Route demo app through Ingress at demo.ahmza.com

apps/demo/ingress.yaml

@@ -0,0 +1,28 @@
+# Routes requests for demo.ahmza.com through ingress-nginx (docs/11-ingress.md)
+# to the demo Service's ClusterIP, on ingress-nginx's one shared address
+# (10.10.60.12) instead of this app having its own dedicated MetalLB address.
+#
+# No ingressClassName is set here because apps/ingress-nginx/values.yaml
+# marks its IngressClass as this cluster's default — the same "don't repeat
+# yourself" convenience Longhorn gives PVCs that don't name a
+# storageClassName.
+#
+# No TLS yet — see docs/12-cert-manager.md for adding a real HTTPS
+# certificate for this exact hostname.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: demo
+  namespace: demo
+spec:
+  rules:
+    - host: demo.ahmza.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: demo
+                port:
+                  number: 80

apps/demo/service.yaml

@@ -3,28 +3,18 @@
 # time. This Service selects any Pod labelled app: demo (see
 # deployment.yaml) and forwards traffic to it.
 #
-# type: LoadBalancer asks the cluster for a real, dedicated IP address that
+# type is omitted here, so Kubernetes defaults to ClusterIP — reachable
-# anything on your network can reach directly. On a cloud provider that
+# only from inside the cluster, no dedicated address of its own. That's
-# would provision an actual cloud load balancer; on bare metal there's
+# deliberate now: docs/11-ingress.md routes this app through ingress-nginx's
-# nothing to provision it, which is exactly the gap MetalLB
+# one shared address (10.10.60.12) by hostname instead, via ingress.yaml
-# (apps/metallb.yaml) fills — it watches for LoadBalancer Services and
+# in this same folder. Compare with apps/whoami/service.yaml (deleted, but
-# hands them an address from the pool configured in
+# see docs/08) for what a dedicated type: LoadBalancer Service looked like.
-# apps/metallb/templates/ipaddresspool.yaml. Until that pool exists, this
-# Service's address will show as <pending>; see docs/05-metallb.md.
 apiVersion: v1
 kind: Service
 metadata:
   name: demo
   namespace: demo
-  annotations:
-    # Requests this specific address from MetalLB's pool, so it stays
-    # predictable across rebuilds instead of getting whatever's next free.
-    # Must fall inside the range in
-    # apps/metallb/templates/ipaddresspool.yaml, or MetalLB will never
-    # satisfy the request.
-    metallb.io/loadBalancerIPs: "10.10.60.11"
 spec:
-  type: LoadBalancer
   selector:
     app: demo
   ports:

docs/network.md

@@ -49,13 +49,28 @@ This dedicated service range is advertised to the MikroTik at
 | Address | What | Namespace | Port(s) | URL | Source |
 |---|---|---|---|---|---|
 | `10.10.60.10` | Argo CD UI/API (`argocd-server`) | `argocd` | 443 | `https://10.10.60.10` | Patched to `LoadBalancer` by hand — see [`docs/05-metallb.md`](05-metallb.md) |
-| `10.10.60.11` | Demo app | `demo` | 80 | `http://10.10.60.11` | [`apps/demo/service.yaml`](../apps/demo/service.yaml) |
 | `10.10.60.12` | ingress-nginx (shared, routes by hostname) | `ingress-nginx` | 80, 443 | `http://10.10.60.12`, `https://10.10.60.12` | [`apps/ingress-nginx/values.yaml`](../apps/ingress-nginx/values.yaml) — see [`docs/11-ingress.md`](11-ingress.md) |
 
-Add a row here every time you add a new app with a `LoadBalancer` Service
+Add a row here every time you add a new app with its own dedicated
-(see [`docs/08-adding-new-apps.md`](08-adding-new-apps.md)). Leave the URL
+`LoadBalancer` Service (see [`docs/08-adding-new-apps.md`](08-adding-new-apps.md)).
-column's port number off only when it's the protocol default (80 for
+Most apps should route through ingress-nginx by hostname instead — see the
-`http://`, 443 for `https://`) — include it otherwise.
+table below — and only need a dedicated address if they can't speak HTTP
+(a raw TCP service, for example). Leave the URL column's port number off
+only when it's the protocol default (80 for `http://`, 443 for `https://`)
+— include it otherwise.
+
+## Hostnames routed through ingress-nginx
+
+Every real DNS record pointing at ingress-nginx's shared address
+(`10.10.60.12`), and which app it reaches. All hosted on Cloudflare.
+
+| Hostname | App | Namespace | TLS | Source |
+|---|---|---|---|---|
+| `demo.ahmza.com` | Demo app | `demo` | Not yet — see [`docs/12-cert-manager.md`](12-cert-manager.md) | [`apps/demo/ingress.yaml`](../apps/demo/ingress.yaml) |
+
+Add a row here every time you point a new hostname at this cluster (see
+[`docs/11-ingress.md`](11-ingress.md)). The DNS record itself lives in
+Cloudflare, not in this repo — this table is just the log of what's real.
 
 ## Free in the pool