How to access services or apps locally?

[META-DREAMER]

Details

Ask your question:

Is there any way we can setup the cluster to allow local access to hajimari etc instead of only going through Cloudflare? When I visit BOOTSTRAP_METALLB_TRAEFIK_ADDR locally it gives me an SSL error

[onedr0p]

This is a pretty big topic and very much depends on what router you are using and what you are comfortable doing in regards to DNS @home. You have some options, and even more than I can sum up here:

• Use your /etc/hosts and have a override for your local domains, then delete the entry from cloudflare so it's internal only. But this means all devices on your network need to have a host file with the same entries to access the services.
• Use split-brain DNS on your router or pihole or whatever and have a host override for your domain so the traffic never leaves your home network, then delete the entry from cloudflare so it's internal only and only manage services you want to be external in cloudflare.
• Almost the same as above but use NAT reflection.
• Check out how I manage DNS @home

[onedr0p]

@META-DREAMER I am going to re-open this issue and pin it. It's a pretty common topic for people to discuss.

[MrMarble]

I am currently using Pi-hole as my DNS server at home. I have configured in dnsmasq a redirect from my domain to the Metallb traefik IP. Then I can configure the entry for any app to be external or not with an annotation to create the Cloudflare record, but it will be accessible from my local network either way.

Example dnsmasq config:
address=/public-domain.com/192.168.1.220

Example ingress config:

ingress:
  enabled: true
  ingressClassName: "traefik"
  annotations:
    hajimari.io/icon: "home-assistant"
    cert-manager.io/cluster-issuer: "letsencrypt-production"
    traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
    external-dns.alpha.kubernetes.io/target: "${SECRET_DOMAIN}"  # Only needed if external access is required
    external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"  # Only needed if external access is required

There may be better ways to do it, but this one was easy and has worked for me so far.

[onedr0p]

With #288 and #287 implemented I am going to close this issue. The docs were updated to reflect these changes on how it works.