From 184970388696c594ebd517352b5439845817fc56 Mon Sep 17 00:00:00 2001
From: Jeffrey Smeets <jeffreysmeets@jsme.be>
Date: Wed, 26 Aug 2026 20:41:28 +0200
Subject: [PATCH] pelican: expose the panel on the public gateway

Adds a pelican listener to gateway-public and a gateway-public parentRef to
pelican-route. Reuses the existing pelican-tls certificate, which both
listeners reference.

Wings deliberately stays internal-only. That is a real functional limit, not
an oversight: the browser talks to wings directly for the console websocket
and for file upload/download, using the address from Node::getConnectionAddress.
From outside the LAN those calls will fail. Panel login, server list, file
browsing and editing, and power actions all go through the panel API and keep
working, because the panel reaches wings server-side over the internal gateway.

CrowdSec ext_authz already covers every listener on gateway-public, so the
panel is behind the WAF and community blocklist from the moment it is live.

Prerequisites completed first: TRUSTED_PROXIES=10.42.0.0/16 and
APP_2FA_REQUIRED=1 set in Infisical and verified live in the panel config.

pelican.jsme.be has no public DNS record yet, so this makes the panel reachable
through 10.8.11.105 but not from the internet. The Azure DNS CNAME in the
OpenTofu repo is the actual cutover.
---
 applications/pelican/pelican-httproute.yaml   |  5 +++++
 infra/envoy-gateway/kustomization.yaml        |  6 ++++++
 .../pelican/pelican-gateway-public-patch.yaml | 19 +++++++++++++++++++
 3 files changed, 30 insertions(+)
 create mode 100644 infra/envoy-gateway/pelican/pelican-gateway-public-patch.yaml

diff --git a/applications/pelican/pelican-httproute.yaml b/applications/pelican/pelican-httproute.yaml
index eb8d290..39ec532 100644
--- a/applications/pelican/pelican-httproute.yaml
+++ b/applications/pelican/pelican-httproute.yaml
@@ -10,6 +10,11 @@ spec:
       name: gateway-internal
       namespace: envoy-gateway
       sectionName: pelican
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-public
+      namespace: envoy-gateway
+      sectionName: pelican
   hostnames:
     - "pelican.jsme.be"
   rules:
diff --git a/infra/envoy-gateway/kustomization.yaml b/infra/envoy-gateway/kustomization.yaml
index 9eba136..ecb5e98 100644
--- a/infra/envoy-gateway/kustomization.yaml
+++ b/infra/envoy-gateway/kustomization.yaml
@@ -379,6 +379,12 @@ patches:
       kind: Gateway
       name: gateway-public
     path: outline/outline-gateway-public-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-public
+    path: pelican/pelican-gateway-public-patch.yaml
   # Uncomment to expose Grafana publicly — ensure Grafana auth is properly configured first
   # - target:
   #     group: gateway.networking.k8s.io
diff --git a/infra/envoy-gateway/pelican/pelican-gateway-public-patch.yaml b/infra/envoy-gateway/pelican/pelican-gateway-public-patch.yaml
new file mode 100644
index 0000000..920bb3d
--- /dev/null
+++ b/infra/envoy-gateway/pelican/pelican-gateway-public-patch.yaml
@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: pelican
+    protocol: HTTPS
+    port: 443
+    hostname: "pelican.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: pelican
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: pelican-tls
+          namespace: envoy-gateway