Route gitea-proxy directly to GKE LB IP, drop CF Access

CF Access was blocking /api/actions/* even with the correct service-token
headers — the gRPC Actions ping endpoint returns 403 through Cloudflare.
Direct connection to the GKE Network LB IP (34.31.145.131) bypasses CF
entirely. Verified /api/actions/ping returns 200 from the LB IP directly.

servers/legion/k8s/gitea-runner/gitea-proxy.yaml

@@ -1,47 +1,39 @@
 ---
-# gitea-proxy — nginx CF Access header-injecting proxy
+# gitea-proxy — plain nginx proxy to GKE Gitea LB IP
 #
-# act_runner cannot add custom HTTP headers, so it can't send the
-# CF-Access-Client-Id / CF-Access-Client-Secret headers that Cloudflare
-# Access requires for service-to-service access to git.neuralplatform.ai.
+# Routes directly to the GKE Network LB IP, bypassing Cloudflare entirely.
+# No CF Access service-token auth needed. The runners can't add custom HTTP
+# headers, so going through Cloudflare Access is not viable for the gRPC
+# Actions ping endpoint (/api/actions/*).
 #
-# This proxy sits in the ci namespace. Runners use:
+# Runners use:
 #   GITEA_INSTANCE_URL: http://gitea-proxy.ci.svc.cluster.local:3000
 #
-# nginx:alpine processes *.conf.template files in /etc/nginx/templates/ via
-# envsubst at startup — so CF Access credentials come from the Secret as env
-# vars and get interpolated into the nginx config before nginx starts.
+# The GKE Gitea LB IP (34.31.145.131) is the external IP of the
+# gitea Service in the gitea namespace on the GKE cluster.
 apiVersion: v1
 kind: ConfigMap
 metadata:
   name: gitea-proxy-config
   namespace: ci
 data:
-  # Placed at /etc/nginx/templates/default.conf.template — nginx:alpine
-  # runs envsubst on this and writes the result to /etc/nginx/conf.d/default.conf
-  default.conf.template: |
+  default.conf: |
     server {
       listen 3000;
 
       location / {
-        proxy_pass          https://git.neuralplatform.ai;
+        # Direct to GKE Gitea LB IP — bypasses Cloudflare/CF Access entirely.
+        proxy_pass http://34.31.145.131;
 
-        # Inject CF Access service-token headers so Cloudflare lets
-        # the request through without interactive auth.
-        proxy_set_header CF-Access-Client-Id     "${CF_ACCESS_CLIENT_ID}";
-        proxy_set_header CF-Access-Client-Secret "${CF_ACCESS_CLIENT_SECRET}";
-
-        # Send SNI so Cloudflare routes the TLS connection correctly.
-        proxy_ssl_server_name on;
-
-        # Preserve Host so Gitea/CF edge routes correctly.
+        # Tell Gitea which hostname it's being served as so self-referencing
+        # URLs (clone URLs, webhook URLs) are generated correctly.
         proxy_set_header Host git.neuralplatform.ai;
 
         # Forward all original request headers (auth tokens, etc).
         proxy_pass_request_headers on;
 
         # Rewrite Location headers in redirects back to the proxy URL.
-        proxy_redirect https://git.neuralplatform.ai/
+        proxy_redirect http://34.31.145.131/
                        http://gitea-proxy.ci.svc.cluster.local:3000/;
 
         # Standard proxy headers.
@@ -54,32 +46,6 @@ data:
       }
     }
 ---
-# ExternalSecret — CF Access service token for the proxy
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: gitea-proxy-secret
-  namespace: ci
-  annotations:
-    force-sync: "2026-05-05-sni-fix"
-spec:
-  refreshInterval: 1h
-  secretStoreRef:
-    name: vault
-    kind: ClusterSecretStore
-  target:
-    name: gitea-proxy-secret
-    creationPolicy: Owner
-  data:
-    - secretKey: CF_ACCESS_CLIENT_ID
-      remoteRef:
-        key: secret/data/gitea-runner-cf-access
-        property: client_id
-    - secretKey: CF_ACCESS_CLIENT_SECRET
-      remoteRef:
-        key: secret/data/gitea-runner-cf-access
-        property: client_secret
----
 # Deployment
 apiVersion: apps/v1
 kind: Deployment
@@ -98,7 +64,7 @@ spec:
       labels:
         app: gitea-proxy
       annotations:
-        config-version: "2026-05-05-sni-fix"
+        config-version: "2026-05-05-direct-lb"
     spec:
       containers:
         - name: nginx
@@ -106,11 +72,8 @@ spec:
           ports:
             - containerPort: 3000
           volumeMounts:
-            - name: config-template
-              mountPath: /etc/nginx/templates
-          envFrom:
-            - secretRef:
-                name: gitea-proxy-secret
+            - name: config
+              mountPath: /etc/nginx/conf.d
           resources:
             requests:
               cpu: 50m
@@ -119,7 +82,7 @@ spec:
               cpu: 200m
               memory: 64Mi
       volumes:
-        - name: config-template
+        - name: config
           configMap:
             name: gitea-proxy-config
 ---