From be0508037a0144576e43c0cc0c26919b9e6b3392 Mon Sep 17 00:00:00 2001
From: Will Anderson <will.anderson@neurontechnologies.ai>
Date: Mon, 4 May 2026 20:56:29 +0000
Subject: [PATCH] fix(dharma): drop letsencrypt certResolver from IngressRoute

---
 servers/legion/k8s/gitea-runner/Dockerfile           | 12 +++++++-----
 .../k8s/neuron-technologies/dharma/ingressroute.yaml |  5 +++--
 2 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/servers/legion/k8s/gitea-runner/Dockerfile b/servers/legion/k8s/gitea-runner/Dockerfile
index 1a72f75..b1ba306 100644
--- a/servers/legion/k8s/gitea-runner/Dockerfile
+++ b/servers/legion/k8s/gitea-runner/Dockerfile
@@ -29,11 +29,13 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     zstd \
     && rm -rf /var/lib/apt/lists/*
 
-# Node.js 20 LTS — required to execute Forgejo JS actions (checkout, upload-artifact, cache, etc.)
-RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
-    && apt-get install -y nodejs \
-    && npm install -g yarn \
-    && rm -rf /var/lib/apt/lists/*
+# Node.js 20 LTS via binary tarball (nodesource apt repo is unreliable on Ubuntu 24.04)
+RUN NODE_VERSION=20.19.1 \
+    && curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz" \
+       | tar -xJ -C /usr/local --strip-components=1 \
+    && node --version \
+    && npm --version \
+    && npm install -g yarn
 
 # Python 3 + pip + venv
 RUN apt-get update && apt-get install -y --no-install-recommends \
diff --git a/servers/legion/k8s/neuron-technologies/dharma/ingressroute.yaml b/servers/legion/k8s/neuron-technologies/dharma/ingressroute.yaml
index 413333e..291bfa2 100644
--- a/servers/legion/k8s/neuron-technologies/dharma/ingressroute.yaml
+++ b/servers/legion/k8s/neuron-technologies/dharma/ingressroute.yaml
@@ -14,5 +14,6 @@ spec:
       services:
         - name: dharma
           port: 8765
-  tls:
-    certResolver: letsencrypt
+  # TLS terminates at Cloudflare; tunnel reaches Traefik with noTLSVerify.
+  # Traefik websecure entrypoint has its own default cert (no resolver
+  # configured in this cluster), matching every other neuron-prod IngressRoute.