Will Anderson
7aa56dcb1e
The neuron-prod namespace runs a default-deny-all NetworkPolicy and explicit allow-ingress policies for every legitimate service: allow-mcp-ingress, allow-rest-ingress, allow-marketing-ingress, allow-daemon-ingress, allow-engram-ingress. There was no equivalent for dharma — so every request that arrived at Traefik in kube-system got 502'd at the Service-to-pod hop, even though the dharma pod itself was healthy and the IngressRoute was correctly defined. The previous attempt to fix the 502 (PR #1) removed an unrelated nonexistent certResolver from the IngressRoute. That was real but not sufficient — the Traefik routing layer was healthy after that change, but the Service-to-pod NetworkPolicy hop was still denied. This adds allow-dharma-ingress mirroring allow-mcp-ingress: accepts traffic from kube-system (Traefik) and from the neuron-prod namespace itself.
infrastructure
Personal infrastructure-as-code for Legion (k3s home server) and supporting tooling.
| Doc | What it covers |
|---|---|
AGENTS.md |
Full reference: machines, secrets, services, domains, namespaces, common operations |
servers/legion/README.md |
What's running on Legion and how deployment works |
servers/legion/RUNBOOK.md |
Disaster recovery — full restore from scratch |
Quick start
cd servers/legion
direnv allow
terraform plan
terraform apply
Push to servers/ to deploy app changes via Argo CD.