Menu
Cloudflare Tunnel and Access configuration for exposing K3s services externally.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Ansible playbook structure, tags, topology rules, branch switching, and operational foot-guns for the K3s cluster.
ArgoCD operations on the K3s cluster — branch repointing via ansible, OCI Helm chart wiring foot-guns (oci:// prefix breaks chart-name resolution), and the InvalidSpecError cache bounce.
Architecture decisions and historical reversals for this repo's bwrap-based Claude sandbox. Covers real claude off PATH, container-scoped PATs, Ubuntu-24.04 CI bwrap workarounds, dogfood ≈ guest, the `just promote` three-layer model (no JSONC editing), and two walked-back paths (Python orchestration; embedding in python-copier-template). Surface before edits to `.devcontainer/claude-sandbox/{claude-shadow,install.sh,promote.sh}`, `install`, `tests/`, `.github/workflows/ci.yml`, or `.claude/commands/verify-sandbox.md`; or before any suggestion to re-introduce Python tooling, embed in python-copier-template, persist gh/glab PATs across containers, or auto-edit JSONC devcontainer.json.
OAuth2-proxy authentication setup, configuration, and troubleshooting for the K3s cluster.
RKLLama (RK3588 NPU LLM server) operations — pod CLI quirks, model layout, hardware pinning, and the silent-failure modes of `rkllama_client pull`.
Test-driven development with red-green-refactor loop. Use when user wants to build features or fix bugs using TDD, mentions "red-green-refactor", wants integration tests, or asks for test-first development.
| name | cloudflare |
| description | Cloudflare Tunnel and Access configuration for exposing K3s services externally. |
*.gkcluster.org — all subdomains protectedServices exposed via tunnel: grafana, headlamp, open-webui, oauth2-proxy, argocd, echo, supabase (Studio + API)
supabase.gkcluster.org — Studio UI (behind OAuth)supabase-api.gkcluster.org — Kong API gateway (x-brain-key auth, NOT behind OAuth)192.168.1.1), not Cloudflare DNS
systemd-resolved overridden to 1.1.1.1 which broke node01.lan resolutionsudo resolvectl dns enp5s0 192.168.1.1http:// redirect_uri — services behind the
tunnel with ssl_redirect: false generate http:// OAuth callbacks. Dex
static clients must list both http:// and https:// redirect URIs.http://ingress-ingress-nginx-controller.ingress-nginx.svc.cluster.local.
Direct-to-service routes (e.g. http://home.home.svc.cluster.local) bypass
the ingress controller and oauth2-proxy entirely, so auth headers like
X-Auth-Request-Email will be empty. Cloudflare Access still authenticates
(using Google identity), but oauth2-proxy features (email headers, sign-out)
won't work.supabase-api.gkcluster.org) cannot solve Google
SSO. Add a Cloudflare Access Application of type Bypass for that
hostname. Policy order matters: the bypass must evaluate
before the wildcard *.gkcluster.org Access app, otherwise the
wildcard wins and challenges every request. Confirm order in the
dashboard after adding. Reference precedent: brain.gkcluster.org.kubernetes-services/values.yaml — cloudflared toggle and configkubernetes-services/additions/ingress/ — ingress definitions for tunneled services