菜单
Cloudflare Tunnel and Access configuration for exposing K3s services externally.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Ansible playbook structure, tags, topology rules, branch switching, and operational foot-guns for the K3s cluster.
ArgoCD operations on the K3s cluster — branch repointing via ansible, OCI Helm chart wiring foot-guns (oci:// prefix breaks chart-name resolution), and the InvalidSpecError cache bounce.
Architecture decisions and historical reversals for this repo's bwrap-based Claude sandbox. Covers real claude off PATH, container-scoped PATs, Ubuntu-24.04 CI bwrap workarounds, dogfood ≈ guest, the `just promote` three-layer model (no JSONC editing), and two walked-back paths (Python orchestration; embedding in python-copier-template). Surface before edits to `.devcontainer/claude-sandbox/{claude-shadow,install.sh,promote.sh}`, `install`, `tests/`, `.github/workflows/ci.yml`, or `.claude/commands/verify-sandbox.md`; or before any suggestion to re-introduce Python tooling, embed in python-copier-template, persist gh/glab PATs across containers, or auto-edit JSONC devcontainer.json.
OAuth2-proxy authentication setup, configuration, and troubleshooting for the K3s cluster.
RKLLama (RK3588 NPU LLM server) operations — pod CLI quirks, model layout, hardware pinning, and the silent-failure modes of `rkllama_client pull`.
Test-driven development with red-green-refactor loop. Use when user wants to build features or fix bugs using TDD, mentions "red-green-refactor", wants integration tests, or asks for test-first development.
| name | cloudflare |
| description | Cloudflare Tunnel and Access configuration for exposing K3s services externally. |
*.gkcluster.org — all subdomains protectedServices exposed via tunnel: grafana, headlamp, open-webui, oauth2-proxy, argocd, echo, supabase (Studio + API)
supabase.gkcluster.org — Studio UI (behind OAuth)supabase-api.gkcluster.org — Kong API gateway (x-brain-key auth, NOT behind OAuth)192.168.1.1), not Cloudflare DNS
systemd-resolved overridden to 1.1.1.1 which broke node01.lan resolutionsudo resolvectl dns enp5s0 192.168.1.1http:// redirect_uri — services behind the
tunnel with ssl_redirect: false generate http:// OAuth callbacks. Dex
static clients must list both http:// and https:// redirect URIs.http://ingress-ingress-nginx-controller.ingress-nginx.svc.cluster.local.
Direct-to-service routes (e.g. http://home.home.svc.cluster.local) bypass
the ingress controller and oauth2-proxy entirely, so auth headers like
X-Auth-Request-Email will be empty. Cloudflare Access still authenticates
(using Google identity), but oauth2-proxy features (email headers, sign-out)
won't work.supabase-api.gkcluster.org) cannot solve Google
SSO. Add a Cloudflare Access Application of type Bypass for that
hostname. Policy order matters: the bypass must evaluate
before the wildcard *.gkcluster.org Access app, otherwise the
wildcard wins and challenges every request. Confirm order in the
dashboard after adding. Reference precedent: brain.gkcluster.org.kubernetes-services/values.yaml — cloudflared toggle and configkubernetes-services/additions/ingress/ — ingress definitions for tunneled services