# Label and annotation keys (dns., auth., net., hardware., storage., renner.uno/...): API names, not served names. Never part of a URL or a longer host.
(^|[^/a-z0-9.-])([a-z0-9-]+\.)*renner\.uno/[a-z0-9.-]+(: |":|"|!=|$)
# IngressClass controller name of authentik-gate-sync: an identifier, not a host.
controller: renner\.uno/authentik-gate
# Image references: Gitea's registry is the pull source on every site.
(image|repository|container_image): "?gitea\.renner\.uno/
# Registry host package-retention matches running image references against; images keep gitea.renner.uno.
- name: REGISTRY_HOST value: gitea\.renner\.uno$
# Renovate host rule for the registry images keep pulling from.
"matchHost":"gitea\.renner\.uno"
# Flux Git source URL.
url: https://gitea\.renner\.uno/konairius/homelab\.git
# Email addresses.
[A-Za-z0-9._-]+@([a-z0-9-]+\.)*renner\.uno
# API group of the KumaMonitor CRD (kuma-sync): an API name, not a host.
(name: kuma(monitors|statuspages)\.|group: |apiGroups: \["|- )uptime\.renner\.uno("\]|$)
# Hosts outside the cluster: UDM, NAS, NetBird controller and its edge proxies, Uptime Kuma on the NetBird VPS.
(^|[^a-z0-9.-])(udm|nas-1|nas-2|netbird|proxy-1|proxy-2|proxy-\[12\]|kuma)\.renner\.uno
# Node and VM names outside the cluster (*.srv), including authentik's brand domain.
(^|[^a-z0-9.-])[a-z0-9-]+\.srv\.renner\.uno
# IoT VLAN devices and the IoT DNS suffix the UDM serves (shelly-manager DnsSuffix).
(^|[^a-z0-9.-])([a-z0-9-]+\.)?iot\.renner\.uno
# SMLIGHT Zigbee/Thread coordinators on the LAN.
(^|[^a-z0-9.-])slzb-[a-z]+\.renner\.uno
# Matrix (Synapse, MAS, Element, Element Call) is out of scope and keeps its production names.
(^|[^a-z0-9.-])(account\.matrix|rtc\.matrix|turn\.matrix|matrix|element)\.renner\.uno
# Matrix MAS upstream issuer: Matrix config is out of scope.
https://auth\.renner\.uno/application/o/matrix/
# authentik identifier of an object in the restored database: the retired Caddy provider.
name: Caddy docs\.renner\.uno
# Prose naming the public zone's wildcard record (Cloudflare, outside the cluster).
\*\.renner\.uno wildcard
# Hermes SOUL.md prose (configMapGenerator: a substituted file changes the hashed name and restarts production). Hermes' tea login and git credential helper read ${SITE_DOMAIN}.
hostnames under `renner\.uno` through Traefik
Gitea \(`https://gitea\.renner\.uno`\) as `hermes-bot`
Home Assistant \(`https://home\.renner\.uno`\) as your own admin user
# Hermes ha-updates skill files (configMapGenerator, as SOUL.md): the script's default is overridden by HA_URL, which reads ${SITE_DOMAIN}.
os\.environ\.get\("HA_URL", "https://home\.renner\.uno"\)
`https://gitea\.renner\.uno/konairius/homeassistant` \(git authenticates as
# Hermes alert-monitor skill files (configMapGenerator, as SOUL.md): the script default is overridden by GITEA_API, which reads ${SITE_DOMAIN}.
GITEA = os\.environ\.get\("GITEA_API", "https://gitea\.renner\.uno/api/v1/repos/konairius/homelab"\)
`https://gitea\.renner\.uno/konairius/homelab` read-only\):
# Alert-only regex (openbao health PrometheusRule and blackbox exclusion, hermes blackbox exclusion); inert on the test site.
https://hermes\.renner\.uno/api/status"
https://openbao\.renner\.uno/v1/sys/health\.\*("|\|)
# Alert-only regex (blackbox probe-failure exclusion of ci); inert on the test site.
https://ci\.renner\.uno\|
