- gitea-web/gitea-sshd ClusterIP services: the chart's gitea-http/ssh are HEADLESS
(pod IP 100.64.x) which COLLIDES with the Tailscale CGNAT range 100.64.0.0/10, so the
tailscale-sidecar proxy swallowed the traffic. ClusterIP (10.32.x) fixes it.
- tailscale-proxy: nginx git.fxhnt.ai -> gitea-web:3000; socat :22 -> gitea-sshd:22
(drop :2222, GitLab); GitLab webservice/registry blocks left for Task 4/2C.
- dns git_ip -> 100.95.225.27 (live proxy node); stale 100.90.76.85 duplicate A records
removed across api/chat/dashboard/git/grafana/mail/minio (were causing platform-wide flakiness).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
79f2ad94a4