Expose Mumble on Funkfeuer address via direct Service

apps/mumble/README.md

@@ -7,3 +7,5 @@ The final dump is retained outside Git at `/home/feedc0de/migration-backups/mumb
 `default/mumble-secrets` contains the application's database, SuperUser, and registry passwords. `default/mumble-postgres` is generated once by the source repository's guarded bootstrap helper: a random PostgreSQL administrator password plus the existing Mumble database password. Neither Secret is in this public repository. Preserve and back up these Secrets with the new PostgreSQL PVC. The certificate remains `default/brunner-ninja-tls`, managed separately by cert-manager. No Mumble PVC exists; durable Mumble state is in PostgreSQL.
 
 The Service retains TCP/UDP port 64738 and the MikroTik operator annotations. Kubernetes/MetalLB should allocate the LoadBalancer address; the operator follows it. The old `192.168.0.14` pin is not a GitOps value. Do not delete the Service to change addressing. During a PostgreSQL restore, pause Argo auto-sync or scale the Mumble Application only with a recorded recovery plan, then resume once data is consistent.
+
+The separate `mumble-direct` Service exposes TCP and UDP 64738 on the existing Funkfeuer/OLSR address `10.12.4.170` on `arschrock`. It uses cluster-wide endpoint routing to reach the ready Mumble pod even when that pod is on an Odroid. The original `mumble` LoadBalancer Service retains its `Local` traffic policy, LAN address, and MikroTik forwarding. A client needs an OLSR route to `10.12.4.170`; the direct entry point also depends on `arschrock` being online.

apps/mumble/values.yaml

@@ -21,6 +21,10 @@ service:
     metallb.io/address-pool: default
     mikrotik.brunner.ninja/router: newgw
     mikrotik.brunner.ninja/forwardings: '[{"name":"tcp","servicePort":"mumble-tcp","dstAddressList":"WANs"},{"name":"udp","servicePort":"mumble-udp","dstAddressList":"WANs"}]'
+directAccess:
+  enabled: true
+  externalIPs:
+    - 10.12.4.170
 postgresql:
   enabled: true
   auth: