Add arschrock LAN service entrypoints

apps/mumble/README.md

@@ -8,4 +8,4 @@ The final dump is retained outside Git at `/home/feedc0de/migration-backups/mumb
 
 The Service retains TCP/UDP port 64738 and the MikroTik operator annotations. Kubernetes/MetalLB should allocate the LoadBalancer address; the operator follows it. The old `192.168.0.14` pin is not a GitOps value. Do not delete the Service to change addressing. During a PostgreSQL restore, pause Argo auto-sync or scale the Mumble Application only with a recorded recovery plan, then resume once data is consistent.
 
-The separate `mumble-direct` Service exposes TCP and UDP 64738 on the existing Funkfeuer/OLSR address `10.12.4.170` on `arschrock`. It uses cluster-wide endpoint routing to reach the ready Mumble pod even when that pod is on an Odroid. The original `mumble` LoadBalancer Service retains its `Local` traffic policy, LAN address, and MikroTik forwarding. A client needs an OLSR route to `10.12.4.170`; the direct entry point also depends on `arschrock` being online.
+The `service.additionalServices.funkfeuer` chart value creates `mumble-funkfeuer`, exposing TCP and UDP 64738 on `10.12.4.170` (Funkfeuer/OLSR) and `192.168.0.2` (the `arschrock` LAN address). It uses cluster-wide endpoint routing to reach the ready Mumble pod even when that pod is on an Odroid. The original `mumble` LoadBalancer Service retains its `Local` traffic policy, LAN address, and MikroTik forwarding. Funkfeuer clients need an OLSR route to `10.12.4.170`; both direct entry points depend on `arschrock` being online.

apps/mumble/values.yaml

@@ -21,10 +21,13 @@ service:
     metallb.io/address-pool: default
     mikrotik.brunner.ninja/router: newgw
     mikrotik.brunner.ninja/forwardings: '[{"name":"tcp","servicePort":"mumble-tcp","dstAddressList":"WANs"},{"name":"udp","servicePort":"mumble-udp","dstAddressList":"WANs"}]'
-directAccess:
-  enabled: true
-  externalIPs:
-    - 10.12.4.170
+  additionalServices:
+    funkfeuer:
+      spec:
+        type: ClusterIP
+        externalIPs:
+          - 10.12.4.170
+          - 192.168.0.2
 postgresql:
   enabled: true
   auth:

apps/traefik/README.md

@@ -8,6 +8,13 @@ observed by the MikroTik operator; do not pin it here. Those routes include the
 NanoPi and WebSocket endpoint, Growatt, and OpenDTU. Do not restore the
 commented/retired routers from the former local configuration.
 
+The operator forwards WAN traffic to the dynamically allocated LoadBalancer
+address from MetalLB's `192.168.0.10–49` L2 pool. The separate
+`traefik-funkfeuer` Service also exposes ports 80/443 at `192.168.0.2` for
+direct LAN access and `10.12.4.170` for OLSR access. Those fixed entrypoints
+depend on `arschrock` being online; Traefik replicas may run on the Odroids
+because the additional Service uses cluster-wide endpoint routing.
+
 Traefik CRDs and Gateway API CRDs are cluster-wide prerequisites. Keep the
 existing CRDs during adoption and upgrades; they are not safe cleanup targets.
 Application-specific ingress resources remain with their owning application.

apps/traefik/values.yaml

@@ -36,6 +36,7 @@ service:
         type: ClusterIP
         externalIPs:
         - 10.12.4.170
+        - 192.168.0.2
 accessLog:
   enabled: true
   format: json