From 317f271bf5f28704d99f605d643075dfd532e300 Mon Sep 17 00:00:00 2001
From: rohow <admin@dev.cm>
Date: Tue, 25 Aug 2026 18:18:47 +0800
Subject: [PATCH] feat(k3s): add CDN fallback ingress redirect

---
 flux/apps/post/ingress-cdn.yaml | 45 +++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)

diff --git a/flux/apps/post/ingress-cdn.yaml b/flux/apps/post/ingress-cdn.yaml
index 172cb16..f52e630 100644
--- a/flux/apps/post/ingress-cdn.yaml
+++ b/flux/apps/post/ingress-cdn.yaml
@@ -47,6 +47,51 @@ spec:
                 port:
                   number: 80
 
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: cdn-fallback
+  namespace: infra-net
+  annotations:
+    nginx.ingress.kubernetes.io/use-regex: "true"
+    nginx.ingress.kubernetes.io/enable-cors: "true"
+    nginx.ingress.kubernetes.io/cors-allow-origin: "https://dev.cm, https://*.dev.cm, https://fillcode.cm, https://*.fillcode.cm"
+    nginx.ingress.kubernetes.io/cors-allow-credentials: "true"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      set_by_lua_block $cdn_redirect_prefix {
+        if ngx.var.request_method ~= "GET" and ngx.var.request_method ~= "HEAD" then return "" end
+
+        local source = ngx.var.http_origin
+        if not source or source == "" then source = ngx.var.http_referer end
+
+        local host = source and source:match("^https?://([^/:]+)")
+        if not host or host:lower() == ngx.var.host then return "" end
+
+        local prefix = "/" .. (host:lower():gsub("%.", "-"))
+        local uri = ngx.var.uri
+        if uri == prefix or uri:sub(1, #prefix + 1) == prefix .. "/" then return "" end
+
+        return prefix
+      }
+      add_header Cache-Control "no-store" always;
+      if ($cdn_redirect_prefix != "") {
+        return 302 https://$host$cdn_redirect_prefix$request_uri;
+      }
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: cdn.fillcode.com
+      http:
+        paths:
+          - path: /(.*)
+            pathType: ImplementationSpecific
+            backend:
+              service:
+                name: ingress-nginx-defaultbackend
+                port:
+                  number: 80
+
 ---
 apiVersion: v1
 kind: Service