https://www.sirmysterion.com/tags/dns/Recent content in Dns on Thomas PetersHugoenthomas@tnepeters.com (Thomas Peters)thomas@tnepeters.com (Thomas Peters)<a href="https://creativecommons.org/licenses/by-nc/4.0/" target="_blank" rel="noopener">CC BY-NC 4.0</a>Fri, 16 Oct 2026 22:41:02 -0600https://www.sirmysterion.com/posts/20260928-split-horizon-dns-gateway-api-external-dns/Mon, 28 Sep 2026 00:00:00 +0000thomas@tnepeters.com (Thomas Peters)https://www.sirmysterion.com/posts/20260928-split-horizon-dns-gateway-api-external-dns/<h1 id="the-problem">The Problem</h1> <p>Everything in my cluster serves HTTPS under <code>*.sirmysterion.com</code>, but the audiences differ: ArgoCD and Grafana are for me, on my network (or VPN); the blog and Immich are for the internet. I want one mechanism where &ldquo;make this public&rdquo; is a small change on the app, not a separate ingress stack, not manual DNS records, and definitely not exposing the admin tools because a wildcard record points at everything.</p>