Add LAN access via CARP and relayd

- Add cert-manager for self-signed TLS certificates
- Create wildcard cert for *.f3s.lan.buetow.org
- Add LAN ingress to Navidrome (navidrome.f3s.lan.buetow.org)
- Document FreeBSD relayd configuration for LAN access
- Add comprehensive setup guide

LAN access uses existing CARP VIP (192.168.1.138) on f0/f1
with relayd forwarding HTTP/HTTPS to k3s Traefik NodePorts.
External access via OpenBSD relayd continues unchanged.

2 files changed, 61 insertions, 1 deletions

diff --git a/f3s/navidrome/helm-chart/README.md b/f3s/navidrome/helm-chart/README.md
index bee6058..1c0a319 100644
--- a/f3s/navidrome/helm-chart/README.md
+++ b/f3s/navidrome/helm-chart/README.md
@@ -7,9 +7,47 @@ This directory contains the Kubernetes configuration for deploying Navidrome, a
 - **Application**: Navidrome
 - **Image**: `deluan/navidrome:latest`
 - **Namespace**: `services`
-- **Ingress**: `navidrome.f3s.buetow.org`
+- **External Ingress**: `navidrome.f3s.buetow.org` (via OpenBSD relayd)
+- **LAN Ingress**: `navidrome.f3s.lan.buetow.org` (via FreeBSD CARP + relayd)
 - **Port**: 4533
 
+## Access Methods
+
+### External Access (Internet)
+
+Access from anywhere via `https://navidrome.f3s.buetow.org`:
+- Routes through OpenBSD relayd (WireGuard tunnel)
+- TLS certificates managed by Let's Encrypt
+- Available from internet-connected devices
+
+### LAN Access (Local Network)
+
+Access from local network via `https://navidrome.f3s.lan.buetow.org`:
+- Routes through FreeBSD CARP VIP (192.168.1.138) with relayd
+- TLS certificates managed by cert-manager (self-signed)
+- Direct access without WireGuard overhead
+- Requires DNS configuration and CA certificate trust (see below)
+
+#### DNS Configuration for LAN
+
+Add to your DNS server or `/etc/hosts`:
+
+```
+192.168.1.138  navidrome.f3s.lan.buetow.org
+```
+
+#### Trusting Self-Signed CA
+
+To avoid browser warnings, install the f3s LAN CA certificate:
+
+1. Export CA from k3s:
+   ```bash
+   cd /home/paul/git/conf/f3s/cert-manager
+   just export-ca
+   ```
+
+2. Install on your device (see `cert-manager/README.md` for platform-specific instructions)
+
 ## Storage
 
 Navidrome requires two persistent volumes:
diff --git a/f3s/navidrome/helm-chart/templates/ingress.yaml b/f3s/navidrome/helm-chart/templates/ingress.yaml
index e8d94c6..f8d674c 100644
--- a/f3s/navidrome/helm-chart/templates/ingress.yaml
+++ b/f3s/navidrome/helm-chart/templates/ingress.yaml
@@ -18,3 +18,25 @@ spec:
                 name: navidrome-service
                 port:
                   number: 4533
+---
+# LAN Ingress for navidrome.f3s.lan.buetow.org
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: navidrome-ingress-lan
+  namespace: services
+  annotations:
+    spec.ingressClassName: traefik
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+spec:
+  rules:
+    - host: navidrome.f3s.lan.buetow.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: navidrome-service
+                port:
+                  number: 4533