feat(ingress): replace traefik crowdsec plugin with firewall bouncer

Move L3 enforcement to the host firewall-bouncer (systemd, nftables): drop the Traefik plugin, its secrets volume and the crowdsec Middleware, remove bouncer refs from all IngressRoutes. Disable the http-generic-bf scenario (403-burst bans hurt legit automation under L3 enforcement). Add a Gateway API PoC for homepages prod and CrowdSec PrometheusRule alerts.

homepages/k8s/gateway.yaml

@@ -0,0 +1,31 @@
+# Gateway API PoC for homepages. Lives next to the TLS secrets so
+# certificateRefs stay same-namespace and no ReferenceGrant is needed.
+# Listener ports must match the Traefik entryPoints (80/443),
+# otherwise Traefik marks the listener Invalid.
+# Local .internal hosts are deliberately left on IngressRoute,
+# only prod is migrated here.
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: homepages
+  namespace: homepages
+spec:
+  gatewayClassName: traefik
+  listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - name: https
+      protocol: HTTPS
+      port: 443
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - name: forust-homepage-prod-tls
+          - name: xdfnx-homepage-prod-tls
+      allowedRoutes:
+        namespaces:
+          from: Same

homepages/k8s/httproute.yaml

@@ -0,0 +1,69 @@
+# PoC: homepages prod hosts via Gateway API.
+# Runs alongside k8s/ingress.yaml - delete the prod IngressRoutes only after verification.
+# There are no local .internal hosts here, they stay on the local IngressRoute.
+# No per-route security middlewares: L3 enforcement moved to the host
+# firewall bouncer, so HTTPRoutes stay clean.
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: homepages-http-redirect
+  namespace: homepages
+spec:
+  parentRefs:
+    - name: homepages
+      kind: Gateway
+      sectionName: http
+  hostnames:
+    - forust.xyz
+    - www.forust.xyz
+    - xdfnx.cfd
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: forust-homepage-https
+  namespace: homepages
+spec:
+  parentRefs:
+    - name: homepages
+      kind: Gateway
+      sectionName: https
+  hostnames:
+    - forust.xyz
+    - www.forust.xyz
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: forust-homepage-service
+          port: 80
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: xdfnx-homepage-https
+  namespace: homepages
+spec:
+  parentRefs:
+    - name: homepages
+      kind: Gateway
+      sectionName: https
+  hostnames:
+    - xdfnx.cfd
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: xdfnx-homepage-service
+          port: 80

homepages/k8s/ingress.yaml

@@ -9,9 +9,6 @@ spec:
   routes:
     - match: Host(`forust.xyz`) || Host(`www.forust.xyz`)
       kind: Rule
-      middlewares:
-        - name: crowdsec-bouncer
-          namespace: crowdsec
       priority: 10
       services:
         - name: forust-homepage-service
@@ -49,9 +46,6 @@ spec:
   routes:
     - match: Host(`xdfnx.cfd`)
       kind: Rule
-      middlewares:
-        - name: crowdsec-bouncer
-          namespace: crowdsec
       services:
         - name: xdfnx-homepage-service
           port: 80