From f29bb3d580c3343c329793f0d23ac27d4ee41f43 Mon Sep 17 00:00:00 2001 From: mr-forust Date: Wed, 23 Sep 2026 14:42:09 +0200 Subject: [PATCH 1/3] revert: drop Grafana cert-manager dashboard --- .../dashboards/cert-manager-dashboard.yaml | 915 ------------------ 1 file changed, 915 deletions(-) delete mode 100644 prometheus-stack/k8s/dashboards/cert-manager-dashboard.yaml diff --git a/prometheus-stack/k8s/dashboards/cert-manager-dashboard.yaml b/prometheus-stack/k8s/dashboards/cert-manager-dashboard.yaml deleted file mode 100644 index cc53fe3..0000000 --- a/prometheus-stack/k8s/dashboards/cert-manager-dashboard.yaml +++ /dev/null @@ -1,915 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: grafana-dashboard-cert-manager - namespace: prometheus - labels: - grafana_dashboard: "1" - app: cert-manager -data: - cert-manager.json: |- - { - "__elements": {}, - "__requires": [ - { - "type": "grafana", - "id": "grafana", - "name": "Grafana", - "version": "11.2.0" - }, - { - "type": "datasource", - "id": "prometheus", - "name": "Prometheus", - "version": "1.0.0" - }, - { - "type": "panel", - "id": "stat", - "name": "Stat", - "version": "" - }, - { - "type": "panel", - "id": "table", - "name": "Table", - "version": "" - }, - { - "type": "panel", - "id": "timeseries", - "name": "Time series", - "version": "" - } - ], - "annotations": { - "list": [ - { - "builtIn": 1, - "datasource": { - "type": "grafana", - "uid": "-- Grafana --" - }, - "enable": true, - "hide": true, - "iconColor": "rgba(0, 211, 255, 1)", - "name": "Annotations & Alerts", - "type": "dashboard" - } - ] - }, - "description": "The dashboard gives an overview of the SSL certs managed by cert-manager in Kubernetes", - "editable": true, - "fiscalYearStartMonth": 0, - "gnetId": 22908, - "graphTooltip": 0, - "id": null, - "links": [], - "panels": [ - { - "datasource": { - "default": false, - "type": "prometheus", - "uid": "${datasource}" - }, - "description": "The number if available certificates", - "fieldConfig": { - "defaults": { - "color": { - "mode": "thresholds" - }, - "mappings": [], - "noValue": "0", - "thresholds": { - "mode": "absolute", - "steps": [ - { - "color": "green", - "value": null - } - ] - } - }, - "overrides": [] - }, - "gridPos": { - "h": 3, - "w": 3, - "x": 0, - "y": 0 - }, - "id": 1, - "options": { - "colorMode": "value", - "graphMode": "none", - "justifyMode": "auto", - "orientation": "auto", - "percentChangeColorMode": "standard", - "reduceOptions": { - "calcs": [ - "lastNotNull" - ], - "fields": "", - "values": false - }, - "showPercentChange": false, - "textMode": "value", - "wideLayout": true - }, - "pluginVersion": "11.2.0", - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "${datasource}" - }, - "disableTextWrap": false, - "editorMode": "code", - "exemplar": false, - "expr": "count(certmanager_certificate_ready_status{condition=\"True\", namespace=~\"$namespace\"})", - "fullMetaSearch": false, - "includeNullMetadata": true, - "instant": true, - "legendFormat": "__auto", - "range": false, - "refId": "A", - "useBackend": false - } - ], - "title": "Valid Certificates", - "type": "stat" - }, - { - "datasource": { - "name": "${datasource}", - "type": "prometheus", - "uid": "${datasource}" - }, - "description": "", - "fieldConfig": { - "defaults": { - "color": { - "mode": "palette-classic" - }, - "custom": { - "axisBorderShow": false, - "axisCenteredZero": false, - "axisColorMode": "text", - "axisLabel": "", - "axisPlacement": "auto", - "barAlignment": 0, - "barWidthFactor": 0.6, - "drawStyle": "line", - "fillOpacity": 0, - "gradientMode": "none", - "hideFrom": { - "legend": false, - "tooltip": false, - "viz": false - }, - "insertNulls": false, - "lineInterpolation": "linear", - "lineWidth": 1, - "pointSize": 5, - "scaleDistribution": { - "type": "linear" - }, - "showPoints": "never", - "spanNulls": false, - "stacking": { - "group": "A", - "mode": "none" - }, - "thresholdsStyle": { - "mode": "off" - } - }, - "links": [], - "mappings": [], - "min": 0, - "thresholds": { - "mode": "absolute", - "steps": [ - { - "color": "green", - "value": null - }, - { - "color": "red", - "value": 80 - } - ] - }, - "unit": "short" - }, - "overrides": [] - }, - "gridPos": { - "h": 9, - "w": 9, - "x": 3, - "y": 0 - }, - "id": 8, - "options": { - "legend": { - "calcs": [], - "displayMode": "list", - "placement": "right", - "showLegend": true - }, - "tooltip": { - "mode": "multi", - "sort": "none" - } - }, - "pluginVersion": "10.2.3", - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "${datasource}" - }, - "editorMode": "code", - "expr": "sum(certmanager_certificate_ready_status{namespace=~\"$namespace\"}) by (condition,name)>0", - "format": "time_series", - "intervalFactor": 2, - "legendFormat": "{{name}}:{{condition}}", - "range": true, - "refId": "A", - "step": 1800 - } - ], - "title": "Certificate Ready Status", - "type": "timeseries" - }, - { - "datasource": { - "default": false, - "type": "prometheus", - "uid": "${datasource}" - }, - "description": "", - "fieldConfig": { - "defaults": { - "color": { - "mode": "palette-classic" - }, - "custom": { - "axisBorderShow": false, - "axisCenteredZero": false, - "axisColorMode": "text", - "axisLabel": "", - "axisPlacement": "auto", - "barAlignment": 0, - "barWidthFactor": 0.6, - "drawStyle": "line", - "fillOpacity": 10, - "gradientMode": "none", - "hideFrom": { - "legend": false, - "tooltip": false, - "viz": false - }, - "insertNulls": false, - "lineInterpolation": "linear", - "lineWidth": 1, - "pointSize": 5, - "scaleDistribution": { - "type": "linear" - }, - "showPoints": "never", - "spanNulls": false, - "stacking": { - "group": "A", - "mode": "none" - }, - "thresholdsStyle": { - "mode": "off" - } - }, - "links": [], - "mappings": [], - "thresholds": { - "mode": "absolute", - "steps": [ - { - "color": "green", - "value": null - }, - { - "color": "red", - "value": 80 - } - ] - }, - "unit": "short" - }, - "overrides": [] - }, - "gridPos": { - "h": 9, - "w": 12, - "x": 12, - "y": 0 - }, - "id": 10, - "options": { - "legend": { - "calcs": [], - "displayMode": "table", - "placement": "right", - "showLegend": true - }, - "tooltip": { - "mode": "multi", - "sort": "none" - } - }, - "pluginVersion": "10.2.3", - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "${datasource}" - }, - "editorMode": "code", - "expr": "sum(rate(certmanager_http_acme_client_request_count{namespace=~\"$namespace\"}[2m])) BY (status, path)>0", - "legendFormat": "{{status}}:{{path}}", - "range": true, - "refId": "A" - } - ], - "title": "Overall requests per 2m", - "type": "timeseries" - }, - { - "datasource": { - "default": false, - "type": "prometheus", - "uid": "${datasource}" - }, - "description": "The number of certificates that will expire within the next 14 days", - "fieldConfig": { - "defaults": { - "color": { - "mode": "thresholds" - }, - "mappings": [], - "noValue": "0", - "thresholds": { - "mode": "absolute", - "steps": [ - { - "color": "green", - "value": null - }, - { - "color": "#EAB839", - "value": 1 - } - ] - } - }, - "overrides": [] - }, - "gridPos": { - "h": 3, - "w": 3, - "x": 0, - "y": 3 - }, - "id": 3, - "options": { - "colorMode": "value", - "graphMode": "none", - "justifyMode": "auto", - "orientation": "auto", - "percentChangeColorMode": "standard", - "reduceOptions": { - "calcs": [ - "lastNotNull" - ], - "fields": "", - "values": false - }, - "showPercentChange": false, - "textMode": "auto", - "wideLayout": true - }, - "pluginVersion": "11.2.0", - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "${datasource}" - }, - "disableTextWrap": false, - "editorMode": "code", - "exemplar": false, - "expr": "count(certmanager_certificate_expiration_timestamp_seconds{namespace=~\"$namespace\"} < (time()+(14*24*3600)))", - "fullMetaSearch": false, - "includeNullMetadata": true, - "instant": true, - "legendFormat": "{{exported_namespace}}/{{name}}", - "range": false, - "refId": "A", - "useBackend": false - } - ], - "title": "Expiring Certificates", - "type": "stat" - }, - { - "datasource": { - "default": false, - "type": "prometheus", - "uid": "${datasource}" - }, - "description": "Total number of HTTP requests", - "fieldConfig": { - "defaults": { - "color": { - "mode": "thresholds" - }, - "mappings": [], - "noValue": "0", - "thresholds": { - "mode": "absolute", - "steps": [ - { - "color": "text", - "value": null - } - ] - } - }, - "overrides": [] - }, - "gridPos": { - "h": 3, - "w": 3, - "x": 0, - "y": 6 - }, - "id": 2, - "options": { - "colorMode": "value", - "graphMode": "none", - "justifyMode": "auto", - "orientation": "auto", - "percentChangeColorMode": "standard", - "reduceOptions": { - "calcs": [ - "lastNotNull" - ], - "fields": "", - "values": false - }, - "showPercentChange": false, - "textMode": "auto", - "wideLayout": true - }, - "pluginVersion": "11.2.0", - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "${datasource}" - }, - "disableTextWrap": false, - "editorMode": "code", - "exemplar": false, - "expr": "sum(certmanager_http_acme_client_request_count)", - "fullMetaSearch": false, - "includeNullMetadata": true, - "instant": true, - "legendFormat": "__auto", - "range": false, - "refId": "A", - "useBackend": false - } - ], - "title": "Total ACME Requests", - "type": "stat" - }, - { - "datasource": { - "default": false, - "type": "prometheus", - "uid": "${datasource}" - }, - "description": "Time before the certificates expire", - "fieldConfig": { - "defaults": { - "color": { - "mode": "thresholds" - }, - "custom": { - "align": "auto", - "cellOptions": { - "type": "auto" - }, - "inspect": false - }, - "mappings": [], - "min": 0, - "thresholds": { - "mode": "absolute", - "steps": [ - { - "color": "red", - "value": null - }, - { - "color": "orange", - "value": 14 - }, - { - "color": "green", - "value": 30 - }, - { - "color": "dark-green", - "value": 60 - } - ] - }, - "unit": "none" - }, - "overrides": [ - { - "matcher": { - "id": "byName", - "options": "证书有效期（天）" - }, - "properties": [ - { - "id": "thresholds", - "value": { - "mode": "absolute", - "steps": [ - { - "color": "green", - "value": null - }, - { - "color": "semi-dark-red", - "value": 10 - }, - { - "color": "yellow", - "value": 15 - }, - { - "color": "green", - "value": 25 - } - ] - } - }, - { - "id": "custom.align", - "value": "center" - }, - { - "id": "custom.cellOptions", - "value": { - "mode": "gradient", - "type": "color-background" - } - } - ] - }, - { - "matcher": { - "id": "byName", - "options": "自动续费证书时间（天）" - }, - "properties": [ - { - "id": "thresholds", - "value": { - "mode": "absolute", - "steps": [ - { - "color": "green", - "value": null - }, - { - "color": "red", - "value": 10 - }, - { - "color": "yellow", - "value": 15 - }, - { - "color": "green", - "value": 20 - } - ] - } - }, - { - "id": "custom.cellOptions", - "value": { - "type": "color-background" - } - } - ] - } - ] - }, - "gridPos": { - "h": 10, - "w": 12, - "x": 0, - "y": 9 - }, - "id": 5, - "options": { - "cellHeight": "sm", - "footer": { - "countRows": false, - "fields": "", - "reducer": [ - "sum" - ], - "show": false - }, - "showHeader": true - }, - "pluginVersion": "11.2.0", - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "${datasource}" - }, - "editorMode": "code", - "exemplar": false, - "expr": "sort_desc(certmanager_certificate_expiration_timestamp_seconds{namespace=~\"$namespace\"} - time())/(24*3600)", - "format": "table", - "instant": true, - "legendFormat": "{{name}}", - "range": false, - "refId": "A" - }, - { - "datasource": { - "type": "prometheus", - "uid": "${datasource}" - }, - "editorMode": "code", - "exemplar": false, - "expr": "sort(certmanager_certificate_renewal_timestamp_seconds{namespace=~\"$namespace\"} - time())/(24*3600)", - "format": "table", - "hide": false, - "instant": true, - "legendFormat": "__auto", - "range": false, - "refId": "B" - } - ], - "title": "证书有效期", - "transformations": [ - { - "id": "joinByField", - "options": { - "byField": "name", - "mode": "outer" - } - }, - { - "id": "organize", - "options": { - "excludeByName": { - "Time 1": false, - "instance 1": false, - "issuer_group 1": false, - "issuer_name 1": false, - "job 1": false, - "namespace 1": false - }, - "includeByName": {}, - "indexByName": { - "Time 1": 4, - "Time 2": 10, - "Value #A": 2, - "Value #B": 3, - "instance 1": 5, - "instance 2": 11, - "issuer_group 1": 8, - "issuer_group 2": 16, - "issuer_kind 1": 9, - "issuer_kind 2": 12, - "issuer_name 1": 6, - "issuer_name 2": 13, - "job 1": 7, - "job 2": 14, - "name": 0, - "namespace 1": 1, - "namespace 2": 15 - }, - "renameByName": { - "Value #A": "证书有效期（天）", - "Value #B": "自动续费证书时间（天）" - } - } - }, - { - "id": "filterFieldsByName", - "options": { - "include": { - "names": [ - "name", - "namespace 1", - "Value #A", - "Value #B" - ] - } - } - } - ], - "type": "table" - }, - { - "datasource": { - "type": "prometheus", - "uid": "${datasource}" - }, - "description": "Time before the certificates expire", - "fieldConfig": { - "defaults": { - "color": { - "mode": "palette-classic" - }, - "custom": { - "axisBorderShow": false, - "axisCenteredZero": false, - "axisColorMode": "text", - "axisLabel": "", - "axisPlacement": "auto", - "barAlignment": 0, - "barWidthFactor": 0.6, - "drawStyle": "line", - "fillOpacity": 0, - "gradientMode": "none", - "hideFrom": { - "legend": false, - "tooltip": false, - "viz": false - }, - "insertNulls": false, - "lineInterpolation": "linear", - "lineWidth": 1, - "pointSize": 5, - "scaleDistribution": { - "type": "linear" - }, - "showPoints": "auto", - "spanNulls": false, - "stacking": { - "group": "A", - "mode": "none" - }, - "thresholdsStyle": { - "mode": "off" - } - }, - "mappings": [], - "thresholds": { - "mode": "absolute", - "steps": [ - { - "color": "green", - "value": null - } - ] - }, - "unit": "none" - }, - "overrides": [ - { - "__systemRef": "hideSeriesFrom", - "matcher": { - "id": "byNames", - "options": { - "mode": "exclude", - "names": [ - "api-elnkpro-ssl", - "alidns-webhook-tls" - ], - "prefix": "All except:", - "readOnly": true - } - }, - "properties": [ - { - "id": "custom.hideFrom", - "value": { - "legend": false, - "tooltip": false, - "viz": true - } - } - ] - } - ] - }, - "gridPos": { - "h": 10, - "w": 12, - "x": 12, - "y": 9 - }, - "id": 4, - "options": { - "legend": { - "calcs": [], - "displayMode": "list", - "placement": "right", - "showLegend": true - }, - "tooltip": { - "mode": "single", - "sort": "none" - } - }, - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "${datasource}" - }, - "editorMode": "code", - "expr": "(certmanager_certificate_expiration_timestamp_seconds{namespace=~\"$namespace\"} - time())/(24*3600)", - "instant": false, - "legendFormat": "{{name}}", - "range": true, - "refId": "A" - } - ], - "title": "证书到期时间", - "type": "timeseries" - } - ], - "schemaVersion": 39, - "tags": [ - "k8s", - "cert-manager" - ], - "templating": { - "list": [ - { - "current": {}, - "hide": 0, - "includeAll": false, - "multi": false, - "name": "datasource", - "options": [], - "query": "prometheus", - "queryValue": "", - "refresh": 1, - "regex": "/^.*k8s/", - "skipUrlSync": false, - "type": "datasource" - }, - { - "allValue": ".*", - "current": {}, - "datasource": { - "type": "prometheus", - "uid": "${datasource}" - }, - "definition": "label_values(certmanager_certificate_expiration_timestamp_seconds,namespace)", - "hide": 0, - "includeAll": true, - "multi": false, - "name": "namespace", - "options": [], - "query": { - "qryType": 1, - "query": "label_values(certmanager_certificate_expiration_timestamp_seconds,namespace)", - "refId": "PrometheusVariableQueryEditor-VariableQuery" - }, - "refresh": 1, - "regex": "", - "skipUrlSync": false, - "sort": 0, - "type": "query" - } - ] - }, - "time": { - "from": "now-5m", - "to": "now" - }, - "timepicker": {}, - "timezone": "browser", - "title": "Cert-manager-Kubernetes", - "uid": "cert-manager-overview", - "version": 15, - "weekStart": "" - } From bc1e69ebe0b0ebb07fe82586d648c0f667fcb4fb Mon Sep 17 00:00:00 2001 From: mr-forust Date: Wed, 23 Sep 2026 14:45:05 +0200 Subject: [PATCH 2/3] feat(tls): internal CA wildcard for *.internal routes Selfsigned root (10y) + internal-ca issuer; per-namespace internal-wildcard-tls certs referenced by all -local routers. Root public cert committed for client trust stores. --- adguardhome/k8s/ingress.yaml | 2 + adguardhome/k8s/internal-certificate.yaml | 15 +++++++ authentik/k8s/certificates.yaml | 16 +++++++ authentik/k8s/ingress.yaml | 2 + cert-manager/k8s/homelab-internal-root-ca.crt | 30 +++++++++++++ cert-manager/k8s/internal-ca.yaml | 33 ++++++++++++++ checkmk/k8s/certificates.yaml | 16 +++++++ checkmk/k8s/ingress.yaml | 2 + converters/k8s/certificates.yaml | 16 +++++++ converters/k8s/ingress.yaml | 5 +++ dockmon/k8s/certificates.yaml | 16 +++++++ dockmon/k8s/ingress.yaml | 2 + downtify/k8s/ingress.yaml | 2 + downtify/k8s/internal-certificate.yaml | 15 +++++++ gitea/k8s/certificates.yaml | 16 +++++++ gitea/k8s/ingress.yaml | 3 ++ glance/k8s/certificates.yaml | 16 +++++++ glance/k8s/ingress.yaml | 3 ++ headscale/k8s/routing/certificates.yaml | 16 +++++++ headscale/k8s/routing/ingress.yaml | 5 +++ homepages/k8s/certificates.yaml | 16 +++++++ homepages/k8s/ingress.yaml | 5 +++ kener/k8s/ingress.yaml | 2 + kener/k8s/internal-certificate.yaml | 15 +++++++ metube/k8s/certificates.yaml | 16 +++++++ metube/k8s/ingress.yaml | 2 + n8n/k8s/ingress.yaml | 2 + n8n/k8s/internal-certificate.yaml | 15 +++++++ netronome/k8s/certificates.yaml | 16 +++++++ netronome/k8s/ingress.yaml | 2 + nextcloud/k8s/routing/certificates.yaml | 16 +++++++ nextcloud/k8s/routing/ingress.yaml | 45 ++++++++++--------- portainer/k8s/certificates.yaml | 16 +++++++ portainer/k8s/ingress.yaml | 2 + prometheus-stack/k8s/certificates.yaml | 16 +++++++ prometheus-stack/k8s/ingress.yaml | 2 + searxng/k8s/certificates.yaml | 16 +++++++ searxng/k8s/ingress.yaml | 2 + termix/k8s/certificates.yaml | 16 +++++++ termix/k8s/ingress.yaml | 2 + traefik/k8s/certificates.yaml | 16 +++++++ traefik/k8s/ingress.yaml | 2 + traefik/k8s/traefik-values.yaml | 6 +-- uptime-kuma/k8s/certificates.yaml | 16 +++++++ uptime-kuma/k8s/ingress.yaml | 2 + userbot/k8s/base/internal-certificate.yaml | 15 +++++++ userbot/k8s/base/panel.yaml | 2 + vaultwarden/k8s/certificates.yaml | 16 +++++++ vaultwarden/k8s/ingress.yaml | 2 + vpn/xui/k8s/certificates.yaml | 16 +++++++ vpn/xui/k8s/ingress.yaml | 5 +++ 51 files changed, 528 insertions(+), 25 deletions(-) create mode 100644 adguardhome/k8s/internal-certificate.yaml create mode 100644 cert-manager/k8s/homelab-internal-root-ca.crt create mode 100644 cert-manager/k8s/internal-ca.yaml create mode 100644 downtify/k8s/internal-certificate.yaml create mode 100644 kener/k8s/internal-certificate.yaml create mode 100644 n8n/k8s/internal-certificate.yaml create mode 100644 userbot/k8s/base/internal-certificate.yaml diff --git a/adguardhome/k8s/ingress.yaml b/adguardhome/k8s/ingress.yaml index 0e101da..2832a7f 100644 --- a/adguardhome/k8s/ingress.yaml +++ b/adguardhome/k8s/ingress.yaml @@ -42,3 +42,5 @@ spec: services: - name: adguard-service port: 3000 + tls: + secretName: internal-wildcard-tls diff --git a/adguardhome/k8s/internal-certificate.yaml b/adguardhome/k8s/internal-certificate.yaml new file mode 100644 index 0000000..f443127 --- /dev/null +++ b/adguardhome/k8s/internal-certificate.yaml @@ -0,0 +1,15 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: adguard +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/authentik/k8s/certificates.yaml b/authentik/k8s/certificates.yaml index f9f7708..d8add27 100644 --- a/authentik/k8s/certificates.yaml +++ b/authentik/k8s/certificates.yaml @@ -10,3 +10,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: authentik +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/authentik/k8s/ingress.yaml b/authentik/k8s/ingress.yaml index 6e06750..2294f35 100644 --- a/authentik/k8s/ingress.yaml +++ b/authentik/k8s/ingress.yaml @@ -32,3 +32,5 @@ spec: services: - name: authentik-server-service port: 9000 + tls: + secretName: internal-wildcard-tls diff --git a/cert-manager/k8s/homelab-internal-root-ca.crt b/cert-manager/k8s/homelab-internal-root-ca.crt new file mode 100644 index 0000000..61c91cc --- /dev/null +++ b/cert-manager/k8s/homelab-internal-root-ca.crt @@ -0,0 +1,30 @@ +-----BEGIN CERTIFICATE----- +MIIFFjCCAv6gAwIBAgIUetKpTfEDOn2985FFMu6G26itT+wwDQYJKoZIhvcNAQEN +BQAwIzEhMB8GA1UEAxMYaG9tZWxhYiBpbnRlcm5hbCByb290IENBMB4XDTI2MDky +MzEyNDA0N1oXDTM2MDkyMDEyNDA0N1owIzEhMB8GA1UEAxMYaG9tZWxhYiBpbnRl +cm5hbCByb290IENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAvmNP +ZCOoD8NtNuYJKVXBlTPjX7D7sJCSK5neH7ZbYV5+lmUlEErY8Mik7j37V5k5NfpF +Ig85pOjP7RckTPz5V6ek3yaN40s4AL053sN5ZPauDVYjalaEHTgj5sEMqlLACQWI +yZmJOZspZykae8dIpQnqCoFpRT4FurJ78v4a0ylnFVLMQn/lyCHedwTjkEdtYWYr +ccJy8vQwqkzs/rWvEH1lDqZhennLOrmcCjfonG7D/pruMn4z+6E28p4+ejkRrI6x +luak3KnpT1XMeHtgU21hiRGaMDBchHMFgAhnY1qosymKenXvfTZItwgjZbwa1hJI +GAiDm+jQDKMjzRZ3rH6Xfc0auUcykNz73PpNu1NGm78nndXwCXcXn1LFKNQJ+r1U +sJiyAmUZmXVn4aM4OMf2F38k7wTYIKg7nRGaUkNeKDlNkjA4HvgWw+jwO1KmdHQ/ +mOem1rosDWHRK01wg+Gga9mQCnhNhxglg3t/UeSic6uOaRsvaz4qkzHq8MbCujVz +DpKQjqdikYOAXZOs4KlBLWrS7NaK4NzfSD02pBUErh54ruJfY/bWz9KyXzBD/lQZ +VUTKyvUVB0bkVHEdf1jJmX3H4IZRQSF5JPqOBotW6bJI5fEGNBvj9Zxy4nm2WWGz +yyP3uWsQz8U/Wdx9nXZLHInTZBsvgLYtKUAWA30CAwEAAaNCMEAwDgYDVR0PAQH/ +BAQDAgKkMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFEkKm2rxPaK6+O9WD80z +BLC6F9QsMA0GCSqGSIb3DQEBDQUAA4ICAQAnFyHz97Umf5VIu+dKTJid7C73VugJ +TIar/xJBs/4CxP+znBxhJjXygRoyIfzoVGWcB2ZSL//vL78Qlts79K/Imc9a4RFF +wMvCxsRXAEQ4TpeWi3ophPNcs4rhsP+gQKQFtnyKP9519bqpfxp0bTqwOV2o18fn +za7rlQViiEnNV58j7CVoM9+mJvVVfBEX1Km+GyJL9GadzbIQ7FxClVJZefCbft93 +zHVk9gDOw8ys1XGSR2OUCyCLinXO6mqS16CmBb2MAKXq/YyH7E0N8iotAPGtfA8V +M/0ddy947rY0xCrtECfWwvGQpJS7NRv/Z9b2jCfXrI5LXmL2nfQRg0y9GE4Vjwr+ +WxtGU5jOeFt0jQ+xRzcgG0Op+qK3x55l5LSo2hOcOVYbiHxcHEJFgwNi1ADeBFwb +q/HdysfURSOghqjIpMMAUabBp+DBUg2EUF7pIaUqbdqExFYcr9EYisEMiNsmKmN+ +8ZbcOeerFKDQj+t/R0bFXa7UBn2UWsjI8zlR74aa2kLDXwtyz/XlO/FlYm66eBFo +2/eYUSeU+S4ej+wUAs/dvjF7f190/DUQGuwOTlLTahqWDztmhCk7qzbECu56CwKT +E5Ect2P72UleYwdblkVOVd352AmiwEzdOaziIRrPh8uenEknH6JBYPO3mjk7cCg+ +GPGcNIBctjdXhg== +-----END CERTIFICATE----- diff --git a/cert-manager/k8s/internal-ca.yaml b/cert-manager/k8s/internal-ca.yaml new file mode 100644 index 0000000..686d7ce --- /dev/null +++ b/cert-manager/k8s/internal-ca.yaml @@ -0,0 +1,33 @@ +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: selfsigned +spec: + selfSigned: {} +--- +# Homelab internal root CA (10y). Install the .crt on clients (see below). +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-ca-root + namespace: cert-manager +spec: + isCA: true + commonName: homelab internal root CA + duration: 87600h + renewBefore: 7200h + secretName: internal-ca-root + privateKey: + algorithm: RSA + size: 4096 + issuerRef: + name: selfsigned + kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: internal-ca +spec: + ca: + secretName: internal-ca-root diff --git a/checkmk/k8s/certificates.yaml b/checkmk/k8s/certificates.yaml index d9dbf77..4e2ad05 100644 --- a/checkmk/k8s/certificates.yaml +++ b/checkmk/k8s/certificates.yaml @@ -10,3 +10,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: checkmk +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/checkmk/k8s/ingress.yaml b/checkmk/k8s/ingress.yaml index 28f2bbc..c736bc7 100644 --- a/checkmk/k8s/ingress.yaml +++ b/checkmk/k8s/ingress.yaml @@ -48,3 +48,5 @@ spec: services: - name: checkmk-service port: 5000 + tls: + secretName: internal-wildcard-tls diff --git a/converters/k8s/certificates.yaml b/converters/k8s/certificates.yaml index c23fe42..92a2955 100644 --- a/converters/k8s/certificates.yaml +++ b/converters/k8s/certificates.yaml @@ -24,3 +24,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: converters +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/converters/k8s/ingress.yaml b/converters/k8s/ingress.yaml index 88e36a5..d3393d8 100644 --- a/converters/k8s/ingress.yaml +++ b/converters/k8s/ingress.yaml @@ -31,6 +31,9 @@ spec: services: - name: convertx-service port: 3000 + tls: + secretName: internal-wildcard-tls + --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute @@ -63,3 +66,5 @@ spec: services: - name: bentopdf-service port: 8080 + tls: + secretName: internal-wildcard-tls diff --git a/dockmon/k8s/certificates.yaml b/dockmon/k8s/certificates.yaml index 6d434e1..6a2d511 100644 --- a/dockmon/k8s/certificates.yaml +++ b/dockmon/k8s/certificates.yaml @@ -10,3 +10,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: dockmon +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/dockmon/k8s/ingress.yaml b/dockmon/k8s/ingress.yaml index bbbd450..50d2fbf 100644 --- a/dockmon/k8s/ingress.yaml +++ b/dockmon/k8s/ingress.yaml @@ -43,3 +43,5 @@ spec: - name: dockmon-service port: 443 serversTransport: dockmon-transport + tls: + secretName: internal-wildcard-tls diff --git a/downtify/k8s/ingress.yaml b/downtify/k8s/ingress.yaml index 25b5cf4..e6711a5 100644 --- a/downtify/k8s/ingress.yaml +++ b/downtify/k8s/ingress.yaml @@ -33,3 +33,5 @@ spec: services: - name: downtify-service port: 8000 + tls: + secretName: internal-wildcard-tls diff --git a/downtify/k8s/internal-certificate.yaml b/downtify/k8s/internal-certificate.yaml new file mode 100644 index 0000000..cdb4cd0 --- /dev/null +++ b/downtify/k8s/internal-certificate.yaml @@ -0,0 +1,15 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: downtify +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/gitea/k8s/certificates.yaml b/gitea/k8s/certificates.yaml index f480d47..d7fc71e 100644 --- a/gitea/k8s/certificates.yaml +++ b/gitea/k8s/certificates.yaml @@ -11,3 +11,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: gitea +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/gitea/k8s/ingress.yaml b/gitea/k8s/ingress.yaml index 28dba3d..61b138c 100644 --- a/gitea/k8s/ingress.yaml +++ b/gitea/k8s/ingress.yaml @@ -45,6 +45,9 @@ spec: services: - name: gitea-service port: 3000 + tls: + secretName: internal-wildcard-tls + --- apiVersion: traefik.io/v1alpha1 kind: IngressRouteTCP diff --git a/glance/k8s/certificates.yaml b/glance/k8s/certificates.yaml index ae0bfb9..4a74661 100644 --- a/glance/k8s/certificates.yaml +++ b/glance/k8s/certificates.yaml @@ -11,3 +11,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: glance +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/glance/k8s/ingress.yaml b/glance/k8s/ingress.yaml index b84dfb4..f3411a6 100644 --- a/glance/k8s/ingress.yaml +++ b/glance/k8s/ingress.yaml @@ -35,6 +35,9 @@ spec: services: - name: glance-service port: 8080 + tls: + secretName: internal-wildcard-tls + --- apiVersion: traefik.io/v1alpha1 kind: Middleware diff --git a/headscale/k8s/routing/certificates.yaml b/headscale/k8s/routing/certificates.yaml index fb1f60b..60d80ca 100644 --- a/headscale/k8s/routing/certificates.yaml +++ b/headscale/k8s/routing/certificates.yaml @@ -23,3 +23,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: headscale +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/headscale/k8s/routing/ingress.yaml b/headscale/k8s/routing/ingress.yaml index baad830..cbdc496 100644 --- a/headscale/k8s/routing/ingress.yaml +++ b/headscale/k8s/routing/ingress.yaml @@ -90,6 +90,9 @@ spec: services: - name: headscale-server-external port: 9090 + tls: + secretName: internal-wildcard-tls + --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute @@ -110,3 +113,5 @@ spec: services: - name: headplane-external port: 3000 + tls: + secretName: internal-wildcard-tls diff --git a/homepages/k8s/certificates.yaml b/homepages/k8s/certificates.yaml index 2b64384..02f0768 100644 --- a/homepages/k8s/certificates.yaml +++ b/homepages/k8s/certificates.yaml @@ -24,3 +24,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: homepages +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/homepages/k8s/ingress.yaml b/homepages/k8s/ingress.yaml index 11e989b..049d546 100644 --- a/homepages/k8s/ingress.yaml +++ b/homepages/k8s/ingress.yaml @@ -34,6 +34,9 @@ spec: services: - name: forust-homepage-service port: 80 + tls: + secretName: internal-wildcard-tls + --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute @@ -69,3 +72,5 @@ spec: services: - name: xdfnx-homepage-service port: 80 + tls: + secretName: internal-wildcard-tls diff --git a/kener/k8s/ingress.yaml b/kener/k8s/ingress.yaml index 56b0fb8..13d2403 100644 --- a/kener/k8s/ingress.yaml +++ b/kener/k8s/ingress.yaml @@ -32,3 +32,5 @@ spec: services: - name: kener-service port: 3000 + tls: + secretName: internal-wildcard-tls diff --git a/kener/k8s/internal-certificate.yaml b/kener/k8s/internal-certificate.yaml new file mode 100644 index 0000000..1463fa2 --- /dev/null +++ b/kener/k8s/internal-certificate.yaml @@ -0,0 +1,15 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: kener +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/metube/k8s/certificates.yaml b/metube/k8s/certificates.yaml index 3a9fe04..59cd001 100644 --- a/metube/k8s/certificates.yaml +++ b/metube/k8s/certificates.yaml @@ -10,3 +10,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: metube +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/metube/k8s/ingress.yaml b/metube/k8s/ingress.yaml index 455c26d..e99b71e 100644 --- a/metube/k8s/ingress.yaml +++ b/metube/k8s/ingress.yaml @@ -31,3 +31,5 @@ spec: services: - name: metube-service port: 8081 + tls: + secretName: internal-wildcard-tls diff --git a/n8n/k8s/ingress.yaml b/n8n/k8s/ingress.yaml index ee875e7..b8d7078 100644 --- a/n8n/k8s/ingress.yaml +++ b/n8n/k8s/ingress.yaml @@ -32,3 +32,5 @@ spec: services: - name: n8n-service port: 5678 + tls: + secretName: internal-wildcard-tls diff --git a/n8n/k8s/internal-certificate.yaml b/n8n/k8s/internal-certificate.yaml new file mode 100644 index 0000000..71bee05 --- /dev/null +++ b/n8n/k8s/internal-certificate.yaml @@ -0,0 +1,15 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: n8n +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/netronome/k8s/certificates.yaml b/netronome/k8s/certificates.yaml index 9c75d31..cc366ac 100644 --- a/netronome/k8s/certificates.yaml +++ b/netronome/k8s/certificates.yaml @@ -10,3 +10,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: netronome +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/netronome/k8s/ingress.yaml b/netronome/k8s/ingress.yaml index ca8128c..0025d05 100644 --- a/netronome/k8s/ingress.yaml +++ b/netronome/k8s/ingress.yaml @@ -32,3 +32,5 @@ spec: services: - name: netronome-service port: 7575 + tls: + secretName: internal-wildcard-tls diff --git a/nextcloud/k8s/routing/certificates.yaml b/nextcloud/k8s/routing/certificates.yaml index 535ee50..39d0cff 100644 --- a/nextcloud/k8s/routing/certificates.yaml +++ b/nextcloud/k8s/routing/certificates.yaml @@ -10,3 +10,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: nextcloud +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/nextcloud/k8s/routing/ingress.yaml b/nextcloud/k8s/routing/ingress.yaml index 1f4dbf0..f9a7e84 100644 --- a/nextcloud/k8s/routing/ingress.yaml +++ b/nextcloud/k8s/routing/ingress.yaml @@ -38,26 +38,29 @@ spec: services: - name: nextcloud-apache port: 11000 -# --- -# Nextcloud AIO -# apiVersion: traefik.io/v1alpha1 -# kind: IngressRoute -# metadata: -# name: naio-prod -# namespace: nextcloud -# spec: -# entryPoints: -# - websecure -# routes: -# - match: Host(`naio.forust.xyz`) -# kind: Rule -# services: -# - name: nextcloud-aio -# port: 8888 -# scheme: https -# serversTransport: insecure-transport -# tls: -# certResolver: letsencrypt + # --- + # Nextcloud AIO + # apiVersion: traefik.io/v1alpha1 + # kind: IngressRoute + # metadata: + # name: naio-prod + # namespace: nextcloud + # spec: + # entryPoints: + # - websecure + # routes: + # - match: Host(`naio.forust.xyz`) + # kind: Rule + # services: + # - name: nextcloud-aio + # port: 8888 + # scheme: https + # serversTransport: insecure-transport + # tls: + # certResolver: letsencrypt + tls: + secretName: internal-wildcard-tls + --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute @@ -75,3 +78,5 @@ spec: port: 8888 scheme: https serversTransport: insecure-transport + tls: + secretName: internal-wildcard-tls diff --git a/portainer/k8s/certificates.yaml b/portainer/k8s/certificates.yaml index a7f4418..c843a3a 100644 --- a/portainer/k8s/certificates.yaml +++ b/portainer/k8s/certificates.yaml @@ -10,3 +10,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: portainer +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/portainer/k8s/ingress.yaml b/portainer/k8s/ingress.yaml index e0bd5d9..cc2283b 100644 --- a/portainer/k8s/ingress.yaml +++ b/portainer/k8s/ingress.yaml @@ -32,3 +32,5 @@ spec: services: - name: portainer-service port: 9000 + tls: + secretName: internal-wildcard-tls diff --git a/prometheus-stack/k8s/certificates.yaml b/prometheus-stack/k8s/certificates.yaml index e90f19d..fef8eb1 100644 --- a/prometheus-stack/k8s/certificates.yaml +++ b/prometheus-stack/k8s/certificates.yaml @@ -10,3 +10,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: prometheus +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/prometheus-stack/k8s/ingress.yaml b/prometheus-stack/k8s/ingress.yaml index 8d712c4..bdb0451 100644 --- a/prometheus-stack/k8s/ingress.yaml +++ b/prometheus-stack/k8s/ingress.yaml @@ -32,3 +32,5 @@ spec: services: - name: prometheus-stack-grafana port: 80 + tls: + secretName: internal-wildcard-tls diff --git a/searxng/k8s/certificates.yaml b/searxng/k8s/certificates.yaml index eef650a..d3487d9 100644 --- a/searxng/k8s/certificates.yaml +++ b/searxng/k8s/certificates.yaml @@ -11,3 +11,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: searxng +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/searxng/k8s/ingress.yaml b/searxng/k8s/ingress.yaml index db223f1..c75b27b 100644 --- a/searxng/k8s/ingress.yaml +++ b/searxng/k8s/ingress.yaml @@ -32,3 +32,5 @@ spec: services: - name: searxng-service port: 8080 + tls: + secretName: internal-wildcard-tls diff --git a/termix/k8s/certificates.yaml b/termix/k8s/certificates.yaml index c1b4afe..93859ff 100644 --- a/termix/k8s/certificates.yaml +++ b/termix/k8s/certificates.yaml @@ -10,3 +10,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: termix +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/termix/k8s/ingress.yaml b/termix/k8s/ingress.yaml index bfbbfa8..b6dcf28 100644 --- a/termix/k8s/ingress.yaml +++ b/termix/k8s/ingress.yaml @@ -32,3 +32,5 @@ spec: services: - name: termix-service port: 8080 + tls: + secretName: internal-wildcard-tls diff --git a/traefik/k8s/certificates.yaml b/traefik/k8s/certificates.yaml index d1f5c71..bcb3d63 100644 --- a/traefik/k8s/certificates.yaml +++ b/traefik/k8s/certificates.yaml @@ -10,3 +10,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: traefik +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/traefik/k8s/ingress.yaml b/traefik/k8s/ingress.yaml index 83b4717..f6e5a59 100644 --- a/traefik/k8s/ingress.yaml +++ b/traefik/k8s/ingress.yaml @@ -33,3 +33,5 @@ spec: services: - name: api@internal kind: TraefikService + tls: + secretName: internal-wildcard-tls diff --git a/traefik/k8s/traefik-values.yaml b/traefik/k8s/traefik-values.yaml index bdadaf5..9fc2e63 100644 --- a/traefik/k8s/traefik-values.yaml +++ b/traefik/k8s/traefik-values.yaml @@ -121,11 +121,7 @@ persistence: size: 100Mi path: /data -# NOTE: no certificatesResolvers — public TLS is issued by cert-manager -# (see cert-manager/k8s/clusterissuer.yaml and per-service certificates.yaml). -# Traefik must not run its own ACME httpChallenge: its internal -# acme-http@internal router hijacks /.well-known/acme-challenge/ for every -# host and breaks external HTTP-01 solvers. +# No certificatesResolvers: public TLS comes from cert-manager. volumes: - name: traefik-dynamic diff --git a/uptime-kuma/k8s/certificates.yaml b/uptime-kuma/k8s/certificates.yaml index be2767d..babc5c8 100644 --- a/uptime-kuma/k8s/certificates.yaml +++ b/uptime-kuma/k8s/certificates.yaml @@ -10,3 +10,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: uptime-kuma +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/uptime-kuma/k8s/ingress.yaml b/uptime-kuma/k8s/ingress.yaml index c730da2..3f8f83e 100644 --- a/uptime-kuma/k8s/ingress.yaml +++ b/uptime-kuma/k8s/ingress.yaml @@ -32,3 +32,5 @@ spec: services: - name: uptime-kuma-service port: 3001 + tls: + secretName: internal-wildcard-tls diff --git a/userbot/k8s/base/internal-certificate.yaml b/userbot/k8s/base/internal-certificate.yaml new file mode 100644 index 0000000..9b4f232 --- /dev/null +++ b/userbot/k8s/base/internal-certificate.yaml @@ -0,0 +1,15 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: userbot +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/userbot/k8s/base/panel.yaml b/userbot/k8s/base/panel.yaml index 4f738c8..2de09f6 100644 --- a/userbot/k8s/base/panel.yaml +++ b/userbot/k8s/base/panel.yaml @@ -262,3 +262,5 @@ spec: services: - name: userbot-panel port: 8080 + tls: + secretName: internal-wildcard-tls diff --git a/vaultwarden/k8s/certificates.yaml b/vaultwarden/k8s/certificates.yaml index b5a2119..c20eaa6 100644 --- a/vaultwarden/k8s/certificates.yaml +++ b/vaultwarden/k8s/certificates.yaml @@ -10,3 +10,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: vaultwarden +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/vaultwarden/k8s/ingress.yaml b/vaultwarden/k8s/ingress.yaml index 24c74e0..86fcbc5 100644 --- a/vaultwarden/k8s/ingress.yaml +++ b/vaultwarden/k8s/ingress.yaml @@ -29,3 +29,5 @@ spec: services: - name: vaultwarden-service port: 80 + tls: + secretName: internal-wildcard-tls diff --git a/vpn/xui/k8s/certificates.yaml b/vpn/xui/k8s/certificates.yaml index ec4bbe0..7ececa5 100644 --- a/vpn/xui/k8s/certificates.yaml +++ b/vpn/xui/k8s/certificates.yaml @@ -10,3 +10,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: xui +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/vpn/xui/k8s/ingress.yaml b/vpn/xui/k8s/ingress.yaml index f3b916e..6b9aa62 100644 --- a/vpn/xui/k8s/ingress.yaml +++ b/vpn/xui/k8s/ingress.yaml @@ -12,6 +12,9 @@ spec: services: - name: xui-service port: 30379 + tls: + secretName: internal-wildcard-tls + --- # Public panel access (optional). # Realistic, but intentionally disabled: the panel has its own login, @@ -79,3 +82,5 @@ spec: services: - name: xui-service port: 10000 + tls: + secretName: internal-wildcard-tls From 7b7fc3bcb00999dc03e1660114d3f04a60f1cf8d Mon Sep 17 00:00:00 2001 From: mr-forust Date: Wed, 23 Sep 2026 14:46:09 +0200 Subject: [PATCH 3/3] fix(tls): drop internal certs for dormant namespaces (kener, downtify have no ns live) --- downtify/k8s/internal-certificate.yaml | 15 --------------- kener/k8s/internal-certificate.yaml | 15 --------------- 2 files changed, 30 deletions(-) delete mode 100644 downtify/k8s/internal-certificate.yaml delete mode 100644 kener/k8s/internal-certificate.yaml diff --git a/downtify/k8s/internal-certificate.yaml b/downtify/k8s/internal-certificate.yaml deleted file mode 100644 index cdb4cd0..0000000 --- a/downtify/k8s/internal-certificate.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: internal-wildcard-tls - namespace: downtify -spec: - secretName: internal-wildcard-tls - dnsNames: - - "*.workstation.internal" - - "*.gigaforust.internal" - - workstation.internal - - gigaforust.internal - issuerRef: - name: internal-ca - kind: ClusterIssuer diff --git a/kener/k8s/internal-certificate.yaml b/kener/k8s/internal-certificate.yaml deleted file mode 100644 index 1463fa2..0000000 --- a/kener/k8s/internal-certificate.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: internal-wildcard-tls - namespace: kener -spec: - secretName: internal-wildcard-tls - dnsNames: - - "*.workstation.internal" - - "*.gigaforust.internal" - - workstation.internal - - gigaforust.internal - issuerRef: - name: internal-ca - kind: ClusterIssuer