forust/homelab
0
0 Fork 0
Code Issues 1 Pull Requests 3 Actions Packages Wiki Activity

feat(tls): internal CA wildcard for *.internal routes
ci / lint-prettier (push) Successful in 3s
Details
ci / lint-ruff (push) Successful in 1s
Details
ci / lint-yaml (push) Successful in 2s
Details
ci / lint-dockerfiles (push) Successful in 1s
Details
ci / validate (push) Successful in 1s
Details
renovate-ci / validate-renovate (push) Successful in 10s
Details
ci / build (push) Successful in 4m51s
Details
ci / deploy-userbot-panel (push) Failing after 2s
Details

Browse Source
This commit is contained in:
forust committed 2026-09-23 14:47:14 +02:00
2 parents 1f7166026b 7b7fc3bcb0
commit 8b2cf29771
50 files changed
+498 -940
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

adguardhome/k8s/ingress.yaml
+2
View File
@@ -42,3 +42,5 @@ spec:
services:
- name: adguard-service
port: 3000
tls:
secretName: internal-wildcard-tls
adguardhome/k8s/internal-certificate.yaml
+15
View File
@@ -0,0 +1,15 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: internal-wildcard-tls
namespace: adguard
spec:
secretName: internal-wildcard-tls
dnsNames:
- "*.workstation.internal"
- "*.gigaforust.internal"
- workstation.internal
- gigaforust.internal
issuerRef:
name: internal-ca
kind: ClusterIssuer
authentik/k8s/certificates.yaml
+16
View File
@@ -10,3 +10,19 @@ spec:
issuerRef:
name: letsencrypt-prod
kind: ClusterIssuer
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: internal-wildcard-tls
namespace: authentik
spec:
secretName: internal-wildcard-tls
dnsNames:
- "*.workstation.internal"
- "*.gigaforust.internal"
- workstation.internal
- gigaforust.internal
issuerRef:
name: internal-ca
kind: ClusterIssuer
authentik/k8s/ingress.yaml
+2
View File
@@ -32,3 +32,5 @@ spec:
services:
- name: authentik-server-service
port: 9000
tls:
secretName: internal-wildcard-tls
cert-manager/k8s/homelab-internal-root-ca.crt
+30
View File
@@ -0,0 +1,30 @@
-----BEGIN CERTIFICATE-----
MIIFFjCCAv6gAwIBAgIUetKpTfEDOn2985FFMu6G26itT+wwDQYJKoZIhvcNAQEN
BQAwIzEhMB8GA1UEAxMYaG9tZWxhYiBpbnRlcm5hbCByb290IENBMB4XDTI2MDky
MzEyNDA0N1oXDTM2MDkyMDEyNDA0N1owIzEhMB8GA1UEAxMYaG9tZWxhYiBpbnRl
cm5hbCByb290IENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAvmNP
ZCOoD8NtNuYJKVXBlTPjX7D7sJCSK5neH7ZbYV5+lmUlEErY8Mik7j37V5k5NfpF
Ig85pOjP7RckTPz5V6ek3yaN40s4AL053sN5ZPauDVYjalaEHTgj5sEMqlLACQWI
yZmJOZspZykae8dIpQnqCoFpRT4FurJ78v4a0ylnFVLMQn/lyCHedwTjkEdtYWYr
ccJy8vQwqkzs/rWvEH1lDqZhennLOrmcCjfonG7D/pruMn4z+6E28p4+ejkRrI6x
luak3KnpT1XMeHtgU21hiRGaMDBchHMFgAhnY1qosymKenXvfTZItwgjZbwa1hJI
GAiDm+jQDKMjzRZ3rH6Xfc0auUcykNz73PpNu1NGm78nndXwCXcXn1LFKNQJ+r1U
sJiyAmUZmXVn4aM4OMf2F38k7wTYIKg7nRGaUkNeKDlNkjA4HvgWw+jwO1KmdHQ/
mOem1rosDWHRK01wg+Gga9mQCnhNhxglg3t/UeSic6uOaRsvaz4qkzHq8MbCujVz
DpKQjqdikYOAXZOs4KlBLWrS7NaK4NzfSD02pBUErh54ruJfY/bWz9KyXzBD/lQZ
VUTKyvUVB0bkVHEdf1jJmX3H4IZRQSF5JPqOBotW6bJI5fEGNBvj9Zxy4nm2WWGz
yyP3uWsQz8U/Wdx9nXZLHInTZBsvgLYtKUAWA30CAwEAAaNCMEAwDgYDVR0PAQH/
BAQDAgKkMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFEkKm2rxPaK6+O9WD80z
BLC6F9QsMA0GCSqGSIb3DQEBDQUAA4ICAQAnFyHz97Umf5VIu+dKTJid7C73VugJ
TIar/xJBs/4CxP+znBxhJjXygRoyIfzoVGWcB2ZSL//vL78Qlts79K/Imc9a4RFF
wMvCxsRXAEQ4TpeWi3ophPNcs4rhsP+gQKQFtnyKP9519bqpfxp0bTqwOV2o18fn
za7rlQViiEnNV58j7CVoM9+mJvVVfBEX1Km+GyJL9GadzbIQ7FxClVJZefCbft93
zHVk9gDOw8ys1XGSR2OUCyCLinXO6mqS16CmBb2MAKXq/YyH7E0N8iotAPGtfA8V
M/0ddy947rY0xCrtECfWwvGQpJS7NRv/Z9b2jCfXrI5LXmL2nfQRg0y9GE4Vjwr+
WxtGU5jOeFt0jQ+xRzcgG0Op+qK3x55l5LSo2hOcOVYbiHxcHEJFgwNi1ADeBFwb
q/HdysfURSOghqjIpMMAUabBp+DBUg2EUF7pIaUqbdqExFYcr9EYisEMiNsmKmN+
8ZbcOeerFKDQj+t/R0bFXa7UBn2UWsjI8zlR74aa2kLDXwtyz/XlO/FlYm66eBFo
2/eYUSeU+S4ej+wUAs/dvjF7f190/DUQGuwOTlLTahqWDztmhCk7qzbECu56CwKT
E5Ect2P72UleYwdblkVOVd352AmiwEzdOaziIRrPh8uenEknH6JBYPO3mjk7cCg+
GPGcNIBctjdXhg==
-----END CERTIFICATE-----
cert-manager/k8s/internal-ca.yaml
+33
View File
@@ -0,0 +1,33 @@
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: selfsigned
spec:
selfSigned: {}
---
# Homelab internal root CA (10y). Install the .crt on clients (see below).
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: internal-ca-root
namespace: cert-manager
spec:
isCA: true
commonName: homelab internal root CA
duration: 87600h
renewBefore: 7200h
secretName: internal-ca-root
privateKey:
algorithm: RSA
size: 4096
issuerRef:
name: selfsigned
kind: ClusterIssuer
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: internal-ca
spec:
ca:
secretName: internal-ca-root
checkmk/k8s/certificates.yaml
+16
View File
@@ -10,3 +10,19 @@ spec:
issuerRef:
name: letsencrypt-prod
kind: ClusterIssuer
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: internal-wildcard-tls
namespace: checkmk
spec:
secretName: internal-wildcard-tls
dnsNames:
- "*.workstation.internal"
- "*.gigaforust.internal"
- workstation.internal
- gigaforust.internal
issuerRef:
name: internal-ca
kind: ClusterIssuer
checkmk/k8s/ingress.yaml
+2
View File
@@ -48,3 +48,5 @@ spec:
services:
- name: checkmk-service
port: 5000
tls:
secretName: internal-wildcard-tls
converters/k8s/certificates.yaml
+16
View File
@@ -24,3 +24,19 @@ spec:
issuerRef:
name: letsencrypt-prod
kind: ClusterIssuer
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: internal-wildcard-tls
namespace: converters
spec:
secretName: internal-wildcard-tls
dnsNames:
- "*.workstation.internal"
- "*.gigaforust.internal"
- workstation.internal
- gigaforust.internal
issuerRef:
name: internal-ca
kind: ClusterIssuer
converters/k8s/ingress.yaml
+5
View File
@@ -31,6 +31,9 @@ spec:
services:
- name: convertx-service
port: 3000
tls:
secretName: internal-wildcard-tls
---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
@@ -63,3 +66,5 @@ spec:
services:
- name: bentopdf-service
port: 8080
tls:
secretName: internal-wildcard-tls
dockmon/k8s/certificates.yaml
+16
View File
@@ -10,3 +10,19 @@ spec:
issuerRef:
name: letsencrypt-prod
kind: ClusterIssuer
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: internal-wildcard-tls
namespace: dockmon
spec:
secretName: internal-wildcard-tls
dnsNames:
- "*.workstation.internal"
- "*.gigaforust.internal"
- workstation.internal
- gigaforust.internal
issuerRef:
name: internal-ca
kind: ClusterIssuer
dockmon/k8s/ingress.yaml
+2
View File
@@ -43,3 +43,5 @@ spec:
- name: dockmon-service
port: 443
serversTransport: dockmon-transport
tls:
secretName: internal-wildcard-tls
downtify/k8s/ingress.yaml
+2
View File
@@ -33,3 +33,5 @@ spec:
services:
- name: downtify-service
port: 8000
tls:
secretName: internal-wildcard-tls
gitea/k8s/certificates.yaml
+16
View File
@@ -11,3 +11,19 @@ spec:
issuerRef:
name: letsencrypt-prod
kind: ClusterIssuer
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: internal-wildcard-tls
namespace: gitea
spec:
secretName: internal-wildcard-tls
dnsNames:
- "*.workstation.internal"
- "*.gigaforust.internal"
- workstation.internal
- gigaforust.internal
issuerRef:
name: internal-ca
kind: ClusterIssuer
gitea/k8s/ingress.yaml
+3
View File
@@ -45,6 +45,9 @@ spec:
services:
- name: gitea-service
port: 3000
tls:
secretName: internal-wildcard-tls
---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
glance/k8s/certificates.yaml
+16
View File
@@ -11,3 +11,19 @@ spec:
issuerRef:
name: letsencrypt-prod
kind: ClusterIssuer
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: internal-wildcard-tls
namespace: glance
spec:
secretName: internal-wildcard-tls
dnsNames:
- "*.workstation.internal"
- "*.gigaforust.internal"
- workstation.internal
- gigaforust.internal
issuerRef:
name: internal-ca
kind: ClusterIssuer
glance/k8s/ingress.yaml
+3
View File
@@ -35,6 +35,9 @@ spec:
services:
- name: glance-service
port: 8080
tls:
secretName: internal-wildcard-tls
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
headscale/k8s/routing/certificates.yaml
+16
View File
@@ -23,3 +23,19 @@ spec:
issuerRef:
name: letsencrypt-prod
kind: ClusterIssuer
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: internal-wildcard-tls
namespace: headscale
spec:
secretName: internal-wildcard-tls
dnsNames:
- "*.workstation.internal"
- "*.gigaforust.internal"
- workstation.internal
- gigaforust.internal
issuerRef:
name: internal-ca
kind: ClusterIssuer
headscale/k8s/routing/ingress.yaml
+5
View File
@@ -90,6 +90,9 @@ spec:
services:
- name: headscale-server-external
port: 9090
tls:
secretName: internal-wildcard-tls
---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
@@ -110,3 +113,5 @@ spec:
services:
- name: headplane-external
port: 3000
tls:
secretName: internal-wildcard-tls
homepages/k8s/certificates.yaml
+16
View File
@@ -24,3 +24,19 @@ spec:
issuerRef:
name: letsencrypt-prod
kind: ClusterIssuer
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: internal-wildcard-tls
namespace: homepages
spec:
secretName: internal-wildcard-tls
dnsNames:
- "*.workstation.internal"
- "*.gigaforust.internal"
- workstation.internal
- gigaforust.internal
issuerRef:
name: internal-ca
kind: ClusterIssuer
homepages/k8s/ingress.yaml
+5
View File
@@ -34,6 +34,9 @@ spec:
services:
- name: forust-homepage-service
port: 80
tls:
secretName: internal-wildcard-tls
---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
@@ -69,3 +72,5 @@ spec:
services:
- name: xdfnx-homepage-service
port: 80
tls:
secretName: internal-wildcard-tls
kener/k8s/ingress.yaml
+2
View File
@@ -32,3 +32,5 @@ spec:
services:
- name: kener-service
port: 3000
tls:
secretName: internal-wildcard-tls
metube/k8s/certificates.yaml
+16
View File
@@ -10,3 +10,19 @@ spec:
issuerRef:
name: letsencrypt-prod
kind: ClusterIssuer
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: internal-wildcard-tls
namespace: metube
spec:
secretName: internal-wildcard-tls
dnsNames:
- "*.workstation.internal"
- "*.gigaforust.internal"
- workstation.internal
- gigaforust.internal
issuerRef:
name: internal-ca
kind: ClusterIssuer
metube/k8s/ingress.yaml
+2
View File
@@ -31,3 +31,5 @@ spec:
services:
- name: metube-service
port: 8081
tls:
secretName: internal-wildcard-tls
n8n/k8s/ingress.yaml
+2
View File
@@ -32,3 +32,5 @@ spec:
services:
- name: n8n-service
port: 5678
tls:
secretName: internal-wildcard-tls
n8n/k8s/internal-certificate.yaml
+15
View File
@@ -0,0 +1,15 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: internal-wildcard-tls
namespace: n8n
spec:
secretName: internal-wildcard-tls
dnsNames:
- "*.workstation.internal"
- "*.gigaforust.internal"
- workstation.internal
- gigaforust.internal
issuerRef:
name: internal-ca
kind: ClusterIssuer
netronome/k8s/certificates.yaml
+16
View File
@@ -10,3 +10,19 @@ spec:
issuerRef:
name: letsencrypt-prod
kind: ClusterIssuer
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: internal-wildcard-tls
namespace: netronome
spec:
secretName: internal-wildcard-tls
dnsNames:
- "*.workstation.internal"
- "*.gigaforust.internal"
- workstation.internal
- gigaforust.internal
issuerRef:
name: internal-ca
kind: ClusterIssuer
netronome/k8s/ingress.yaml
+2
View File
@@ -32,3 +32,5 @@ spec:
services:
- name: netronome-service
port: 7575
tls:
secretName: internal-wildcard-tls
nextcloud/k8s/routing/certificates.yaml
+16
View File
@@ -10,3 +10,19 @@ spec:
issuerRef:
name: letsencrypt-prod
kind: ClusterIssuer
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: internal-wildcard-tls
namespace: nextcloud
spec:
secretName: internal-wildcard-tls
dnsNames:
- "*.workstation.internal"
- "*.gigaforust.internal"
- workstation.internal
- gigaforust.internal
issuerRef:
name: internal-ca
kind: ClusterIssuer
nextcloud/k8s/routing/ingress.yaml
+25 -20
View File
@@ -38,26 +38,29 @@ spec:
services:
- name: nextcloud-apache
port: 11000
# ---
# Nextcloud AIO
# apiVersion: traefik.io/v1alpha1
# kind: IngressRoute
# metadata:
# name: naio-prod
# namespace: nextcloud
# spec:
# entryPoints:
# - websecure
# routes:
# - match: Host(`naio.forust.xyz`)
# kind: Rule
# services:
# - name: nextcloud-aio
# port: 8888
# scheme: https
# serversTransport: insecure-transport
# tls:
# certResolver: letsencrypt
# ---
# Nextcloud AIO
# apiVersion: traefik.io/v1alpha1
# kind: IngressRoute
# metadata:
# name: naio-prod
# namespace: nextcloud
# spec:
# entryPoints:
# - websecure
# routes:
# - match: Host(`naio.forust.xyz`)
# kind: Rule
# services:
# - name: nextcloud-aio
# port: 8888
# scheme: https
# serversTransport: insecure-transport
# tls:
# certResolver: letsencrypt
tls:
secretName: internal-wildcard-tls
---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
@@ -75,3 +78,5 @@ spec:
port: 8888
scheme: https
serversTransport: insecure-transport
tls:
secretName: internal-wildcard-tls
portainer/k8s/certificates.yaml
+16
View File
@@ -10,3 +10,19 @@ spec:
issuerRef:
name: letsencrypt-prod
kind: ClusterIssuer
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: internal-wildcard-tls
namespace: portainer
spec:
secretName: internal-wildcard-tls
dnsNames:
- "*.workstation.internal"
- "*.gigaforust.internal"
- workstation.internal
- gigaforust.internal
issuerRef:
name: internal-ca
kind: ClusterIssuer
portainer/k8s/ingress.yaml
+2
View File
@@ -32,3 +32,5 @@ spec:
services:
- name: portainer-service
port: 9000
tls:
secretName: internal-wildcard-tls
prometheus-stack/k8s/certificates.yaml
+16
View File
@@ -10,3 +10,19 @@ spec:
issuerRef:
name: letsencrypt-prod
kind: ClusterIssuer
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: internal-wildcard-tls
namespace: prometheus
spec:
secretName: internal-wildcard-tls
dnsNames:
- "*.workstation.internal"
- "*.gigaforust.internal"
- workstation.internal
- gigaforust.internal
issuerRef:
name: internal-ca
kind: ClusterIssuer
prometheus-stack/k8s/dashboards/cert-manager-dashboard.yaml
-915
View File
@@ -1,915 +0,0 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: grafana-dashboard-cert-manager
namespace: prometheus
labels:
grafana_dashboard: "1"
app: cert-manager
data:
cert-manager.json: |-
{
"__elements": {},
"__requires": [
{
"type": "grafana",
"id": "grafana",
"name": "Grafana",
"version": "11.2.0"
},
{
"type": "datasource",
"id": "prometheus",
"name": "Prometheus",
"version": "1.0.0"
},
{
"type": "panel",
"id": "stat",
"name": "Stat",
"version": ""
},
{
"type": "panel",
"id": "table",
"name": "Table",
"version": ""
},
{
"type": "panel",
"id": "timeseries",
"name": "Time series",
"version": ""
}
],
"annotations": {
"list": [
{
"builtIn": 1,
"datasource": {
"type": "grafana",
"uid": "-- Grafana --"
},
"enable": true,
"hide": true,
"iconColor": "rgba(0, 211, 255, 1)",
"name": "Annotations & Alerts",
"type": "dashboard"
}
]
},
"description": "The dashboard gives an overview of the SSL certs managed by cert-manager in Kubernetes",
"editable": true,
"fiscalYearStartMonth": 0,
"gnetId": 22908,
"graphTooltip": 0,
"id": null,
"links": [],
"panels": [
{
"datasource": {
"default": false,
"type": "prometheus",
"uid": "${datasource}"
},
"description": "The number if available certificates",
"fieldConfig": {
"defaults": {
"color": {
"mode": "thresholds"
},
"mappings": [],
"noValue": "0",
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
}
]
}
},
"overrides": []
},
"gridPos": {
"h": 3,
"w": 3,
"x": 0,
"y": 0
},
"id": 1,
"options": {
"colorMode": "value",
"graphMode": "none",
"justifyMode": "auto",
"orientation": "auto",
"percentChangeColorMode": "standard",
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"showPercentChange": false,
"textMode": "value",
"wideLayout": true
},
"pluginVersion": "11.2.0",
"targets": [
{
"datasource": {
"type": "prometheus",
"uid": "${datasource}"
},
"disableTextWrap": false,
"editorMode": "code",
"exemplar": false,
"expr": "count(certmanager_certificate_ready_status{condition=\"True\", namespace=~\"$namespace\"})",
"fullMetaSearch": false,
"includeNullMetadata": true,
"instant": true,
"legendFormat": "__auto",
"range": false,
"refId": "A",
"useBackend": false
}
],
"title": "Valid Certificates",
"type": "stat"
},
{
"datasource": {
"name": "${datasource}",
"type": "prometheus",
"uid": "${datasource}"
},
"description": "",
"fieldConfig": {
"defaults": {
"color": {
"mode": "palette-classic"
},
"custom": {
"axisBorderShow": false,
"axisCenteredZero": false,
"axisColorMode": "text",
"axisLabel": "",
"axisPlacement": "auto",
"barAlignment": 0,
"barWidthFactor": 0.6,
"drawStyle": "line",
"fillOpacity": 0,
"gradientMode": "none",
"hideFrom": {
"legend": false,
"tooltip": false,
"viz": false
},
"insertNulls": false,
"lineInterpolation": "linear",
"lineWidth": 1,
"pointSize": 5,
"scaleDistribution": {
"type": "linear"
},
"showPoints": "never",
"spanNulls": false,
"stacking": {
"group": "A",
"mode": "none"
},
"thresholdsStyle": {
"mode": "off"
}
},
"links": [],
"mappings": [],
"min": 0,
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "red",
"value": 80
}
]
},
"unit": "short"
},
"overrides": []
},
"gridPos": {
"h": 9,
"w": 9,
"x": 3,
"y": 0
},
"id": 8,
"options": {
"legend": {
"calcs": [],
"displayMode": "list",
"placement": "right",
"showLegend": true
},
"tooltip": {
"mode": "multi",
"sort": "none"
}
},
"pluginVersion": "10.2.3",
"targets": [
{
"datasource": {
"type": "prometheus",
"uid": "${datasource}"
},
"editorMode": "code",
"expr": "sum(certmanager_certificate_ready_status{namespace=~\"$namespace\"}) by (condition,name)>0",
"format": "time_series",
"intervalFactor": 2,
"legendFormat": "{{name}}:{{condition}}",
"range": true,
"refId": "A",
"step": 1800
}
],
"title": "Certificate Ready Status",
"type": "timeseries"
},
{
"datasource": {
"default": false,
"type": "prometheus",
"uid": "${datasource}"
},
"description": "",
"fieldConfig": {
"defaults": {
"color": {
"mode": "palette-classic"
},
"custom": {
"axisBorderShow": false,
"axisCenteredZero": false,
"axisColorMode": "text",
"axisLabel": "",
"axisPlacement": "auto",
"barAlignment": 0,
"barWidthFactor": 0.6,
"drawStyle": "line",
"fillOpacity": 10,
"gradientMode": "none",
"hideFrom": {
"legend": false,
"tooltip": false,
"viz": false
},
"insertNulls": false,
"lineInterpolation": "linear",
"lineWidth": 1,
"pointSize": 5,
"scaleDistribution": {
"type": "linear"
},
"showPoints": "never",
"spanNulls": false,
"stacking": {
"group": "A",
"mode": "none"
},
"thresholdsStyle": {
"mode": "off"
}
},
"links": [],
"mappings": [],
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "red",
"value": 80
}
]
},
"unit": "short"
},
"overrides": []
},
"gridPos": {
"h": 9,
"w": 12,
"x": 12,
"y": 0
},
"id": 10,
"options": {
"legend": {
"calcs": [],
"displayMode": "table",
"placement": "right",
"showLegend": true
},
"tooltip": {
"mode": "multi",
"sort": "none"
}
},
"pluginVersion": "10.2.3",
"targets": [
{
"datasource": {
"type": "prometheus",
"uid": "${datasource}"
},
"editorMode": "code",
"expr": "sum(rate(certmanager_http_acme_client_request_count{namespace=~\"$namespace\"}[2m])) BY (status, path)>0",
"legendFormat": "{{status}}:{{path}}",
"range": true,
"refId": "A"
}
],
"title": "Overall requests per 2m",
"type": "timeseries"
},
{
"datasource": {
"default": false,
"type": "prometheus",
"uid": "${datasource}"
},
"description": "The number of certificates that will expire within the next 14 days",
"fieldConfig": {
"defaults": {
"color": {
"mode": "thresholds"
},
"mappings": [],
"noValue": "0",
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "#EAB839",
"value": 1
}
]
}
},
"overrides": []
},
"gridPos": {
"h": 3,
"w": 3,
"x": 0,
"y": 3
},
"id": 3,
"options": {
"colorMode": "value",
"graphMode": "none",
"justifyMode": "auto",
"orientation": "auto",
"percentChangeColorMode": "standard",
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"showPercentChange": false,
"textMode": "auto",
"wideLayout": true
},
"pluginVersion": "11.2.0",
"targets": [
{
"datasource": {
"type": "prometheus",
"uid": "${datasource}"
},
"disableTextWrap": false,
"editorMode": "code",
"exemplar": false,
"expr": "count(certmanager_certificate_expiration_timestamp_seconds{namespace=~\"$namespace\"} < (time()+(14*24*3600)))",
"fullMetaSearch": false,
"includeNullMetadata": true,
"instant": true,
"legendFormat": "{{exported_namespace}}/{{name}}",
"range": false,
"refId": "A",
"useBackend": false
}
],
"title": "Expiring Certificates",
"type": "stat"
},
{
"datasource": {
"default": false,
"type": "prometheus",
"uid": "${datasource}"
},
"description": "Total number of HTTP requests",
"fieldConfig": {
"defaults": {
"color": {
"mode": "thresholds"
},
"mappings": [],
"noValue": "0",
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "text",
"value": null
}
]
}
},
"overrides": []
},
"gridPos": {
"h": 3,
"w": 3,
"x": 0,
"y": 6
},
"id": 2,
"options": {
"colorMode": "value",
"graphMode": "none",
"justifyMode": "auto",
"orientation": "auto",
"percentChangeColorMode": "standard",
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"showPercentChange": false,
"textMode": "auto",
"wideLayout": true
},
"pluginVersion": "11.2.0",
"targets": [
{
"datasource": {
"type": "prometheus",
"uid": "${datasource}"
},
"disableTextWrap": false,
"editorMode": "code",
"exemplar": false,
"expr": "sum(certmanager_http_acme_client_request_count)",
"fullMetaSearch": false,
"includeNullMetadata": true,
"instant": true,
"legendFormat": "__auto",
"range": false,
"refId": "A",
"useBackend": false
}
],
"title": "Total ACME Requests",
"type": "stat"
},
{
"datasource": {
"default": false,
"type": "prometheus",
"uid": "${datasource}"
},
"description": "Time before the certificates expire",
"fieldConfig": {
"defaults": {
"color": {
"mode": "thresholds"
},
"custom": {
"align": "auto",
"cellOptions": {
"type": "auto"
},
"inspect": false
},
"mappings": [],
"min": 0,
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "red",
"value": null
},
{
"color": "orange",
"value": 14
},
{
"color": "green",
"value": 30
},
{
"color": "dark-green",
"value": 60
}
]
},
"unit": "none"
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "证书有效期（天）"
},
"properties": [
{
"id": "thresholds",
"value": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "semi-dark-red",
"value": 10
},
{
"color": "yellow",
"value": 15
},
{
"color": "green",
"value": 25
}
]
}
},
{
"id": "custom.align",
"value": "center"
},
{
"id": "custom.cellOptions",
"value": {
"mode": "gradient",
"type": "color-background"
}
}
]
},
{
"matcher": {
"id": "byName",
"options": "自动续费证书时间（天）"
},
"properties": [
{
"id": "thresholds",
"value": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "red",
"value": 10
},
{
"color": "yellow",
"value": 15
},
{
"color": "green",
"value": 20
}
]
}
},
{
"id": "custom.cellOptions",
"value": {
"type": "color-background"
}
}
]
}
]
},
"gridPos": {
"h": 10,
"w": 12,
"x": 0,
"y": 9
},
"id": 5,
"options": {
"cellHeight": "sm",
"footer": {
"countRows": false,
"fields": "",
"reducer": [
"sum"
],
"show": false
},
"showHeader": true
},
"pluginVersion": "11.2.0",
"targets": [
{
"datasource": {
"type": "prometheus",
"uid": "${datasource}"
},
"editorMode": "code",
"exemplar": false,
"expr": "sort_desc(certmanager_certificate_expiration_timestamp_seconds{namespace=~\"$namespace\"} - time())/(24*3600)",
"format": "table",
"instant": true,
"legendFormat": "{{name}}",
"range": false,
"refId": "A"
},
{
"datasource": {
"type": "prometheus",
"uid": "${datasource}"
},
"editorMode": "code",
"exemplar": false,
"expr": "sort(certmanager_certificate_renewal_timestamp_seconds{namespace=~\"$namespace\"} - time())/(24*3600)",
"format": "table",
"hide": false,
"instant": true,
"legendFormat": "__auto",
"range": false,
"refId": "B"
}
],
"title": "证书有效期",
"transformations": [
{
"id": "joinByField",
"options": {
"byField": "name",
"mode": "outer"
}
},
{
"id": "organize",
"options": {
"excludeByName": {
"Time 1": false,
"instance 1": false,
"issuer_group 1": false,
"issuer_name 1": false,
"job 1": false,
"namespace 1": false
},
"includeByName": {},
"indexByName": {
"Time 1": 4,
"Time 2": 10,
"Value #A": 2,
"Value #B": 3,
"instance 1": 5,
"instance 2": 11,
"issuer_group 1": 8,
"issuer_group 2": 16,
"issuer_kind 1": 9,
"issuer_kind 2": 12,
"issuer_name 1": 6,
"issuer_name 2": 13,
"job 1": 7,
"job 2": 14,
"name": 0,
"namespace 1": 1,
"namespace 2": 15
},
"renameByName": {
"Value #A": "证书有效期（天）",
"Value #B": "自动续费证书时间（天）"
}
}
},
{
"id": "filterFieldsByName",
"options": {
"include": {
"names": [
"name",
"namespace 1",
"Value #A",
"Value #B"
]
}
}
}
],
"type": "table"
},
{
"datasource": {
"type": "prometheus",
"uid": "${datasource}"
},
"description": "Time before the certificates expire",
"fieldConfig": {
"defaults": {
"color": {
"mode": "palette-classic"
},
"custom": {
"axisBorderShow": false,
"axisCenteredZero": false,
"axisColorMode": "text",
"axisLabel": "",
"axisPlacement": "auto",
"barAlignment": 0,
"barWidthFactor": 0.6,
"drawStyle": "line",
"fillOpacity": 0,
"gradientMode": "none",
"hideFrom": {
"legend": false,
"tooltip": false,
"viz": false
},
"insertNulls": false,
"lineInterpolation": "linear",
"lineWidth": 1,
"pointSize": 5,
"scaleDistribution": {
"type": "linear"
},
"showPoints": "auto",
"spanNulls": false,
"stacking": {
"group": "A",
"mode": "none"
},
"thresholdsStyle": {
"mode": "off"
}
},
"mappings": [],
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
}
]
},
"unit": "none"
},
"overrides": [
{
"__systemRef": "hideSeriesFrom",
"matcher": {
"id": "byNames",
"options": {
"mode": "exclude",
"names": [
"api-elnkpro-ssl",
"alidns-webhook-tls"
],
"prefix": "All except:",
"readOnly": true
}
},
"properties": [
{
"id": "custom.hideFrom",
"value": {
"legend": false,
"tooltip": false,
"viz": true
}
}
]
}
]
},
"gridPos": {
"h": 10,
"w": 12,
"x": 12,
"y": 9
},
"id": 4,
"options": {
"legend": {
"calcs": [],
"displayMode": "list",
"placement": "right",
"showLegend": true
},
"tooltip": {
"mode": "single",
"sort": "none"
}
},
"targets": [
{
"datasource": {
"type": "prometheus",
"uid": "${datasource}"
},
"editorMode": "code",
"expr": "(certmanager_certificate_expiration_timestamp_seconds{namespace=~\"$namespace\"} - time())/(24*3600)",
"instant": false,
"legendFormat": "{{name}}",
"range": true,
"refId": "A"
}
],
"title": "证书到期时间",
"type": "timeseries"
}
],
"schemaVersion": 39,
"tags": [
"k8s",
"cert-manager"
],
"templating": {
"list": [
{
"current": {},
"hide": 0,
"includeAll": false,
"multi": false,
"name": "datasource",
"options": [],
"query": "prometheus",
"queryValue": "",
"refresh": 1,
"regex": "/^.*k8s/",
"skipUrlSync": false,
"type": "datasource"
},
{
"allValue": ".*",
"current": {},
"datasource": {
"type": "prometheus",
"uid": "${datasource}"
},
"definition": "label_values(certmanager_certificate_expiration_timestamp_seconds,namespace)",
"hide": 0,
"includeAll": true,
"multi": false,
"name": "namespace",
"options": [],
"query": {
"qryType": 1,
"query": "label_values(certmanager_certificate_expiration_timestamp_seconds,namespace)",
"refId": "PrometheusVariableQueryEditor-VariableQuery"
},
"refresh": 1,
"regex": "",
"skipUrlSync": false,
"sort": 0,
"type": "query"
}
]
},
"time": {
"from": "now-5m",
"to": "now"
},
"timepicker": {},
"timezone": "browser",
"title": "Cert-manager-Kubernetes",
"uid": "cert-manager-overview",
"version": 15,
"weekStart": ""
}
prometheus-stack/k8s/ingress.yaml
+2
View File
@@ -32,3 +32,5 @@ spec:
services:
- name: prometheus-stack-grafana
port: 80
tls:
secretName: internal-wildcard-tls
searxng/k8s/certificates.yaml
+16
View File
@@ -11,3 +11,19 @@ spec:
issuerRef:
name: letsencrypt-prod
kind: ClusterIssuer
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: internal-wildcard-tls
namespace: searxng
spec:
secretName: internal-wildcard-tls
dnsNames:
- "*.workstation.internal"
- "*.gigaforust.internal"
- workstation.internal
- gigaforust.internal
issuerRef:
name: internal-ca
kind: ClusterIssuer
searxng/k8s/ingress.yaml
+2
View File
@@ -32,3 +32,5 @@ spec:
services:
- name: searxng-service
port: 8080
tls:
secretName: internal-wildcard-tls
termix/k8s/certificates.yaml
+16
View File
@@ -10,3 +10,19 @@ spec:
issuerRef:
name: letsencrypt-prod
kind: ClusterIssuer
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: internal-wildcard-tls
namespace: termix
spec:
secretName: internal-wildcard-tls
dnsNames:
- "*.workstation.internal"
- "*.gigaforust.internal"
- workstation.internal
- gigaforust.internal
issuerRef:
name: internal-ca
kind: ClusterIssuer
termix/k8s/ingress.yaml
+2
View File
@@ -32,3 +32,5 @@ spec:
services:
- name: termix-service
port: 8080
tls:
secretName: internal-wildcard-tls
traefik/k8s/certificates.yaml
+16
View File
@@ -10,3 +10,19 @@ spec:
issuerRef:
name: letsencrypt-prod
kind: ClusterIssuer
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: internal-wildcard-tls
namespace: traefik
spec:
secretName: internal-wildcard-tls
dnsNames:
- "*.workstation.internal"
- "*.gigaforust.internal"
- workstation.internal
- gigaforust.internal
issuerRef:
name: internal-ca
kind: ClusterIssuer
traefik/k8s/ingress.yaml
+2
View File
@@ -33,3 +33,5 @@ spec:
services:
- name: api@internal
kind: TraefikService
tls:
secretName: internal-wildcard-tls
traefik/k8s/traefik-values.yaml
+1 -5
View File
@@ -121,11 +121,7 @@ persistence:
size: 100Mi
path: /data
# NOTE: no certificatesResolvers — public TLS is issued by cert-manager
# (see cert-manager/k8s/clusterissuer.yaml and per-service certificates.yaml).
# Traefik must not run its own ACME httpChallenge: its internal
# acme-http@internal router hijacks /.well-known/acme-challenge/ for every
# host and breaks external HTTP-01 solvers.
# No certificatesResolvers: public TLS comes from cert-manager.
volumes:
- name: traefik-dynamic
uptime-kuma/k8s/certificates.yaml
+16
View File
@@ -10,3 +10,19 @@ spec:
issuerRef:
name: letsencrypt-prod
kind: ClusterIssuer
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: internal-wildcard-tls
namespace: uptime-kuma
spec:
secretName: internal-wildcard-tls
dnsNames:
- "*.workstation.internal"
- "*.gigaforust.internal"
- workstation.internal
- gigaforust.internal
issuerRef:
name: internal-ca
kind: ClusterIssuer
uptime-kuma/k8s/ingress.yaml
+2
View File
@@ -32,3 +32,5 @@ spec:
services:
- name: uptime-kuma-service
port: 3001
tls:
secretName: internal-wildcard-tls
userbot/k8s/base/internal-certificate.yaml
+15
View File
@@ -0,0 +1,15 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: internal-wildcard-tls
namespace: userbot
spec:
secretName: internal-wildcard-tls
dnsNames:
- "*.workstation.internal"
- "*.gigaforust.internal"
- workstation.internal
- gigaforust.internal
issuerRef:
name: internal-ca
kind: ClusterIssuer
userbot/k8s/base/panel.yaml
+2
View File
@@ -262,3 +262,5 @@ spec:
services:
- name: userbot-panel
port: 8080
tls:
secretName: internal-wildcard-tls
vaultwarden/k8s/certificates.yaml
+16
View File
@@ -10,3 +10,19 @@ spec:
issuerRef:
name: letsencrypt-prod
kind: ClusterIssuer
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: internal-wildcard-tls
namespace: vaultwarden
spec:
secretName: internal-wildcard-tls
dnsNames:
- "*.workstation.internal"
- "*.gigaforust.internal"
- workstation.internal
- gigaforust.internal
issuerRef:
name: internal-ca
kind: ClusterIssuer
vaultwarden/k8s/ingress.yaml
+2
View File
@@ -29,3 +29,5 @@ spec:
services:
- name: vaultwarden-service
port: 80
tls:
secretName: internal-wildcard-tls
vpn/xui/k8s/certificates.yaml
+16
View File
@@ -10,3 +10,19 @@ spec:
issuerRef:
name: letsencrypt-prod
kind: ClusterIssuer
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: internal-wildcard-tls
namespace: xui
spec:
secretName: internal-wildcard-tls
dnsNames:
- "*.workstation.internal"
- "*.gigaforust.internal"
- workstation.internal
- gigaforust.internal
issuerRef:
name: internal-ca
kind: ClusterIssuer
vpn/xui/k8s/ingress.yaml
+5
View File
@@ -12,6 +12,9 @@ spec:
services:
- name: xui-service
port: 30379
tls:
secretName: internal-wildcard-tls
---
# Public panel access (optional).
# Realistic, but intentionally disabled: the panel has its own login,
@@ -79,3 +82,5 @@ spec:
services:
- name: xui-service
port: 10000
tls:
secretName: internal-wildcard-tls