From b9b8474455f43321b1ad4608533a17b2163eec3b Mon Sep 17 00:00:00 2001 From: mr-forust Date: Wed, 17 Jun 2026 01:50:33 +0200 Subject: [PATCH] feat(k8s): protect all prod routers with crowdsec middleware --- adguardhome/k8s/ingress.yaml | 4 ++++ authentik/k8s/ingress.yaml | 2 ++ checkmk/k8s/ingress.yaml | 2 ++ dockmon/k8s/ingress.yaml | 1 + downtify/k8s/ingress.yaml | 1 + headscale/k8s/ingress.yaml | 5 +++++ homepages/k8s/ingress.yaml | 2 ++ kener/k8s/ingress.yaml | 2 ++ n8n/k8s/ingress.yaml | 2 ++ netronome/k8s/ingress.yaml | 2 ++ nextcloud/k8s/ingress.yaml | 1 + portainer/k8s/ingress.yaml | 2 ++ searxng/k8s/ingress.yaml | 2 ++ termix/k8s/ingress.yaml | 2 ++ traefik/k8s/ingress.yaml | 2 ++ uptime-kuma/k8s/ingress.yaml | 2 ++ 16 files changed, 34 insertions(+) diff --git a/adguardhome/k8s/ingress.yaml b/adguardhome/k8s/ingress.yaml index 4c60f2e..b5b73a9 100644 --- a/adguardhome/k8s/ingress.yaml +++ b/adguardhome/k8s/ingress.yaml @@ -9,6 +9,8 @@ spec: routes: - match: Host(`adguard.forust.xyz`) || Host(`dns.forust.xyz`) kind: Rule + middlewares: + - name: "crowdsec-crowdsec-bouncer@kubernetescrd" services: - name: adguard-service port: 3000 @@ -41,6 +43,8 @@ spec: routes: - match: (Host(`adguard.forust.xyz`) || Host(`dns.forust.xyz`)) && PathPrefix(`/dns-query`) kind: Rule + middlewares: + - name: "crowdsec-crowdsec-bouncer@kubernetescrd" services: - name: adguard-service port: 3000 diff --git a/authentik/k8s/ingress.yaml b/authentik/k8s/ingress.yaml index 6297b9f..720b03c 100644 --- a/authentik/k8s/ingress.yaml +++ b/authentik/k8s/ingress.yaml @@ -9,6 +9,8 @@ spec: routes: - match: Host(`auth.forust.xyz`) kind: Rule + middlewares: + - name: "crowdsec-crowdsec-bouncer@kubernetescrd" services: - name: authentik-server-service port: 9000 diff --git a/checkmk/k8s/ingress.yaml b/checkmk/k8s/ingress.yaml index a4ec055..dad4ad3 100644 --- a/checkmk/k8s/ingress.yaml +++ b/checkmk/k8s/ingress.yaml @@ -9,6 +9,8 @@ spec: routes: - match: Host(`cmk.forust.xyz`) kind: Rule + middlewares: + - name: crowdsec-crowdsec-bouncer@kubernetescrd services: - name: checkmk-service port: 5000 diff --git a/dockmon/k8s/ingress.yaml b/dockmon/k8s/ingress.yaml index 417a652..0c7781d 100644 --- a/dockmon/k8s/ingress.yaml +++ b/dockmon/k8s/ingress.yaml @@ -18,6 +18,7 @@ spec: - match: Host(`dockmon.forust.xyz`) kind: Rule middlewares: + - name: crowdsec-crowdsec-bouncer@kubernetescrd - name: security-headers@file services: - name: dockmon-service diff --git a/downtify/k8s/ingress.yaml b/downtify/k8s/ingress.yaml index 7c6f3ef..5b353ae 100644 --- a/downtify/k8s/ingress.yaml +++ b/downtify/k8s/ingress.yaml @@ -10,6 +10,7 @@ spec: - match: Host(`downtify.forust.xyz`) kind: Rule middlewares: + - name: crowdsec-crowdsec-bouncer@kubernetescrd - name: security-chain@file services: - name: downtify-service diff --git a/headscale/k8s/ingress.yaml b/headscale/k8s/ingress.yaml index 4c5eddb..a3dfc2a 100644 --- a/headscale/k8s/ingress.yaml +++ b/headscale/k8s/ingress.yaml @@ -9,6 +9,8 @@ spec: routes: - match: Host(`hs.forust.xyz`) kind: Rule + middlewares: + - name: crowdsec-crowdsec-bouncer@kubernetescrd services: - name: headscale-server-external port: 8080 @@ -43,6 +45,7 @@ spec: - match: Host(`hs.forust.xyz`) && PathPrefix(`/admin`) kind: Rule middlewares: + - name: crowdsec-crowdsec-bouncer@kubernetescrd - name: security-chain@file services: - name: headscale-ui-external @@ -77,6 +80,8 @@ spec: routes: - match: Host(`hs.forust.xyz`) && PathPrefix(`/metrics`) kind: Rule + middlewares: + - name: crowdsec-crowdsec-bouncer@kubernetescrd services: - name: headscale-server-external port: 9090 diff --git a/homepages/k8s/ingress.yaml b/homepages/k8s/ingress.yaml index 6d25bd6..f0c82ef 100644 --- a/homepages/k8s/ingress.yaml +++ b/homepages/k8s/ingress.yaml @@ -45,6 +45,8 @@ spec: routes: - match: Host(`xdfnx.cfd`) || Host(`www.xdfnx.cfd`) kind: Rule + middlewares: + - name: crowdsec-crowdsec-bouncer@kubernetescrd services: - name: xdfnx-homepage-service port: 80 diff --git a/kener/k8s/ingress.yaml b/kener/k8s/ingress.yaml index 0b14999..76444e2 100644 --- a/kener/k8s/ingress.yaml +++ b/kener/k8s/ingress.yaml @@ -9,6 +9,8 @@ spec: routes: - match: Host(`status.forust.xyz`) kind: Rule + middlewares: + - name: crowdsec-crowdsec-bouncer@kubernetescrd services: - name: kener-service port: 3000 diff --git a/n8n/k8s/ingress.yaml b/n8n/k8s/ingress.yaml index f0248c6..8c26df7 100644 --- a/n8n/k8s/ingress.yaml +++ b/n8n/k8s/ingress.yaml @@ -9,6 +9,8 @@ spec: routes: - match: Host(`n8n.forust.xyz`) kind: Rule + middlewares: + - name: "crowdsec-crowdsec-bouncer@kubernetescrd" services: - name: n8n-service port: 5678 diff --git a/netronome/k8s/ingress.yaml b/netronome/k8s/ingress.yaml index 823e167..c05eed4 100644 --- a/netronome/k8s/ingress.yaml +++ b/netronome/k8s/ingress.yaml @@ -9,6 +9,8 @@ spec: routes: - match: Host(`nm.forust.xyz`) kind: Rule + middlewares: + - name: "crowdsec-crowdsec-bouncer@kubernetescrd" services: - name: netronome-service port: 7575 diff --git a/nextcloud/k8s/ingress.yaml b/nextcloud/k8s/ingress.yaml index e86ea0a..63f332e 100644 --- a/nextcloud/k8s/ingress.yaml +++ b/nextcloud/k8s/ingress.yaml @@ -31,6 +31,7 @@ spec: - match: HostRegexp(`^nextcloud\.(workstation|gigaforust)\.internal$`) kind: Rule middlewares: + - name: "crowdsec-crowdsec-bouncer@kubernetescrd" - name: nextcloud-chain@file services: - name: nextcloud-apache diff --git a/portainer/k8s/ingress.yaml b/portainer/k8s/ingress.yaml index 47bb2ca..7d7a59a 100644 --- a/portainer/k8s/ingress.yaml +++ b/portainer/k8s/ingress.yaml @@ -9,6 +9,8 @@ spec: routes: - match: Host(`portainer.forust.xyz`) kind: Rule + middlewares: + - name: "crowdsec-crowdsec-bouncer@kubernetescrd" services: - name: portainer-service port: 9000 diff --git a/searxng/k8s/ingress.yaml b/searxng/k8s/ingress.yaml index 0c42675..86c834e 100644 --- a/searxng/k8s/ingress.yaml +++ b/searxng/k8s/ingress.yaml @@ -9,6 +9,8 @@ spec: routes: - match: Host(`s.forust.xyz`) || Host(`search.forust.xyz`) kind: Rule + middlewares: + - name: "crowdsec-crowdsec-bouncer@kubernetescrd" services: - name: searxng-service port: 8080 diff --git a/termix/k8s/ingress.yaml b/termix/k8s/ingress.yaml index 355b5eb..dcd5310 100644 --- a/termix/k8s/ingress.yaml +++ b/termix/k8s/ingress.yaml @@ -9,6 +9,8 @@ spec: routes: - match: Host(`termix.forust.xyz`) kind: Rule + middlewares: + - name: "crowdsec-crowdsec-bouncer@kubernetescrd" services: - name: termix-service port: 8080 diff --git a/traefik/k8s/ingress.yaml b/traefik/k8s/ingress.yaml index b8e52f8..b3b531d 100644 --- a/traefik/k8s/ingress.yaml +++ b/traefik/k8s/ingress.yaml @@ -10,6 +10,8 @@ spec: routes: - match: Host(`traefik.forust.xyz`) kind: Rule + middlewares: + - name: "crowdsec-crowdsec-bouncer@kubernetescrd" services: - name: api@internal kind: TraefikService diff --git a/uptime-kuma/k8s/ingress.yaml b/uptime-kuma/k8s/ingress.yaml index a31b373..8126226 100644 --- a/uptime-kuma/k8s/ingress.yaml +++ b/uptime-kuma/k8s/ingress.yaml @@ -9,6 +9,8 @@ spec: routes: - match: Host(`uptime.forust.xyz`) kind: Rule + middlewares: + - name: crowdsec-crowdsec-bouncer@kubernetescrd services: - name: uptime-kuma-service port: 3001