From bb5a3697f2a51a194bbe7c53a2036ecf6c2061b2 Mon Sep 17 00:00:00 2001
From: mr-forust <vzlomdsisma@gmail.com>
Date: Tue, 16 Jun 2026 13:35:03 +0200
Subject: [PATCH] feat: bentopdf k8s manifests

---
 converters/compose.yaml             |  7 ++---
 converters/k8s/bentopdf.yaml        | 42 +++++++++++++++++++++++++++++
 converters/k8s/ingress.yaml         | 32 ++++++++++++++++++++++
 converters/k8s/secrets.yaml.example |  1 +
 homepages/k8s/ingress.yaml          |  2 ++
 nextcloud/k8s/ingress.yaml          | 40 ++++++++++++++-------------
 6 files changed, 102 insertions(+), 22 deletions(-)
 create mode 100644 converters/k8s/bentopdf.yaml

diff --git a/converters/compose.yaml b/converters/compose.yaml
index 72bff78..30e6fff 100644
--- a/converters/compose.yaml
+++ b/converters/compose.yaml
@@ -47,17 +47,18 @@ services:
     labels: 
       - "traefik.enable=true"
       - "traefik.http.services.bentopdf.loadbalancer.server.port=8080"
+      
       # Prod router
-      - "traefik.http.routers.bentopdf.rule=(Host(`forust.xyz`) || Host(www.forust.xyz)) && PathPrefix(`pdf-tools`)"
+      - "traefik.http.routers.bentopdf.rule=Host(`pdf.forust.xyz`)"
       - "traefik.http.routers.bentopdf.entrypoints=websecure"
       - "traefik.http.routers.bentopdf.tls.certresolver=letsencrypt"
       - "traefik.http.routers.bentopdf.tls=true"
       # Local router
-      - "traefik.http.routers.bentopdf-local.rule=Host(`workstation.internal`) && PathPrefix(`pdf-tools`)"
+      - "traefik.http.routers.bentopdf-local.rule=Host(`pdf.wokstation.internal`)"
       - "traefik.http.routers.bentopdf-local.entrypoints=websecure"
       - "traefik.http.routers.bentopdf-local.tls=true"
         # Prod router
-      - "traefik.http.routers.bentopdf-dev.rule=Host(`gigaforust.internal`) && PathPrefix(`pdf-tools`)"
+      - "traefik.http.routers.bentopdf-dev.rule=Host(`pdf.gigaforust.internal`)"
       - "traefik.http.routers.bentopdf-dev.entrypoints=websecure"
       - "traefik.http.routers.bentopdf-dev.tls=true"
     networks:
diff --git a/converters/k8s/bentopdf.yaml b/converters/k8s/bentopdf.yaml
new file mode 100644
index 0000000..8aeb5cc
--- /dev/null
+++ b/converters/k8s/bentopdf.yaml
@@ -0,0 +1,42 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: bentopdf-service
+  namespace: converters
+spec:
+  selector:
+    app: bentopdf
+  ports:
+    - port: 8080
+      targetPort: 8080
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: bentopdf-deployment
+  namespace: converters
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: bentopdf
+  template:
+    metadata:
+      labels:
+        app: bentopdf
+    spec:
+      containers:
+        - image: bentopdf/bentopdf:latest
+          imagePullPolicy: Always
+          name: bentopdf
+          ports:
+            - containerPort: 8080
+          resources:
+            requests:
+              memory: "50Mi"
+              cpu: "50m"
+              ephemeral-storage: "100Mi"
+            limits:
+              memory: "700Mi"
+              cpu: "700m"
+              ephemeral-storage: "5Gi"
diff --git a/converters/k8s/ingress.yaml b/converters/k8s/ingress.yaml
index 26cc43b..530ab29 100644
--- a/converters/k8s/ingress.yaml
+++ b/converters/k8s/ingress.yaml
@@ -31,3 +31,35 @@ spec:
       services:
         - name: convertx-service
           port: 3000
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: bentopdf-prod
+  namespace: converters
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`pdf.forust.xyz`)
+      kind: Rule
+      services:
+        - name: bentopdf-service
+          port: 8080
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: bentopdf-local
+  namespace: converters
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: HostRegexp(`^pdf\.(workstation|gigaforust)\.internal$`)
+      kind: Rule
+      services:
+        - name: bentopdf-service
+          port: 8080
diff --git a/converters/k8s/secrets.yaml.example b/converters/k8s/secrets.yaml.example
index 58902a9..f827fb1 100644
--- a/converters/k8s/secrets.yaml.example
+++ b/converters/k8s/secrets.yaml.example
@@ -2,6 +2,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: convertx-secrets
+  namespace: converters
 type: Opaque
 stringData:
   jwt-secret: ""
diff --git a/homepages/k8s/ingress.yaml b/homepages/k8s/ingress.yaml
index ac9a471..6d25bd6 100644
--- a/homepages/k8s/ingress.yaml
+++ b/homepages/k8s/ingress.yaml
@@ -9,6 +9,8 @@ spec:
   routes:
     - match: Host(`forust.xyz`) || Host(`www.forust.xyz`)
       kind: Rule
+      middlewares:
+        - name: crowdsec-crowdsec-bouncer@kubernetescrd
       priority: 10
       services:
         - name: forust-homepage-service
diff --git a/nextcloud/k8s/ingress.yaml b/nextcloud/k8s/ingress.yaml
index 14764b3..e86ea0a 100644
--- a/nextcloud/k8s/ingress.yaml
+++ b/nextcloud/k8s/ingress.yaml
@@ -12,6 +12,7 @@ spec:
       kind: Rule
       middlewares:
         - name: nextcloud-chain@file
+        - name: crowdsec-crowdsec-bouncer@kubernetescrd
       services:
         - name: nextcloud-apache
           port: 11000
@@ -35,26 +36,27 @@ spec:
         - name: nextcloud-apache
           port: 11000
 
----
+
+# ---
 # Nextcloud AIO
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: naio-prod
-  namespace: nextcloud
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`naio.forust.xyz`)
-      kind: Rule
-      services:
-        - name: nextcloud-aio
-          port: 8888
-          scheme: https
-          serversTransport: insecure-transport # <-- Ссылка на ваш CRD ресурс вместо @file
-  tls:
-    certResolver: letsencrypt
+# apiVersion: traefik.io/v1alpha1
+# kind: IngressRoute
+# metadata:
+#   name: naio-prod
+#   namespace: nextcloud
+# spec:
+#   entryPoints:
+# - websecure
+# routes:
+#   - match: Host(`naio.forust.xyz`)
+#     kind: Rule
+#     services:
+#       - name: nextcloud-aio
+#         port: 8888
+#         scheme: https
+#         serversTransport: insecure-transport
+# tls:
+#   certResolver: letsencrypt
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute