diff --git a/adguardhome/k8s/ingress.yaml b/adguardhome/k8s/ingress.yaml index 0e101da..2832a7f 100644 --- a/adguardhome/k8s/ingress.yaml +++ b/adguardhome/k8s/ingress.yaml @@ -42,3 +42,5 @@ spec: services: - name: adguard-service port: 3000 + tls: + secretName: internal-wildcard-tls diff --git a/adguardhome/k8s/internal-certificate.yaml b/adguardhome/k8s/internal-certificate.yaml new file mode 100644 index 0000000..f443127 --- /dev/null +++ b/adguardhome/k8s/internal-certificate.yaml @@ -0,0 +1,15 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: adguard +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/authentik/k8s/certificates.yaml b/authentik/k8s/certificates.yaml index f9f7708..d8add27 100644 --- a/authentik/k8s/certificates.yaml +++ b/authentik/k8s/certificates.yaml @@ -10,3 +10,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: authentik +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/authentik/k8s/ingress.yaml b/authentik/k8s/ingress.yaml index 6e06750..2294f35 100644 --- a/authentik/k8s/ingress.yaml +++ b/authentik/k8s/ingress.yaml @@ -32,3 +32,5 @@ spec: services: - name: authentik-server-service port: 9000 + tls: + secretName: internal-wildcard-tls diff --git a/cert-manager/k8s/homelab-internal-root-ca.crt b/cert-manager/k8s/homelab-internal-root-ca.crt new file mode 100644 index 0000000..61c91cc --- /dev/null +++ b/cert-manager/k8s/homelab-internal-root-ca.crt @@ -0,0 +1,30 @@ +-----BEGIN CERTIFICATE----- +MIIFFjCCAv6gAwIBAgIUetKpTfEDOn2985FFMu6G26itT+wwDQYJKoZIhvcNAQEN +BQAwIzEhMB8GA1UEAxMYaG9tZWxhYiBpbnRlcm5hbCByb290IENBMB4XDTI2MDky +MzEyNDA0N1oXDTM2MDkyMDEyNDA0N1owIzEhMB8GA1UEAxMYaG9tZWxhYiBpbnRl +cm5hbCByb290IENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAvmNP +ZCOoD8NtNuYJKVXBlTPjX7D7sJCSK5neH7ZbYV5+lmUlEErY8Mik7j37V5k5NfpF +Ig85pOjP7RckTPz5V6ek3yaN40s4AL053sN5ZPauDVYjalaEHTgj5sEMqlLACQWI +yZmJOZspZykae8dIpQnqCoFpRT4FurJ78v4a0ylnFVLMQn/lyCHedwTjkEdtYWYr +ccJy8vQwqkzs/rWvEH1lDqZhennLOrmcCjfonG7D/pruMn4z+6E28p4+ejkRrI6x +luak3KnpT1XMeHtgU21hiRGaMDBchHMFgAhnY1qosymKenXvfTZItwgjZbwa1hJI +GAiDm+jQDKMjzRZ3rH6Xfc0auUcykNz73PpNu1NGm78nndXwCXcXn1LFKNQJ+r1U +sJiyAmUZmXVn4aM4OMf2F38k7wTYIKg7nRGaUkNeKDlNkjA4HvgWw+jwO1KmdHQ/ +mOem1rosDWHRK01wg+Gga9mQCnhNhxglg3t/UeSic6uOaRsvaz4qkzHq8MbCujVz +DpKQjqdikYOAXZOs4KlBLWrS7NaK4NzfSD02pBUErh54ruJfY/bWz9KyXzBD/lQZ +VUTKyvUVB0bkVHEdf1jJmX3H4IZRQSF5JPqOBotW6bJI5fEGNBvj9Zxy4nm2WWGz +yyP3uWsQz8U/Wdx9nXZLHInTZBsvgLYtKUAWA30CAwEAAaNCMEAwDgYDVR0PAQH/ +BAQDAgKkMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFEkKm2rxPaK6+O9WD80z +BLC6F9QsMA0GCSqGSIb3DQEBDQUAA4ICAQAnFyHz97Umf5VIu+dKTJid7C73VugJ +TIar/xJBs/4CxP+znBxhJjXygRoyIfzoVGWcB2ZSL//vL78Qlts79K/Imc9a4RFF +wMvCxsRXAEQ4TpeWi3ophPNcs4rhsP+gQKQFtnyKP9519bqpfxp0bTqwOV2o18fn +za7rlQViiEnNV58j7CVoM9+mJvVVfBEX1Km+GyJL9GadzbIQ7FxClVJZefCbft93 +zHVk9gDOw8ys1XGSR2OUCyCLinXO6mqS16CmBb2MAKXq/YyH7E0N8iotAPGtfA8V +M/0ddy947rY0xCrtECfWwvGQpJS7NRv/Z9b2jCfXrI5LXmL2nfQRg0y9GE4Vjwr+ +WxtGU5jOeFt0jQ+xRzcgG0Op+qK3x55l5LSo2hOcOVYbiHxcHEJFgwNi1ADeBFwb +q/HdysfURSOghqjIpMMAUabBp+DBUg2EUF7pIaUqbdqExFYcr9EYisEMiNsmKmN+ +8ZbcOeerFKDQj+t/R0bFXa7UBn2UWsjI8zlR74aa2kLDXwtyz/XlO/FlYm66eBFo +2/eYUSeU+S4ej+wUAs/dvjF7f190/DUQGuwOTlLTahqWDztmhCk7qzbECu56CwKT +E5Ect2P72UleYwdblkVOVd352AmiwEzdOaziIRrPh8uenEknH6JBYPO3mjk7cCg+ +GPGcNIBctjdXhg== +-----END CERTIFICATE----- diff --git a/cert-manager/k8s/internal-ca.yaml b/cert-manager/k8s/internal-ca.yaml new file mode 100644 index 0000000..686d7ce --- /dev/null +++ b/cert-manager/k8s/internal-ca.yaml @@ -0,0 +1,33 @@ +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: selfsigned +spec: + selfSigned: {} +--- +# Homelab internal root CA (10y). Install the .crt on clients (see below). +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-ca-root + namespace: cert-manager +spec: + isCA: true + commonName: homelab internal root CA + duration: 87600h + renewBefore: 7200h + secretName: internal-ca-root + privateKey: + algorithm: RSA + size: 4096 + issuerRef: + name: selfsigned + kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: internal-ca +spec: + ca: + secretName: internal-ca-root diff --git a/checkmk/k8s/certificates.yaml b/checkmk/k8s/certificates.yaml index d9dbf77..4e2ad05 100644 --- a/checkmk/k8s/certificates.yaml +++ b/checkmk/k8s/certificates.yaml @@ -10,3 +10,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: checkmk +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/checkmk/k8s/ingress.yaml b/checkmk/k8s/ingress.yaml index 28f2bbc..c736bc7 100644 --- a/checkmk/k8s/ingress.yaml +++ b/checkmk/k8s/ingress.yaml @@ -48,3 +48,5 @@ spec: services: - name: checkmk-service port: 5000 + tls: + secretName: internal-wildcard-tls diff --git a/converters/k8s/certificates.yaml b/converters/k8s/certificates.yaml index c23fe42..92a2955 100644 --- a/converters/k8s/certificates.yaml +++ b/converters/k8s/certificates.yaml @@ -24,3 +24,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: converters +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/converters/k8s/ingress.yaml b/converters/k8s/ingress.yaml index 88e36a5..d3393d8 100644 --- a/converters/k8s/ingress.yaml +++ b/converters/k8s/ingress.yaml @@ -31,6 +31,9 @@ spec: services: - name: convertx-service port: 3000 + tls: + secretName: internal-wildcard-tls + --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute @@ -63,3 +66,5 @@ spec: services: - name: bentopdf-service port: 8080 + tls: + secretName: internal-wildcard-tls diff --git a/dockmon/k8s/certificates.yaml b/dockmon/k8s/certificates.yaml index 6d434e1..6a2d511 100644 --- a/dockmon/k8s/certificates.yaml +++ b/dockmon/k8s/certificates.yaml @@ -10,3 +10,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: dockmon +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/dockmon/k8s/ingress.yaml b/dockmon/k8s/ingress.yaml index bbbd450..50d2fbf 100644 --- a/dockmon/k8s/ingress.yaml +++ b/dockmon/k8s/ingress.yaml @@ -43,3 +43,5 @@ spec: - name: dockmon-service port: 443 serversTransport: dockmon-transport + tls: + secretName: internal-wildcard-tls diff --git a/downtify/k8s/ingress.yaml b/downtify/k8s/ingress.yaml index 25b5cf4..e6711a5 100644 --- a/downtify/k8s/ingress.yaml +++ b/downtify/k8s/ingress.yaml @@ -33,3 +33,5 @@ spec: services: - name: downtify-service port: 8000 + tls: + secretName: internal-wildcard-tls diff --git a/downtify/k8s/internal-certificate.yaml b/downtify/k8s/internal-certificate.yaml new file mode 100644 index 0000000..cdb4cd0 --- /dev/null +++ b/downtify/k8s/internal-certificate.yaml @@ -0,0 +1,15 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: downtify +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/gitea/k8s/certificates.yaml b/gitea/k8s/certificates.yaml index f480d47..d7fc71e 100644 --- a/gitea/k8s/certificates.yaml +++ b/gitea/k8s/certificates.yaml @@ -11,3 +11,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: gitea +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/gitea/k8s/ingress.yaml b/gitea/k8s/ingress.yaml index 28dba3d..61b138c 100644 --- a/gitea/k8s/ingress.yaml +++ b/gitea/k8s/ingress.yaml @@ -45,6 +45,9 @@ spec: services: - name: gitea-service port: 3000 + tls: + secretName: internal-wildcard-tls + --- apiVersion: traefik.io/v1alpha1 kind: IngressRouteTCP diff --git a/glance/k8s/certificates.yaml b/glance/k8s/certificates.yaml index ae0bfb9..4a74661 100644 --- a/glance/k8s/certificates.yaml +++ b/glance/k8s/certificates.yaml @@ -11,3 +11,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: glance +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/glance/k8s/ingress.yaml b/glance/k8s/ingress.yaml index b84dfb4..f3411a6 100644 --- a/glance/k8s/ingress.yaml +++ b/glance/k8s/ingress.yaml @@ -35,6 +35,9 @@ spec: services: - name: glance-service port: 8080 + tls: + secretName: internal-wildcard-tls + --- apiVersion: traefik.io/v1alpha1 kind: Middleware diff --git a/headscale/k8s/routing/certificates.yaml b/headscale/k8s/routing/certificates.yaml index fb1f60b..60d80ca 100644 --- a/headscale/k8s/routing/certificates.yaml +++ b/headscale/k8s/routing/certificates.yaml @@ -23,3 +23,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: headscale +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/headscale/k8s/routing/ingress.yaml b/headscale/k8s/routing/ingress.yaml index baad830..cbdc496 100644 --- a/headscale/k8s/routing/ingress.yaml +++ b/headscale/k8s/routing/ingress.yaml @@ -90,6 +90,9 @@ spec: services: - name: headscale-server-external port: 9090 + tls: + secretName: internal-wildcard-tls + --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute @@ -110,3 +113,5 @@ spec: services: - name: headplane-external port: 3000 + tls: + secretName: internal-wildcard-tls diff --git a/homepages/k8s/certificates.yaml b/homepages/k8s/certificates.yaml index 2b64384..02f0768 100644 --- a/homepages/k8s/certificates.yaml +++ b/homepages/k8s/certificates.yaml @@ -24,3 +24,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: homepages +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/homepages/k8s/ingress.yaml b/homepages/k8s/ingress.yaml index 11e989b..049d546 100644 --- a/homepages/k8s/ingress.yaml +++ b/homepages/k8s/ingress.yaml @@ -34,6 +34,9 @@ spec: services: - name: forust-homepage-service port: 80 + tls: + secretName: internal-wildcard-tls + --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute @@ -69,3 +72,5 @@ spec: services: - name: xdfnx-homepage-service port: 80 + tls: + secretName: internal-wildcard-tls diff --git a/kener/k8s/ingress.yaml b/kener/k8s/ingress.yaml index 56b0fb8..13d2403 100644 --- a/kener/k8s/ingress.yaml +++ b/kener/k8s/ingress.yaml @@ -32,3 +32,5 @@ spec: services: - name: kener-service port: 3000 + tls: + secretName: internal-wildcard-tls diff --git a/kener/k8s/internal-certificate.yaml b/kener/k8s/internal-certificate.yaml new file mode 100644 index 0000000..1463fa2 --- /dev/null +++ b/kener/k8s/internal-certificate.yaml @@ -0,0 +1,15 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: kener +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/metube/k8s/certificates.yaml b/metube/k8s/certificates.yaml index 3a9fe04..59cd001 100644 --- a/metube/k8s/certificates.yaml +++ b/metube/k8s/certificates.yaml @@ -10,3 +10,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: metube +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/metube/k8s/ingress.yaml b/metube/k8s/ingress.yaml index 455c26d..e99b71e 100644 --- a/metube/k8s/ingress.yaml +++ b/metube/k8s/ingress.yaml @@ -31,3 +31,5 @@ spec: services: - name: metube-service port: 8081 + tls: + secretName: internal-wildcard-tls diff --git a/n8n/k8s/ingress.yaml b/n8n/k8s/ingress.yaml index ee875e7..b8d7078 100644 --- a/n8n/k8s/ingress.yaml +++ b/n8n/k8s/ingress.yaml @@ -32,3 +32,5 @@ spec: services: - name: n8n-service port: 5678 + tls: + secretName: internal-wildcard-tls diff --git a/n8n/k8s/internal-certificate.yaml b/n8n/k8s/internal-certificate.yaml new file mode 100644 index 0000000..71bee05 --- /dev/null +++ b/n8n/k8s/internal-certificate.yaml @@ -0,0 +1,15 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: n8n +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/netronome/k8s/certificates.yaml b/netronome/k8s/certificates.yaml index 9c75d31..cc366ac 100644 --- a/netronome/k8s/certificates.yaml +++ b/netronome/k8s/certificates.yaml @@ -10,3 +10,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: netronome +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/netronome/k8s/ingress.yaml b/netronome/k8s/ingress.yaml index ca8128c..0025d05 100644 --- a/netronome/k8s/ingress.yaml +++ b/netronome/k8s/ingress.yaml @@ -32,3 +32,5 @@ spec: services: - name: netronome-service port: 7575 + tls: + secretName: internal-wildcard-tls diff --git a/nextcloud/k8s/routing/certificates.yaml b/nextcloud/k8s/routing/certificates.yaml index 535ee50..39d0cff 100644 --- a/nextcloud/k8s/routing/certificates.yaml +++ b/nextcloud/k8s/routing/certificates.yaml @@ -10,3 +10,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: nextcloud +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/nextcloud/k8s/routing/ingress.yaml b/nextcloud/k8s/routing/ingress.yaml index 1f4dbf0..f9a7e84 100644 --- a/nextcloud/k8s/routing/ingress.yaml +++ b/nextcloud/k8s/routing/ingress.yaml @@ -38,26 +38,29 @@ spec: services: - name: nextcloud-apache port: 11000 -# --- -# Nextcloud AIO -# apiVersion: traefik.io/v1alpha1 -# kind: IngressRoute -# metadata: -# name: naio-prod -# namespace: nextcloud -# spec: -# entryPoints: -# - websecure -# routes: -# - match: Host(`naio.forust.xyz`) -# kind: Rule -# services: -# - name: nextcloud-aio -# port: 8888 -# scheme: https -# serversTransport: insecure-transport -# tls: -# certResolver: letsencrypt + # --- + # Nextcloud AIO + # apiVersion: traefik.io/v1alpha1 + # kind: IngressRoute + # metadata: + # name: naio-prod + # namespace: nextcloud + # spec: + # entryPoints: + # - websecure + # routes: + # - match: Host(`naio.forust.xyz`) + # kind: Rule + # services: + # - name: nextcloud-aio + # port: 8888 + # scheme: https + # serversTransport: insecure-transport + # tls: + # certResolver: letsencrypt + tls: + secretName: internal-wildcard-tls + --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute @@ -75,3 +78,5 @@ spec: port: 8888 scheme: https serversTransport: insecure-transport + tls: + secretName: internal-wildcard-tls diff --git a/portainer/k8s/certificates.yaml b/portainer/k8s/certificates.yaml index a7f4418..c843a3a 100644 --- a/portainer/k8s/certificates.yaml +++ b/portainer/k8s/certificates.yaml @@ -10,3 +10,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: portainer +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/portainer/k8s/ingress.yaml b/portainer/k8s/ingress.yaml index e0bd5d9..cc2283b 100644 --- a/portainer/k8s/ingress.yaml +++ b/portainer/k8s/ingress.yaml @@ -32,3 +32,5 @@ spec: services: - name: portainer-service port: 9000 + tls: + secretName: internal-wildcard-tls diff --git a/prometheus-stack/k8s/certificates.yaml b/prometheus-stack/k8s/certificates.yaml index e90f19d..fef8eb1 100644 --- a/prometheus-stack/k8s/certificates.yaml +++ b/prometheus-stack/k8s/certificates.yaml @@ -10,3 +10,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: prometheus +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/prometheus-stack/k8s/ingress.yaml b/prometheus-stack/k8s/ingress.yaml index 8d712c4..bdb0451 100644 --- a/prometheus-stack/k8s/ingress.yaml +++ b/prometheus-stack/k8s/ingress.yaml @@ -32,3 +32,5 @@ spec: services: - name: prometheus-stack-grafana port: 80 + tls: + secretName: internal-wildcard-tls diff --git a/searxng/k8s/certificates.yaml b/searxng/k8s/certificates.yaml index eef650a..d3487d9 100644 --- a/searxng/k8s/certificates.yaml +++ b/searxng/k8s/certificates.yaml @@ -11,3 +11,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: searxng +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/searxng/k8s/ingress.yaml b/searxng/k8s/ingress.yaml index db223f1..c75b27b 100644 --- a/searxng/k8s/ingress.yaml +++ b/searxng/k8s/ingress.yaml @@ -32,3 +32,5 @@ spec: services: - name: searxng-service port: 8080 + tls: + secretName: internal-wildcard-tls diff --git a/termix/k8s/certificates.yaml b/termix/k8s/certificates.yaml index c1b4afe..93859ff 100644 --- a/termix/k8s/certificates.yaml +++ b/termix/k8s/certificates.yaml @@ -10,3 +10,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: termix +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/termix/k8s/ingress.yaml b/termix/k8s/ingress.yaml index bfbbfa8..b6dcf28 100644 --- a/termix/k8s/ingress.yaml +++ b/termix/k8s/ingress.yaml @@ -32,3 +32,5 @@ spec: services: - name: termix-service port: 8080 + tls: + secretName: internal-wildcard-tls diff --git a/traefik/k8s/certificates.yaml b/traefik/k8s/certificates.yaml index d1f5c71..bcb3d63 100644 --- a/traefik/k8s/certificates.yaml +++ b/traefik/k8s/certificates.yaml @@ -10,3 +10,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: traefik +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/traefik/k8s/ingress.yaml b/traefik/k8s/ingress.yaml index 83b4717..f6e5a59 100644 --- a/traefik/k8s/ingress.yaml +++ b/traefik/k8s/ingress.yaml @@ -33,3 +33,5 @@ spec: services: - name: api@internal kind: TraefikService + tls: + secretName: internal-wildcard-tls diff --git a/traefik/k8s/traefik-values.yaml b/traefik/k8s/traefik-values.yaml index bdadaf5..9fc2e63 100644 --- a/traefik/k8s/traefik-values.yaml +++ b/traefik/k8s/traefik-values.yaml @@ -121,11 +121,7 @@ persistence: size: 100Mi path: /data -# NOTE: no certificatesResolvers — public TLS is issued by cert-manager -# (see cert-manager/k8s/clusterissuer.yaml and per-service certificates.yaml). -# Traefik must not run its own ACME httpChallenge: its internal -# acme-http@internal router hijacks /.well-known/acme-challenge/ for every -# host and breaks external HTTP-01 solvers. +# No certificatesResolvers: public TLS comes from cert-manager. volumes: - name: traefik-dynamic diff --git a/uptime-kuma/k8s/certificates.yaml b/uptime-kuma/k8s/certificates.yaml index be2767d..babc5c8 100644 --- a/uptime-kuma/k8s/certificates.yaml +++ b/uptime-kuma/k8s/certificates.yaml @@ -10,3 +10,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: uptime-kuma +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/uptime-kuma/k8s/ingress.yaml b/uptime-kuma/k8s/ingress.yaml index c730da2..3f8f83e 100644 --- a/uptime-kuma/k8s/ingress.yaml +++ b/uptime-kuma/k8s/ingress.yaml @@ -32,3 +32,5 @@ spec: services: - name: uptime-kuma-service port: 3001 + tls: + secretName: internal-wildcard-tls diff --git a/userbot/k8s/base/internal-certificate.yaml b/userbot/k8s/base/internal-certificate.yaml new file mode 100644 index 0000000..9b4f232 --- /dev/null +++ b/userbot/k8s/base/internal-certificate.yaml @@ -0,0 +1,15 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: userbot +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/userbot/k8s/base/panel.yaml b/userbot/k8s/base/panel.yaml index 4f738c8..2de09f6 100644 --- a/userbot/k8s/base/panel.yaml +++ b/userbot/k8s/base/panel.yaml @@ -262,3 +262,5 @@ spec: services: - name: userbot-panel port: 8080 + tls: + secretName: internal-wildcard-tls diff --git a/vaultwarden/k8s/certificates.yaml b/vaultwarden/k8s/certificates.yaml index b5a2119..c20eaa6 100644 --- a/vaultwarden/k8s/certificates.yaml +++ b/vaultwarden/k8s/certificates.yaml @@ -10,3 +10,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: vaultwarden +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/vaultwarden/k8s/ingress.yaml b/vaultwarden/k8s/ingress.yaml index 24c74e0..86fcbc5 100644 --- a/vaultwarden/k8s/ingress.yaml +++ b/vaultwarden/k8s/ingress.yaml @@ -29,3 +29,5 @@ spec: services: - name: vaultwarden-service port: 80 + tls: + secretName: internal-wildcard-tls diff --git a/vpn/xui/k8s/certificates.yaml b/vpn/xui/k8s/certificates.yaml index ec4bbe0..7ececa5 100644 --- a/vpn/xui/k8s/certificates.yaml +++ b/vpn/xui/k8s/certificates.yaml @@ -10,3 +10,19 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-wildcard-tls + namespace: xui +spec: + secretName: internal-wildcard-tls + dnsNames: + - "*.workstation.internal" + - "*.gigaforust.internal" + - workstation.internal + - gigaforust.internal + issuerRef: + name: internal-ca + kind: ClusterIssuer diff --git a/vpn/xui/k8s/ingress.yaml b/vpn/xui/k8s/ingress.yaml index f3b916e..6b9aa62 100644 --- a/vpn/xui/k8s/ingress.yaml +++ b/vpn/xui/k8s/ingress.yaml @@ -12,6 +12,9 @@ spec: services: - name: xui-service port: 30379 + tls: + secretName: internal-wildcard-tls + --- # Public panel access (optional). # Realistic, but intentionally disabled: the panel has its own login, @@ -79,3 +82,5 @@ spec: services: - name: xui-service port: 10000 + tls: + secretName: internal-wildcard-tls