From c139d700f11bc303117cc8aba3d7965a4b3549dc Mon Sep 17 00:00:00 2001
From: mr-forust <vzlomdsisma@gmail.com>
Date: Wed, 23 Sep 2026 13:19:26 +0200
Subject: [PATCH] feat(adguard,traefik,cert-manager,reloader): foundation for
 adguard cert sync

- traefik: enable kubernetesIngress provider (needed for cert-manager HTTP-01)
- adguard: add reloader auto annotation for secret-driven restarts
- cert-manager: namespace, helm values (crds), staging+prod ClusterIssuers
- reloader: namespace manifest
---
 adguardhome/k8s/adguard.yaml              |  2 ++
 cert-manager/k8s/cert-manager-values.yaml |  2 ++
 cert-manager/k8s/clusterissuer.yaml       | 29 +++++++++++++++++++++++
 cert-manager/k8s/namespace.yaml           |  4 ++++
 reloader/k8s/namespace.yaml               |  4 ++++
 traefik/k8s/traefik-values.yaml           |  4 ++--
 6 files changed, 43 insertions(+), 2 deletions(-)
 create mode 100644 cert-manager/k8s/cert-manager-values.yaml
 create mode 100644 cert-manager/k8s/clusterissuer.yaml
 create mode 100644 cert-manager/k8s/namespace.yaml
 create mode 100644 reloader/k8s/namespace.yaml

diff --git a/adguardhome/k8s/adguard.yaml b/adguardhome/k8s/adguard.yaml
index 85920f5..6cf2b77 100644
--- a/adguardhome/k8s/adguard.yaml
+++ b/adguardhome/k8s/adguard.yaml
@@ -62,6 +62,8 @@ spec:
     metadata:
       labels:
         app: adguard
+      annotations:
+        reloader.stakater.com/auto: "true"
     spec:
       containers:
         - name: adguard
diff --git a/cert-manager/k8s/cert-manager-values.yaml b/cert-manager/k8s/cert-manager-values.yaml
new file mode 100644
index 0000000..c526c4b
--- /dev/null
+++ b/cert-manager/k8s/cert-manager-values.yaml
@@ -0,0 +1,2 @@
+crds:
+  enabled: true
diff --git a/cert-manager/k8s/clusterissuer.yaml b/cert-manager/k8s/clusterissuer.yaml
new file mode 100644
index 0000000..a1d663c
--- /dev/null
+++ b/cert-manager/k8s/clusterissuer.yaml
@@ -0,0 +1,29 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging
+spec:
+  acme:
+    email: bobrovod@national.shitposting.agency
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: letsencrypt-staging-account-key
+    solvers:
+      - http01:
+          ingress:
+            class: traefik
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    email: bobrovod@national.shitposting.agency
+    server: https://acme-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: letsencrypt-prod-account-key
+    solvers:
+      - http01:
+          ingress:
+            class: traefik
diff --git a/cert-manager/k8s/namespace.yaml b/cert-manager/k8s/namespace.yaml
new file mode 100644
index 0000000..c90416f
--- /dev/null
+++ b/cert-manager/k8s/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cert-manager
diff --git a/reloader/k8s/namespace.yaml b/reloader/k8s/namespace.yaml
new file mode 100644
index 0000000..1729007
--- /dev/null
+++ b/reloader/k8s/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: reloader
diff --git a/traefik/k8s/traefik-values.yaml b/traefik/k8s/traefik-values.yaml
index 2f5168d..477aea0 100644
--- a/traefik/k8s/traefik-values.yaml
+++ b/traefik/k8s/traefik-values.yaml
@@ -31,7 +31,7 @@ deployment:
 
 providers:
   kubernetesIngress:
-    enabled: false
+    enabled: true
   kubernetesCRD:
     enabled: true
   kubernetesGateway:
@@ -125,7 +125,7 @@ certificatesResolvers:
   letsencrypt-staging:
     acme:
       email: bobrovod@national.shitposting.agency
-      storage: /data/letsencrypt/acme.json
+      storage: /data/letsencrypt/acme-staging.json
       caServer: https://acme-staging-v02.api.letsencrypt.org/directory
       httpChallenge:
         entryPoint: web