From df98aebc2bc80ef74f0810d33b6d01f648af5317 Mon Sep 17 00:00:00 2001
From: mr-forust <vzlomdsisma@gmail.com>
Date: Fri, 19 Jun 2026 23:00:11 +0200
Subject: [PATCH] chore(k8s): rewritten ingressroute to include headplane AND
 headscale-admin ui new routes groupping style

---
 headscale/k8s/ingress.yaml | 123 +++++++++++++++++++------------------
 1 file changed, 64 insertions(+), 59 deletions(-)

diff --git a/headscale/k8s/ingress.yaml b/headscale/k8s/ingress.yaml
index 2f4247a..4f4e877 100644
--- a/headscale/k8s/ingress.yaml
+++ b/headscale/k8s/ingress.yaml
@@ -1,7 +1,16 @@
 apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: headplane-prefix
+  namespace: headscale
+spec:
+  addPrefix:
+    prefix: "/admin"
+---
+apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
-  name: headscale-server-prod
+  name: headscale-prod
   namespace: headscale
 spec:
   entryPoints:
@@ -14,13 +23,52 @@ spec:
       services:
         - name: headscale-server-external
           port: 8080
+    - match: Host(`hs.forust.xyz`) && PathPrefix(`/admin`)
+      kind: Rule
+      middlewares:
+        - name: crowdsec-crowdsec-bouncer@kubernetescrd
+      services:
+        - name: headscale-ui-external
+          port: 80
+    - match: Host(`hs.forust.xyz`) && PathPrefix(`/metrics`)
+      kind: Rule
+      middlewares:
+        - name: crowdsec-crowdsec-bouncer@kubernetescrd
+      services:
+        - name: headscale-server-external
+          port: 9090
   tls:
     certResolver: letsencrypt
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
-  name: headscale-server-local
+  name: headplane-prod
+  namespace: headscale
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`hp.forust.xyz`)
+      kind: Rule
+      middlewares:
+        - name: headplane-prefix
+        - name: crowdsec-crowdsec-bouncer@kubernetescrd
+      services:
+        - name: headplane-external
+          port: 3000
+    - match: Host(`hp.forust.xyz`) && PathPrefix(`/admin`)
+      kind: Rule
+      services:
+        - name: headplane-external
+          port: 3000
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: headscale-local
   namespace: headscale
 spec:
   entryPoints:
@@ -31,76 +79,33 @@ spec:
       services:
         - name: headscale-server-external
           port: 8080
-
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: headscale-ui-prod
-  namespace: headscale
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`hs.forust.xyz`) && PathPrefix(`/admin`)
-      kind: Rule
-      middlewares:
-        - name: crowdsec-crowdsec-bouncer@kubernetescrd
-        - name: security-chain@file
-      services:
-        - name: headscale-ui-external
-          port: 80
-  tls:
-    certResolver: letsencrypt
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: headscale-ui-local
-  namespace: headscale
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: HostRegexp(`^hs\.(workstation|gigaforust)\.internal$`) && PathPrefix(`/admin`)
+    - match: (Host(`hs.workstation.internal`) || Host(`hs.gigaforust.internal`)) && PathPrefix(`/admin`)
       kind: Rule
       services:
         - name: headscale-ui-external
           port: 80
-
+    - match: (Host(`hs.workstation.internal`) || Host(`hs.gigaforust.internal`)) && PathPrefix(`/metrics`)
+      kind: Rule
+      services:
+        - name: headscale-server-external
+          port: 9090
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
-  name: headscale-metrics-prod
+  name: headplane-local
   namespace: headscale
 spec:
-  entryPoints:
-    - websecure
   routes:
-    - match: Host(`hs.forust.xyz`) && PathPrefix(`/metrics`)
+    - match: Host(`hp.workstation.internal`) || Host(`hp.gigaforust.internal`)
       kind: Rule
       middlewares:
-        - name: crowdsec-crowdsec-bouncer@kubernetescrd
+        - name: headplane-prefix
       services:
-        - name: headscale-server-external
-          port: 9090
-  tls:
-    certResolver: letsencrypt
-    domains:
-      - main: hs.forust.xyz
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: headscale-metrics-local
-  namespace: headscale
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: HostRegexp(`^hs\.(workstation|gigaforust)\.internal$`) && PathPrefix(`/metrics`)
+        - name: headplane-external
+          port: 3000
+    - match: (Host(`hp.workstation.internal`) || Host(`hp.gigaforust.internal`)) && PathPrefix(`/admin`)
       kind: Rule
       services:
-        - name: headscale-server-external
-          port: 9090
+        - name: headplane-external
+          port: 3000