From e19660fdf4536e4622fe0ee8fc4e56be705aaf74 Mon Sep 17 00:00:00 2001 From: mr-forust Date: Mon, 8 Jun 2026 12:27:55 +0200 Subject: [PATCH] =?UTF-8?q?feat(k8s):=20standardize=20IngressRoutes=20?= =?UTF-8?q?=E2=80=94=20LE=20prod=20certs,=20prod=E2=86=92local=E2=86=92dev?= =?UTF-8?q?=20order,=20Traefik=20values=20fix?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .gitignore | 10 ++-- adguardhome/k8s/ingress.yaml | 51 +++++++++--------- adguardhome/k8s/secrets.yaml.example | 2 +- checkmk/k8s/checkmk.yaml | 7 +-- checkmk/k8s/config.yaml | 8 +++ checkmk/k8s/ingress.yaml | 2 +- dockmon/k8s/ingress.yaml | 2 +- downtify/k8s/ingress.yaml | 2 +- gitea/k8s/ingressroute.yaml | 14 ++--- headscale/k8s/ingress.yaml | 6 +-- homepages/k8s/ingress.yaml | 4 +- kener/k8s/ingress.yaml | 2 +- metube/k8s/ingress.yaml | 2 +- netronome/k8s/ingress.yaml | 2 +- nextcloud/k8s/ingress.yaml | 24 ++++----- portainer/k8s/ingress.yaml | 2 +- traefik/k8s/ingress.yaml | 79 ++++++++++++++-------------- traefik/k8s/local-tls.yaml | 9 ---- traefik/k8s/local-tls.yaml.example | 8 +++ traefik/k8s/traefik-values.yaml | 18 +++++++ uptime-kuma/k8s/ingress.yaml | 12 ++--- 21 files changed, 145 insertions(+), 121 deletions(-) create mode 100644 checkmk/k8s/config.yaml delete mode 100644 traefik/k8s/local-tls.yaml create mode 100644 traefik/k8s/local-tls.yaml.example diff --git a/.gitignore b/.gitignore index ea35378..3771d07 100644 --- a/.gitignore +++ b/.gitignore @@ -47,6 +47,7 @@ traefik/logs/* # SSL Certificates adguardhome/certs/* traefik/certs/* +certs/ # Monitoring monitoring/prometheus.yml @@ -94,11 +95,12 @@ temp/* # Environment .env - -# kubernetes -*/k8s/*secret* -!*/k8s/*secret*.example .env.anna .env.forust .env.* !*example + +# kubernetes +*/k8s/*secret* +!*/k8s/*secret*.example +traefik/k8s/local-tls.yaml diff --git a/adguardhome/k8s/ingress.yaml b/adguardhome/k8s/ingress.yaml index 6a84859..4a58389 100644 --- a/adguardhome/k8s/ingress.yaml +++ b/adguardhome/k8s/ingress.yaml @@ -1,19 +1,19 @@ apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: - name: adguard-dev + name: adguard-prod namespace: adguard spec: entryPoints: - websecure routes: - - match: Host(`adguard.gigaforust.internal`) || Host(`dns.gigaforust.internal`) - kind: Rule - services: - - name: adguard-service - port: 3000 + - match: Host(`adguard.forust.xyz`) || Host(`dns.forust.xyz`) + kind: Rule + services: + - name: adguard-service + port: 3000 tls: - secretName: local-tls + certResolver: letsencrypt --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute @@ -24,30 +24,30 @@ spec: entryPoints: - websecure routes: - - match: Host(`adguard.workstation.internal`) || Host(`dns.workstation.internal`) - kind: Rule - services: - - name: adguard-service - port: 3000 + - match: Host(`adguard.workstation.internal`) || Host(`dns.workstation.internal`) + kind: Rule + services: + - name: adguard-service + port: 3000 tls: secretName: local-tls --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: - name: adguard-prod + name: adguard-dev namespace: adguard spec: entryPoints: - websecure routes: - - match: Host(`adguard.forust.xyz`) || Host(`dns.forust.xyz`) - kind: Rule - services: - - name: adguard-service - port: 3000 + - match: Host(`adguard.gigaforust.internal`) || Host(`dns.gigaforust.internal`) + kind: Rule + services: + - name: adguard-service + port: 3000 tls: - {} + secretName: local-tls --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute @@ -58,10 +58,9 @@ spec: entryPoints: - websecure routes: - - match: Host(`dns.forust.xyz`) && PathPrefix(`/dns-query`) - kind: Rule - services: - - name: adguard-service - port: 3000 - tls: - {} + - match: Host(`dns.forust.xyz`) && PathPrefix(`/dns-query`) + kind: Rule + services: + - name: adguard-service + port: 3000 + tls: {} diff --git a/adguardhome/k8s/secrets.yaml.example b/adguardhome/k8s/secrets.yaml.example index af5cfad..fb2b3ef 100644 --- a/adguardhome/k8s/secrets.yaml.example +++ b/adguardhome/k8s/secrets.yaml.example @@ -1,7 +1,7 @@ kubectl apply -f k8s/namespace.yaml && \ kubectl create secret tls adguard-certs -n adguard \ --cert=certs/fullchain.pem \ - --key=certs/privkey.pem --dry-run=client -o json > \ + --key=certs/privkey.pem --dry-run=client -o yaml > \ k8s/secrets.yaml # OR WITH NO FILE CREATION: diff --git a/checkmk/k8s/checkmk.yaml b/checkmk/k8s/checkmk.yaml index 056f2db..26c1830 100644 --- a/checkmk/k8s/checkmk.yaml +++ b/checkmk/k8s/checkmk.yaml @@ -31,11 +31,8 @@ spec: envFrom: - secretRef: name: checkmk-secrets - env: - - name: CMK_SITE_ID - value: "cmk" - - name: TZ - value: "Etc/UTC" + - configMapRef: + name: checkmk-config ports: - containerPort: 5000 volumeMounts: diff --git a/checkmk/k8s/config.yaml b/checkmk/k8s/config.yaml new file mode 100644 index 0000000..5f6a21c --- /dev/null +++ b/checkmk/k8s/config.yaml @@ -0,0 +1,8 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: checkmk-config + namespace: checkmk +data: + TZ: Europe/Bratislava + CMK_SITE_ID: cmk \ No newline at end of file diff --git a/checkmk/k8s/ingress.yaml b/checkmk/k8s/ingress.yaml index 50a5852..d8f0766 100644 --- a/checkmk/k8s/ingress.yaml +++ b/checkmk/k8s/ingress.yaml @@ -13,7 +13,7 @@ spec: - name: checkmk-service port: 5000 tls: - {} + certResolver: letsencrypt --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute diff --git a/dockmon/k8s/ingress.yaml b/dockmon/k8s/ingress.yaml index 412b3af..4cca96d 100644 --- a/dockmon/k8s/ingress.yaml +++ b/dockmon/k8s/ingress.yaml @@ -24,7 +24,7 @@ spec: port: 443 serversTransport: dockmon-transport tls: - {} + certResolver: letsencrypt --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute diff --git a/downtify/k8s/ingress.yaml b/downtify/k8s/ingress.yaml index d57b50c..3ae7115 100644 --- a/downtify/k8s/ingress.yaml +++ b/downtify/k8s/ingress.yaml @@ -15,7 +15,7 @@ spec: - name: downtify-service port: 8000 tls: - {} + certResolver: letsencrypt --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute diff --git a/gitea/k8s/ingressroute.yaml b/gitea/k8s/ingressroute.yaml index cedc053..6393769 100644 --- a/gitea/k8s/ingressroute.yaml +++ b/gitea/k8s/ingressroute.yaml @@ -1,19 +1,19 @@ apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: - name: gitea-dev + name: gitea-prod namespace: gitea spec: entryPoints: - websecure routes: - - match: Host(`gitea.gigaforust.internal`) + - match: Host(`gitea.forust.xyz`) kind: Rule services: - name: gitea-service port: 3000 tls: - secretName: local-tls + certResolver: letsencrypt --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute @@ -35,19 +35,19 @@ spec: apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: - name: gitea-prod + name: gitea-dev namespace: gitea spec: entryPoints: - websecure routes: - - match: Host(`gitea.forust.xyz`) + - match: Host(`gitea.gigaforust.internal`) kind: Rule services: - name: gitea-service port: 3000 tls: - {} + secretName: local-tls --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute @@ -64,7 +64,7 @@ spec: - name: gitea-service port: 3000 tls: - {} + certResolver: letsencrypt --- apiVersion: traefik.io/v1alpha1 kind: IngressRouteTCP diff --git a/headscale/k8s/ingress.yaml b/headscale/k8s/ingress.yaml index b55f33e..8784869 100644 --- a/headscale/k8s/ingress.yaml +++ b/headscale/k8s/ingress.yaml @@ -14,7 +14,7 @@ spec: - name: headscale-service port: 8080 tls: - {} + certResolver: letsencrypt --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute @@ -66,7 +66,7 @@ spec: - name: headscale-service port: 9090 tls: - {} + certResolver: letsencrypt --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute @@ -120,7 +120,7 @@ spec: - name: headscale-admin-service port: 80 tls: - {} + certResolver: letsencrypt --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute diff --git a/homepages/k8s/ingress.yaml b/homepages/k8s/ingress.yaml index 92b143a..68713e3 100644 --- a/homepages/k8s/ingress.yaml +++ b/homepages/k8s/ingress.yaml @@ -13,7 +13,7 @@ spec: - name: forust-homepage-service port: 80 tls: - {} + certResolver: letsencrypt --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute @@ -64,7 +64,7 @@ spec: - name: xdfnx-homepage-service port: 80 tls: - {} + certResolver: letsencrypt --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute diff --git a/kener/k8s/ingress.yaml b/kener/k8s/ingress.yaml index 9971110..0b14318 100644 --- a/kener/k8s/ingress.yaml +++ b/kener/k8s/ingress.yaml @@ -13,7 +13,7 @@ spec: - name: kener-service port: 3000 tls: - {} + certResolver: letsencrypt --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute diff --git a/metube/k8s/ingress.yaml b/metube/k8s/ingress.yaml index b28a2dc..67aa12a 100644 --- a/metube/k8s/ingress.yaml +++ b/metube/k8s/ingress.yaml @@ -15,7 +15,7 @@ spec: - name: metube-service port: 8081 tls: - {} + certResolver: letsencrypt --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute diff --git a/netronome/k8s/ingress.yaml b/netronome/k8s/ingress.yaml index 070a19b..3294bae 100644 --- a/netronome/k8s/ingress.yaml +++ b/netronome/k8s/ingress.yaml @@ -13,7 +13,7 @@ spec: - name: netronome-service port: 7575 tls: - {} + certResolver: letsencrypt --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute diff --git a/nextcloud/k8s/ingress.yaml b/nextcloud/k8s/ingress.yaml index e350c55..3ab8f20 100644 --- a/nextcloud/k8s/ingress.yaml +++ b/nextcloud/k8s/ingress.yaml @@ -2,13 +2,13 @@ apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: - name: nextcloud-dev + name: nextcloud-prod namespace: nextcloud spec: entryPoints: - websecure routes: - - match: Host(`nextcloud.gigaforust.internal`) + - match: Host(`nextcloud.forust.xyz`) kind: Rule middlewares: - name: nextcloud-chain@file @@ -16,7 +16,7 @@ spec: - name: nextcloud-apache port: 11000 tls: - secretName: local-tls + certResolver: letsencrypt --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute @@ -40,13 +40,13 @@ spec: apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: - name: nextcloud-prod + name: nextcloud-dev namespace: nextcloud spec: entryPoints: - websecure routes: - - match: Host(`nextcloud.forust.xyz`) + - match: Host(`nextcloud.gigaforust.internal`) kind: Rule middlewares: - name: nextcloud-chain@file @@ -54,19 +54,19 @@ spec: - name: nextcloud-apache port: 11000 tls: - {} + secretName: local-tls --- # Nextcloud AIO apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: - name: naio-dev + name: naio-prod namespace: nextcloud spec: entryPoints: - websecure routes: - - match: Host(`naio.gigaforust.internal`) + - match: Host(`naio.forust.xyz`) kind: Rule services: - name: nextcloud-aio @@ -74,7 +74,7 @@ spec: scheme: https serversTransport: insecureTransport@file tls: - secretName: local-tls + certResolver: letsencrypt --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute @@ -98,13 +98,13 @@ spec: apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: - name: naio-prod + name: naio-dev namespace: nextcloud spec: entryPoints: - websecure routes: - - match: Host(`naio.forust.xyz`) + - match: Host(`naio.gigaforust.internal`) kind: Rule services: - name: nextcloud-aio @@ -112,4 +112,4 @@ spec: scheme: https serversTransport: insecureTransport@file tls: - {} + secretName: local-tls diff --git a/portainer/k8s/ingress.yaml b/portainer/k8s/ingress.yaml index a556192..23aa46a 100644 --- a/portainer/k8s/ingress.yaml +++ b/portainer/k8s/ingress.yaml @@ -13,7 +13,7 @@ spec: - name: portainer-service port: 9000 tls: - {} + certResolver: letsencrypt --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute diff --git a/traefik/k8s/ingress.yaml b/traefik/k8s/ingress.yaml index bd5f16c..ade4f4d 100644 --- a/traefik/k8s/ingress.yaml +++ b/traefik/k8s/ingress.yaml @@ -1,36 +1,3 @@ -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: dashboard-dev - namespace: traefik -spec: - entryPoints: - - websecure - routes: - - match: Host(`traefik.gigaforust.internal`) - kind: Rule - services: - - name: api@internal - kind: TraefikService - tls: - secretName: local-tls ---- -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: dashboard-local - namespace: traefik -spec: - entryPoints: - - websecure - routes: - - match: Host(`traefik.workstation.internal`) - kind: Rule - services: - - name: api@internal - kind: TraefikService - tls: - secretName: local-tls --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute @@ -41,10 +8,44 @@ spec: entryPoints: - websecure routes: - - match: Host(`traefik.forust.xyz`) - kind: Rule - services: - - name: api@internal - kind: TraefikService + - match: Host(`traefik.forust.xyz`) + kind: Rule + services: + - name: api@internal + kind: TraefikService tls: - {} + certResolver: letsencrypt +--- +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: dashboard-local + namespace: traefik +spec: + entryPoints: + - websecure + routes: + - match: Host(`traefik.workstation.internal`) + kind: Rule + services: + - name: api@internal + kind: TraefikService + tls: + secretName: local-tls +--- +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: dashboard-dev + namespace: traefik +spec: + entryPoints: + - websecure + routes: + - match: Host(`traefik.gigaforust.internal`) + kind: Rule + services: + - name: api@internal + kind: TraefikService + tls: + secretName: local-tls diff --git a/traefik/k8s/local-tls.yaml b/traefik/k8s/local-tls.yaml deleted file mode 100644 index 6464646..0000000 --- a/traefik/k8s/local-tls.yaml +++ /dev/null @@ -1,9 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - name: local-tls - namespace: traefik -type: kubernetes.io/tls -data: - tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURXVENDQWtHZ0F3SUJBZ0lVR0FpNCtsWDlCOUFteVdmcVpUSWl3UTlYYkcwd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0Z6RVZNQk1HQTFVRUF3d01LaTVtYjNKMWMzUXVlSGw2TUI0WERUSTJNRFl3T0RBMk1qazFObG9YRFRNMgpNRFl3TlRBMk1qazFObG93RnpFVk1CTUdBMVVFQXd3TUtpNW1iM0oxYzNRdWVIbDZNSUlCSWpBTkJna3Foa2lHCjl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUF5c2VLRnBmaDRJVGR0NGdHR2JNV01pQ1F2bTc5UkZ4UDgwa3QKNDVWOTF5VkVRWUZaMmptRjFpOS9JRTNiKzhacXR6cXQ2bWU5aHN4L21LTXE5Z05tQ1M1NWUxc0NMNkttRCs3bgpSOXJtM2h2TEJWRUpselIwZW9FOXhWS091dzJYNkNvcEZRelVQU1ZzUFRSajExQlUyVDVqekVUc00xTG5LVFhHCnlzMHpCcjByZHMvRlM2cUV2alY4TkREdUVZWVNCaU1hMUdpclpPSndvd2NiZ0pBVWRiRnUyMHRGRmZMb3B2R0wKSEFQcnA3TXpYWTdVQ3RRYW9xY0xMeTN1NEdKN3dyNUcyRURvVUhmdXlJaFBtTStibENZbWkzY2NlZ0tBQ2hKcApZQTQyMGRXVkRBYWpmT1hFc2c1VTFFT3JLK2hQaTluRVc3MUlYYnNYdWp3ZG9zbEgvd0lEQVFBQm80R2NNSUdaCk1CMEdBMVVkRGdRV0JCVHkxdFlLWElYUXJSdlFGL0g4RkFmanp5Z2ZyekFmQmdOVkhTTUVHREFXZ0JUeTF0WUsKWElYUXJSdlFGL0g4RkFmanp5Z2ZyekFQQmdOVkhSTUJBZjhFQlRBREFRSC9NRVlHQTFVZEVRUS9NRDJDRENvdQpabTl5ZFhOMExuaDVlb0lXS2k1M2IzSnJjM1JoZEdsdmJpNXBiblJsY201aGJJSVZLaTVuYVdkaFptOXlkWE4wCkxtbHVkR1Z5Ym1Gc01BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQ1ZTQ21Sekl2RjhhdXRWVkxZRXpuVHN6OHUKWlNWOGJSYkxYalpDVWVSZUJidW1OR2JQS1c5dExLS2JBWmJqUit1dWZIbGxMMGk1TjdrdFRvNm5NU05vS3NjaApOSjdrRkJoVHRwcmRZUjhMNFpnUkh1VFZGTmViR0pBL1RPRFpUSjhUNTNXaVdoa2tUWnRWOEViQ2hwZ3Zqb2tuCkJCSEpBbEo2dkZFczBzSE9pMVp4Yk5VU2ZLQWdiMlJiSXpJRlhPZkllR095ZjZCL3hFcGtndVNzN3drMGJrK3QKV2YyNVJ5WnZiYmg0amc4WDVOVGQwS2dwdU5NZU96aERlUHNKNlM0b3o5STA0UlEvdENRdWErdlRYNEM3NkFrWgpjcnYxYlR4Wm5pNjBzYVZKeC8wVDI0LzBPN2dGbXFkelcvL1U0QS82eUx3RzlRMG9jZ1JYcGFlVmFLeUkKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= - tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRREt4NG9XbCtIZ2hOMjMKaUFZWnN4WXlJSkMrYnYxRVhFL3pTUzNqbFgzWEpVUkJnVm5hT1lYV0wzOGdUZHY3eG1xM09xM3FaNzJHekgrWQpveXIyQTJZSkxubDdXd0l2b3FZUDd1ZEgydWJlRzhzRlVRbVhOSFI2Z1QzRlVvNjdEWmZvS2lrVkROUTlKV3c5Ck5HUFhVRlRaUG1QTVJPd3pVdWNwTmNiS3pUTUd2U3QyejhWTHFvUytOWHcwTU80UmhoSUdJeHJVYUt0azRuQ2oKQnh1QWtCUjFzVzdiUzBVVjh1aW04WXNjQSt1bnN6TmRqdFFLMUJxaXB3c3ZMZTdnWW52Q3ZrYllRT2hRZCs3SQppRStZejV1VUppYUxkeHg2QW9BS0VtbGdEamJSMVpVTUJxTjg1Y1N5RGxUVVE2c3I2RStMMmNSYnZVaGR1eGU2ClBCMml5VWYvQWdNQkFBRUNnZ0VBRWdrZlloVU9OUTc4UFdldXl6aGZnQVBmZStDWlRDdzl2RERGRVJucHdHb0QKSVNSbEhvREJRNlNqMVBhMzJ6UHhwK3hqTFpjZWgwL0hCWWQxdWIzaHBHMXF4cXI0amM0VW9SUXBvLzEzVFVnQgpqYTZBZ045Y2dNemY5cDM2TGU3dWxPcXpEcmsrWTFYaHc2dldPWDllbkpmcy9tMGU2UTIxbTdlNXY2M3luT1dyCjN0cFhWcXNPNVhrVWwyb2lCQWNHNG1STnhOSzVkdTZjamJMSTlIenBZSEQrYVpNNVBnTDdUUDltQ3djN1M2dnEKWks4M1h2UC9DL0U2alJzMmwyTWJLRzFkSzllOVl3cnVaNmpCbTRVVVRtR0xOVU1JamVnZ09XTWNnaDVhVHRBRAo5N2JTUFovWHYxeWgwZzUyMkhNbUFHYW52WlZRNWs3VkIyY3dCc2FabVFLQmdRRG8zTm5EWGhsM1l2ajRFQUtDCk1TK2ZkVEp2NFYzem9oWnlLZlYxN053U2dpQ2ZQaldKbDduRGluSVdhR2p1QzY2OENPM0dURys5Q25IY2dLS2UKcnp5QWhaUGpzc2EvQVZuSGE0MDBTYm9Cb3RacUVQdnA5eTVQTzVnNGkyT1k3ZUFjTDZZakJsUmVmOUsyNUNkbQpIR1d3MjNnRG5UeDRXMDFncjY4Uk5GOVZEUUtCZ1FEZTdYditkVUhCT1BzcHNSVmVlV1FuWjB3WlJFVGxvSE1KCnZ3OVZsdlYrN1hIYTRDb0gyMUg5TU1IbkM5TkhuYmlTaUpvR09lc1FLMUowUnhVNjZMMkZDQUJnQk9USTlqYU4KZmNmaTNKcGZ4a2N3c2VWRXB1WmQrZHFZbVlPNjlRZG1nODJOa3o0emwrTWREU0RBOVQ5Uk1XS1V4WHZVSEVPcgpuTE9pU0VQbU93S0JnQ3V1c2xNSjVmRVZhZXJ1NWVtU1hJS25NNHoxVS9DT0tYUEZGenpGOEFxd3lublU2Nm9pCkFrRUNTYUNXZVlpZVBHc2RxYTBYVGFiQ3ZOVkdkRHNjV0ZjcnQ3QnhLd05OdDQvSFJ6ZlYxTVRWelM4Y2ZJVkoKVHpDaDEwNVVKNXpha3IzMjJrMmJ0RnY5MG9Ob2pWT0VaRGNuRkg1cEVwenBVN3lkZUZQYjVUNUpBb0dCQUlVNAp6Um5TL3htMnNMcElubW1ZQjlkWWJ1ekdsSm5abWdYZ0RRenNLd2ZRWkhNVjlXZytsQy9IL0lqVDAwNkFIZlpMCjlpZjBZdHFGMlQrdDN5MFdPM1FOeFJPY3VSQ3p1d1F4Zjh1K1krOEtjaTdTa1IzRzAvS2pSeFJjNFpGUHJ6MS8KVk03ZmlKT1NtR0liSDFEUS95YkphWTFZdTFpV0Q0YTJIYy9FZWZkVEFvR0FQRmcxZW14U1BoYUdCN3RKVkVFaQptNzhCUEhpZ01OTXd6VDFWRVcrV1BXeks4a3lvak1XU1puRkIyamEwZ25VL0dOSjkzY3F3T0xGck1aOCtSL1JyClRnRnVJZ0JENGRENUJ0MGd4WlQ1SC9QU0dUOGszUU0vYloxamZaTXk0WG1vTlFONytaVXIrS2EycWNaSjhMZHYKbmlvdGhGTGg3VmI4d0grTGhvNnVzaFE9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K diff --git a/traefik/k8s/local-tls.yaml.example b/traefik/k8s/local-tls.yaml.example new file mode 100644 index 0000000..f1b86c1 --- /dev/null +++ b/traefik/k8s/local-tls.yaml.example @@ -0,0 +1,8 @@ +apiVersion: v1 +data: + tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVWRENDQXJ5Z0F3SUJBZ0lSQUpkbVJpaHoxNWNpeXczUU5wTVgxVGd3RFFZSktvWklodmNOQVFFTEJRQXcKZFRFZU1Cd0dBMVVFQ2hNVmJXdGpaWEowSUdSbGRtVnNiM0J0Wlc1MElFTkJNU1V3SXdZRFZRUUxEQnhtYjNKMQpjM1JBWjJsbllXWnZjblZ6ZENBb1RYSkdiM0oxYzNRcE1Td3dLZ1lEVlFRRERDTnRhMk5sY25RZ1ptOXlkWE4wClFHZHBaMkZtYjNKMWMzUWdLRTF5Um05eWRYTjBLVEFlRncweU5URXlNRFV4TWpVME16UmFGdzB5T0RBek1EVXgKTWpVME16UmFNRkF4SnpBbEJnTlZCQW9USG0xclkyVnlkQ0JrWlhabGJHOXdiV1Z1ZENCalpYSjBhV1pwWTJGMApaVEVsTUNNR0ExVUVDd3djWm05eWRYTjBRR2RwWjJGbWIzSjFjM1FnS0UxeVJtOXlkWE4wS1RDQ0FTSXdEUVlKCktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQUx1c2dJNUJuQVJnZzVTS1hpR29PT3dXSkFocXBXSUQKOWg4cGtUMjFTZzhxM3haeU80anZjUEVWbmpOVzRnRFQ0WUhFdjNIZDdZY25IRFdOWG5qSW9LdUd2N2lMOUQyagpLMllNUGtXOGM4RmhJRzFycTJmNTR5YXYxbm1QVmtoYVk2WkJRdzRVT0ZCKzRYRHprbDJTZXcxQnBCV3JIQmZmCitYT2gzUUllcFRiZGdGalhsS0VQdEZuR0YrZFhyZmZmZm5Ucm80ejJ4QVpYeUdSb2pqZTZSbi9tMjJYeHZVRXYKcnhnUE5sM2Y4N0grZXpmZXgrQndMZWNSbVVhQkU0MEFmOHpobSs3T0JvZ1psQU4vZGU2TnZrT1JWdjRydGdIWgpaczFacGYzYmxqTGpwUmh2NGNwYVhPam44bW9UaEEzNUsrRVVUY3hBaUVZSE5pVHZFY2tMZXFjQ0F3RUFBYU9CCmd6Q0JnREFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0V3SHdZRFZSMGoKQkJnd0ZvQVVYU25JWGM5cU55TktibDhEZjZ4T3V3UHZFQW93T0FZRFZSMFJCREV3TDRJVktpNW5hV2RoWm05eQpkWE4wTG1sdWRHVnlibUZzZ2hZcUxuZHZjbXR6ZEdGMGFXOXVMbWx1ZEdWeWJtRnNNQTBHQ1NxR1NJYjNEUUVCCkN3VUFBNElCZ1FETVdmMXUzQm5IRnV4TlpRN29CYnZBQk5Xb0xlOTlSb2N6TFk2c2dzZkdCZFFIWXdvUzMxT2EKZXgwT0ZYVXZQb2N2NWRIdWdtSlpvUlN0NDU1QndZRzVuTUM0VTJhY0NzNm53TjJGK2paa3BNL2xCUEdtek1WWgpvM0lNc1M0VU5IYzZXRGllRWp3Y1J1Q005bldWQnRrTmE4RTdsdWJxZk5SclhZTjB4L0YzWGpud2RWUS8wT0l0CnZvc2ZyRTRzMVJUdEhmY3VQWnhBZW9NSVdFN0pSQjRMOHhabHU5T0RZeituRGwva3BOTDkwVThHdXQwWFFucHgKY1RScVhnNC9nT1RKOUFlUnMwMHIrQU9wV1V3ZExFTmZnQVZ4Z0MrZ3FWVmFMV0NlVkFTWi9UNFJNWmt6K0YxeQpZRU5PR2o2L09hdm5wd25Wd21GcVRya1lHWURqU3RNWW9GZHBrWHB1VjY1dkg3Qnk4cHkyNmpMWFZ3VUpsUjQyClFUMGZnV0RDVFcxZTEwQ0o4N2NZMVNFQ3N2T2kwWVM0ZmtUTHJCM0FsMEhoQVZiWkFicmRSSHErMWQySzhtSTIKcUVpOXVPVnZZckZneHFtcWxIRUR1cFJMM095bWJ6bnRQeFZabXpzMmRiRXNVd0lxUXo0VFRiTzU4ZWs0eVI2dApQdG5hNyttNzJIMD0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= + tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2QUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktZd2dnU2lBZ0VBQW9JQkFRQzdySUNPUVp3RVlJT1UKaWw0aHFEanNGaVFJYXFWaUEvWWZLWkU5dFVvUEt0OFdjanVJNzNEeEZaNHpWdUlBMCtHQnhMOXgzZTJISnh3MQpqVjU0eUtDcmhyKzRpL1E5b3l0bURENUZ2SFBCWVNCdGE2dG4rZU1tcjlaNWoxWklXbU9tUVVNT0ZEaFFmdUZ3Cjg1SmRrbnNOUWFRVnF4d1gzL2x6b2QwQ0hxVTIzWUJZMTVTaEQ3Ulp4aGZuVjYzMzMzNTA2Nk9NOXNRR1Y4aGsKYUk0M3VrWi81dHRsOGIxQkw2OFlEelpkMy9PeC9uczMzc2ZnY0MzbkVabEdnUk9OQUgvTTRadnV6Z2FJR1pRRApmM1h1amI1RGtWYitLN1lCMldiTldhWDkyNVl5NDZVWWIrSEtXbHpvNS9KcUU0UU4rU3ZoRkUzTVFJaEdCellrCjd4SEpDM3FuQWdNQkFBRUNnZ0VBR1dmNDMwa3lmY1V6Q3VEUWJXNEFoclZZbTJzVWlIaFEwVmNuT2x0WWMwVXkKZmk5b3I5ajZTU2pNQ2RjeE1UdDl3N3VHenp0ajlHL3UrYkR4b1JoSDUvQ044OFcrZ3JtY0hteDU0YWJwWkx4cApUMmJNQlg5bXFNNFZFcys4dG43R0RyTzNDQ2prbHNFV2M5d0ZiSFZ3QXhObnl5Y20zblNMcUlPNUQ1aG1kVTY3CmlRR1c3bEd3WGJicWlTbUZ1NjIyaERNWWE0Z3RYUnB5cXkrZlpjcGNES29iSXpJRjBCcmhQRDN5RytCellhaFYKVVpIZVBlRm9mTjQvOXI4MTVmOWE3MndPSFBJa0Z6NWdNSlBIREdkUDh1aHdrdzlUOEV2NHAvT0lLZlJTYmc2cgp3VVdlMVowNFUzL0VvenkyczRwYURua1VYVXBoRytINzhnTnVta2VIQVFLQmdRREpOM0VSMURjMHplWEo0Um5oCmI3TldzY1RDV09sS2FkVGN2YlFFY3ViRnVjZzE3Vkc4UzNrVjhSYStmam9zVGNpN0hmR1dZSUc2MS90dXNXYTgKTDVJVUNRNnJlSFhpempLM1BsK0oyOW9TM1RhbjZDdDlxOEtaalYwMXZKTXEzYk1FQVg5VUVwL2JTbHdPUWVqeApOZkZrZ2JFMkRmSEJRVTY3SVlsQ2lVMy9FUUtCZ1FEdXhTWGd3UTRYT1h6T1hrMzlVZE56TVB3S2tDUFhMZkgxCjRGbElTUXZHU05QY1FmK0t0WVVvL1hGNXF2RkkxTUNEa1JBT01FMWZCcFQ4OW9wbEVLUXQ3M3RLc1BoUHhzSHgKem5sL2t0MVRZdUZrcDZtdk9wOHpLdHZqRGVoRGoxUmJZTVN3OFZJNkNlSTRqcDZoSmdZQVhhNURwbFkxM3dFegpHMnhCV1dyT053S0JnRDQ3UEdna056TEluMUlSb1h4OG5IMnFtMHowVEtxc0VwNTJ1VzlLemg3Rzk2bmVEUkpzClVUVzlDNmk4eDJjZVkzK2pvaTA5Q2NKc3ZDR2ZFa1FQZm1GZDc4Q09qLzhtZ0w3MXRueWZsMUdRUXpBbytSSjAKQmNxUjB3c2ttR3VBaDdZc2RHSGZKTHVnd3RuUi9xWmpaWllOR202NlgxUEN6QVBLT25adW1zWFJBb0dBY2pURQphRnVQRk5hL2Rxb3UzWkxzOC9VaktSNUd0bDdZbEFYS1RzUDVxTThlM3dTR2FWOW5vUEtRKzJRall2VzRXM1hnCld4a0plUUZaOUNFc2t5akJqdU0wY3NaeER4OS9sdHh1eXZHQmdhZ1RMU1R4Q2NxZGFVai93ZnZkODZxejY3MCsKZDNBR0o1S2dyUEt5dDF2TGxSTTZEa3VhZ3N2MjgrNFMrckw5WGtNQ2dZQjQ0d0IzdUs4N0lsK3F0dGFNdG5SQwp5NkcwNlBsUkZlbGF6THoxc2F0aC9Gam1JUm5rd2tqcUEzRFRwV04wM1RWRStqdDRQY2h5VkQ2cWw0S3JJQzZMCjdKWDc4Qm1Yc1NGTkxZZ3h4NUNCejJUU0wvODA1amdVRnVmZGg5TjlWZm9YWnJKSldSakpqTTg4UU5xTmxNSWMKbVVobkMzU01kajdkdDVMSU9pNE5NUT09Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K +kind: Secret +metadata: + name: local-tls +type: kubernetes.io/tls diff --git a/traefik/k8s/traefik-values.yaml b/traefik/k8s/traefik-values.yaml index 08351eb..86a17b1 100644 --- a/traefik/k8s/traefik-values.yaml +++ b/traefik/k8s/traefik-values.yaml @@ -2,6 +2,17 @@ hostNetwork: true +securityContext: + capabilities: + add: + - NET_BIND_SERVICE + +podSecurityContext: ~ + +service: + spec: + type: ClusterIP + api: dashboard: true insecure: true @@ -63,6 +74,13 @@ certificatesResolvers: caServer: https://acme-staging-v02.api.letsencrypt.org/directory httpChallenge: entryPoint: web + letsencrypt: + acme: + email: bobrovod@national.shitposting.agency + storage: /data/letsencrypt/acme.json + caServer: https://acme-v02.api.letsencrypt.org/directory + httpChallenge: + entryPoint: web volumes: - name: traefik-dynamic diff --git a/uptime-kuma/k8s/ingress.yaml b/uptime-kuma/k8s/ingress.yaml index dd44f59..64119bf 100644 --- a/uptime-kuma/k8s/ingress.yaml +++ b/uptime-kuma/k8s/ingress.yaml @@ -1,19 +1,19 @@ apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: - name: uptime-kuma-dev + name: uptime-kuma-prod namespace: uptime-kuma spec: entryPoints: - websecure routes: - - match: Host(`uptime.gigaforust.internal`) + - match: Host(`uptime.forust.xyz`) kind: Rule services: - name: uptime-kuma-service port: 3001 tls: - secretName: local-tls + certResolver: letsencrypt --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute @@ -35,16 +35,16 @@ spec: apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: - name: uptime-kuma-prod + name: uptime-kuma-dev namespace: uptime-kuma spec: entryPoints: - websecure routes: - - match: Host(`uptime.forust.xyz`) + - match: Host(`uptime.gigaforust.internal`) kind: Rule services: - name: uptime-kuma-service port: 3001 tls: - {} + secretName: local-tls