apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: headscale-server-prod
  namespace: headscale
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`hs.forust.xyz`)
      kind: Rule
      middlewares:
        - name: crowdsec-crowdsec-bouncer@kubernetescrd
      services:
        - name: headscale-server-external
          port: 8080
  tls:
    certResolver: letsencrypt
---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: headscale-server-local
  namespace: headscale
spec:
  entryPoints:
    - websecure
  routes:
    - match: HostRegexp(`^hs\.(workstation|gigaforust)\.internal$`)
      kind: Rule
      services:
        - name: headscale-server-external
          port: 8080

---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: headscale-ui-prod
  namespace: headscale
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`hs.forust.xyz`) && PathPrefix(`/admin`)
      kind: Rule
      middlewares:
        - name: crowdsec-crowdsec-bouncer@kubernetescrd
        - name: security-chain@file
      services:
        - name: headscale-ui-external
          port: 80
  tls:
    certResolver: letsencrypt
---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: headscale-ui-local
  namespace: headscale
spec:
  entryPoints:
    - websecure
  routes:
    - match: HostRegexp(`^hs\.(workstation|gigaforust)\.internal$`) && PathPrefix(`/admin`)
      kind: Rule
      services:
        - name: headscale-ui-external
          port: 80

---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: headscale-metrics-prod
  namespace: headscale
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`hs.forust.xyz`) && PathPrefix(`/metrics`)
      kind: Rule
      middlewares:
        - name: crowdsec-crowdsec-bouncer@kubernetescrd
      services:
        - name: headscale-server-external
          port: 9090
  tls:
    certResolver: letsencrypt
    domains:
      - main: hs.forust.xyz
---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: headscale-metrics-local
  namespace: headscale
spec:
  entryPoints:
    - websecure
  routes:
    - match: HostRegexp(`^hs\.(workstation|gigaforust)\.internal$`) && PathPrefix(`/metrics`)
      kind: Rule
      services:
        - name: headscale-server-external
          port: 9090