feat(k8s): add K8s manifests for all homelab services

traefik, gitea, adguard, nextcloud, errorpages, homepages, uptime-kuma, kener, checkmk, headscale, dockmon, metube, downtify, portainer, netronome, userbot Includes Helm values, deployments, services, ingress routes, configmaps, secrets (placeholders), postgres statefulsets, kustomize overlays, and Traefik dynamic configuration.
2026-06-08 10:51:04 +02:00
parent f3d04e935c
commit 36922a177c
60 changed files with 2596 additions and 5 deletions
@@ -0,0 +1,124 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: traefik
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: traefik-dynamic
+  namespace: traefik
+data:
+  dynamic.yml: |
+    http:
+      serversTransports:
+        insecureTransport:
+          insecureSkipVerify: true
+  middlewares.yml: |
+    http:
+      middlewares:
+        # HTTPS Redirect
+        redirect-https:
+          redirectScheme:
+            scheme: https
+            permanent: true
+        # Cloudflare IP Whitelist
+        cloudflare-ipwhitelist:
+          ipWhiteList:
+            sourceRange:
+              - "173.245.48.0/20"
+              - "103.21.244.0/22"
+              - "103.22.200.0/22"
+              - "103.31.4.0/22"
+              - "141.101.64.0/18"
+              - "108.162.192.0/18"
+              - "190.93.240.0/20"
+              - "188.114.96.0/20"
+              - "197.234.240.0/22"
+              - "198.41.128.0/17"
+              - "162.158.0.0/15"
+              - "104.16.0.0/13"
+              - "104.24.0.0/14"
+              - "172.64.0.0/13"
+              - "131.0.72.0/22"
+
+        # Authentik + secure headers
+        security-chain:
+          chain:
+            middlewares:
+              - authentik@file
+              - security-headers@file
+        authentik:
+          forwardAuth:
+            address: "http://authentik-server:9000/outpost.goauthentik.io/auth/traefik"
+            trustForwardHeader: true
+            maxResponseBodySize: 1048576
+            authResponseHeaders:
+              - X-authentik-username
+              - X-authentik-groups
+              - X-authentik-email
+              - X-authentik-name
+              - X-authentik-uid
+              - X-authentik-jwt
+              - X-authentik-meta-jwks
+              - X-authentik-meta-outpost
+              - X-authentik-meta-provider
+              - X-authentik-meta-app
+              - X-authentik-meta-version
+
+        # Security Headers
+        security-headers:
+          headers:
+            browserXssFilter: true
+            contentTypeNosniff: true
+            forceSTSHeader: true
+            stsIncludeSubdomains: true
+            stsPreload: true
+            stsSeconds: 31536000
+            customFrameOptionsValue: "SAMEORIGIN"
+            customResponseHeaders:
+              X-Content-Type-Options: "nosniff"
+              Referrer-Policy: "strict-origin-when-cross-origin"
+
+        # Nextcloud specific headers
+        nextcloud-secure-headers:
+          headers:
+            hostsProxyHeaders:
+              - "X-Forwarded-Host"
+              - "X-Forwarded-Proto"
+            referrerPolicy: "same-origin"
+            customFrameOptionsValue: "SAMEORIGIN"
+
+        # Rate limiting
+        rate-limit:
+          rateLimit:
+            average: 100
+            burst: 50
+            period: 1m
+
+        # Nextcloud chain
+        nextcloud-chain:
+          chain:
+            middlewares:
+              - nextcloud-secure-headers@file
+              - security-headers@file
+
+        # Error pages
+        error-pages:
+          errors:
+            status:
+              - "400"
+              - "402-599"
+            service: error-pages-service.error-pages@kubernetescrd
+            query: /{status}.html
+  tls.yml: |
+    # TLS Configuration
+    tls:
+      options:
+        default:
+          minVersion: VersionTLS12
+          sniStrict: false
+          cipherSuites:
+            - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
+            - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+            - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305