# Auto-generated by forust | See https://github.com/traefik/traefik-helm-chart/blob/master/values.yaml
hostNetwork: false

securityContext:
  capabilities:
    add:
      - NET_BIND_SERVICE

podSecurityContext: ~

service:
  enabled: true
  type: LoadBalancer
  annotations:
    metallb.io/loadBalancerIPs: "192.168.80.2"
  spec:
    externalTrafficPolicy: Local
api:
  dashboard: true
  insecure: true

updateStrategy:
  type: Recreate

deployment:
  initContainers:
    - name: volume-permissions
      image: busybox:latest
      command:
        - sh
        - -c
        - "mkdir -p /data/letsencrypt && touch /data/letsencrypt/acme.json && chmod 600 /data/letsencrypt/acme.json"
      volumeMounts:
        - name: data
          mountPath: /data

providers:
  kubernetesIngress:
    enabled: false
  kubernetesCRD:
    enabled: true
  kubernetesGateway:
    enabled: false
  file:
    enabled: false

# Entrypoints
ports:
  web:
    port: 80
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
          permanent: true
  websecure:
    port: 443
    http:
      tls:
        enabled: true
  ssh:
    port: 2221
    exposedPort: 2221
    protocol: TCP
    expose:
      default: true
  minecraft-tcp:
    port: 25565
    exposedPort: 25565
    protocol: TCP
    expose:
      default: true
  minecraft-udp:
    port: 19132
    exposedPort: 19132
    protocol: UDP
    expose:
      default: true

ingressRoute:
  dashboard:
    enabled: false

persistence:
  enabled: true
  size: 100Mi
  path: /data

certificatesResolvers:
  letsencrypt-staging:
    acme:
      email: bobrovod@national.shitposting.agency
      storage: /data/letsencrypt/acme.json
      caServer: https://acme-staging-v02.api.letsencrypt.org/directory
      httpChallenge:
        entryPoint: web
  letsencrypt:
    acme:
      email: bobrovod@national.shitposting.agency
      storage: /data/letsencrypt/acme.json
      caServer: https://acme-v02.api.letsencrypt.org/directory
      httpChallenge:
        entryPoint: web

volumes:
  - name: traefik-dynamic
    mountPath: /etc/traefik/dynamic
    type: configMap
  - name: crowdsec-bouncer-secrets
    mountPath: /etc/traefik/secrets
    type: secret

additionalArguments:
  - "--providers.file.directory=/etc/traefik/dynamic"
  - "--providers.file.watch=true"
  - "--providers.kubernetesCRD.allowCrossNamespace=true"
  - "--entryPoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22,192.168.1.1,192.168.1.0/24,192.168.88.0/24,192.168.88.1"
  - "--entryPoints.web.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22,192.168.1.1,192.168.1.0/24,192.168.88.0/24,192.168.88.1"

logs:
  general:
    level: INFO
  access:
    enabled: true
    format: common

experimental:
  plugins:
    crowdsec-bouncer:
      moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
      version: v1.3.3