From cf0081bf12f55990abfe8825ecc44293849ccb5e Mon Sep 17 00:00:00 2001 From: KnightArtorias Date: Mon, 4 May 2026 17:28:34 +0000 Subject: [PATCH] Move to websecure --- .../audiobookshelf-ingress.yaml | 2 +- services/calibre-web/calibre-web-ingress.yaml | 2 +- services/foundryvtt/foundry-vtt-ingress.yaml | 4 +- services/jellyfin/jellyfin-ingress.yaml | 2 +- services/keycloak/keycloak-ingress.yaml | 2 +- services/navidrome/navidrome-ingress.yaml | 2 +- .../omada-controller-deployment.yaml | 104 ++++++++++++++++++ .../omada-controller-ingress.yaml | 37 +++++++ .../omada-controller-service.yaml | 66 +++++++++++ services/vaultwarden/vaultwarden-ingress.yaml | 2 +- 10 files changed, 215 insertions(+), 8 deletions(-) create mode 100644 services/omada-controller/omada-controller-deployment.yaml create mode 100644 services/omada-controller/omada-controller-ingress.yaml create mode 100644 services/omada-controller/omada-controller-service.yaml diff --git a/services/audiobookshelf/audiobookshelf-ingress.yaml b/services/audiobookshelf/audiobookshelf-ingress.yaml index 5cfe65d..76b75db 100644 --- a/services/audiobookshelf/audiobookshelf-ingress.yaml +++ b/services/audiobookshelf/audiobookshelf-ingress.yaml @@ -15,7 +15,7 @@ metadata: namespace: default annotations: cert-manager.io/cluster-issuer: "letsencrypt-prod" - traefik.ingress.kubernetes.io/router.entrypoints: web + traefik.ingress.kubernetes.io/router.entrypoints: websecure traefik.ingress.kubernetes.io/router.tls: "true" traefik.ingress.kubernetes.io/router.middlewares: default-audiobookshelf-proxy-headers@kubernetescrd diff --git a/services/calibre-web/calibre-web-ingress.yaml b/services/calibre-web/calibre-web-ingress.yaml index bc718ed..42bf51f 100644 --- a/services/calibre-web/calibre-web-ingress.yaml +++ b/services/calibre-web/calibre-web-ingress.yaml @@ -15,7 +15,7 @@ metadata: namespace: default annotations: cert-manager.io/cluster-issuer: "letsencrypt-prod" - traefik.ingress.kubernetes.io/router.entrypoints: web + traefik.ingress.kubernetes.io/router.entrypoints: websecure traefik.ingress.kubernetes.io/router.tls: "true" traefik.ingress.kubernetes.io/router.middlewares: default-calibre-web-proxy-headers@kubernetescrd spec: diff --git a/services/foundryvtt/foundry-vtt-ingress.yaml b/services/foundryvtt/foundry-vtt-ingress.yaml index ec74773..4cdbf01 100644 --- a/services/foundryvtt/foundry-vtt-ingress.yaml +++ b/services/foundryvtt/foundry-vtt-ingress.yaml @@ -29,7 +29,7 @@ metadata: namespace: default annotations: cert-manager.io/cluster-issuer: "letsencrypt-prod" - traefik.ingress.kubernetes.io/router.entrypoints: web, websecure + traefik.ingress.kubernetes.io/router.entrypoints: websecure traefik.ingress.kubernetes.io/router.tls: "true" traefik.ingress.kubernetes.io/router.middlewares: default-foundry-proxy-headers@kubernetescrd, default-foundry-vtt-oauth-auth@kubernetescrd spec: @@ -57,7 +57,7 @@ metadata: namespace: default annotations: cert-manager.io/cluster-issuer: "letsencrypt-prod" - traefik.ingress.kubernetes.io/router.entrypoints: web, websecure + traefik.ingress.kubernetes.io/router.entrypoints: websecure traefik.ingress.kubernetes.io/router.tls: "true" traefik.ingress.kubernetes.io/router.middlewares: default-foundry-proxy-headers@kubernetescrd spec: diff --git a/services/jellyfin/jellyfin-ingress.yaml b/services/jellyfin/jellyfin-ingress.yaml index 79eb2d5..40bc62d 100644 --- a/services/jellyfin/jellyfin-ingress.yaml +++ b/services/jellyfin/jellyfin-ingress.yaml @@ -15,7 +15,7 @@ metadata: namespace: default annotations: cert-manager.io/cluster-issuer: "letsencrypt-prod" - traefik.ingress.kubernetes.io/router.entrypoints: web + traefik.ingress.kubernetes.io/router.entrypoints: websecure traefik.ingress.kubernetes.io/router.tls: "true" traefik.ingress.kubernetes.io/router.middlewares: default-jellyfin-proxy-headers@kubernetescrd spec: diff --git a/services/keycloak/keycloak-ingress.yaml b/services/keycloak/keycloak-ingress.yaml index 1090126..3ec8780 100644 --- a/services/keycloak/keycloak-ingress.yaml +++ b/services/keycloak/keycloak-ingress.yaml @@ -15,7 +15,7 @@ metadata: namespace: default annotations: cert-manager.io/cluster-issuer: "letsencrypt-prod" - traefik.ingress.kubernetes.io/router.entrypoints: websecure, web + traefik.ingress.kubernetes.io/router.entrypoints: websecure traefik.ingress.kubernetes.io/router.tls: "true" traefik.ingress.kubernetes.io/router.middlewares: default-keycloak-proxy-headers@kubernetescrd spec: diff --git a/services/navidrome/navidrome-ingress.yaml b/services/navidrome/navidrome-ingress.yaml index cd21f35..c2e4e18 100644 --- a/services/navidrome/navidrome-ingress.yaml +++ b/services/navidrome/navidrome-ingress.yaml @@ -15,7 +15,7 @@ metadata: namespace: default annotations: cert-manager.io/cluster-issuer: "letsencrypt-prod" - traefik.ingress.kubernetes.io/router.entrypoints: web + traefik.ingress.kubernetes.io/router.entrypoints: websecure traefik.ingress.kubernetes.io/router.tls: "true" traefik.ingress.kubernetes.io/router.middlewares: default-navidrome-proxy-headers@kubernetescrd spec: diff --git a/services/omada-controller/omada-controller-deployment.yaml b/services/omada-controller/omada-controller-deployment.yaml new file mode 100644 index 0000000..0272c6e --- /dev/null +++ b/services/omada-controller/omada-controller-deployment.yaml @@ -0,0 +1,104 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: omada-controller + namespace: default + annotations: + reloader.stakater.com/auto: "true" +spec: + replicas: 1 + strategy: + type: Recreate + selector: + matchLabels: + app: omada-controller + template: + metadata: + labels: + app: omada-controller + spec: + securityContext: + runAsUser: 1000 + runAsGroup: 1000 + runAsNonRoot: true + fsGroup: 1000 + fsGroupChangePolicy: "OnRootMismatch" + seccompProfile: + type: RuntimeDefault + containers: + - name: omada-controller + image: mbentley/omada-controller:6.2 + imagePullPolicy: Always + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + env: + - name: ROOTLESS + value: "true" + - name: MANAGE_HTTP_PORT + value: "8088" + - name: MANAGE_HTTPS_PORT + value: "8043" + - name: PORTAL_HTTP_PORT + value: "8088" + - name: PORTAL_HTTPS_PORT + value: "8843" + - name: UPGRADE_HTTPS_PORT + value: "8043" + - name: PORT_APP_DISCOVERY + value: "27001" + - name: PORT_ADOPT_V1 + value: "29812" + - name: PORT_UPGRADE_V1 + value: "29813" + - name: PORT_MANAGER_V1 + value: "29811" + - name: PORT_MANAGER_V2 + value: "29814" + - name: PORT_DISCOVERY + value: "29810" + - name: PORT_TRANSFER_V2 + value: "29815" + - name: PORT_RTTY + value: "29816" + - name: PORT_DEVICE_MONITOR + value: "29817" + - name: WEB_CONFIG_OVERRIDE + value: "false" + - name: SHOW_SERVER_LOGS + value: "true" + - name: SHOW_MONGODB_LOGS + value: "false" + - name: SSL_CERT_NAME + value: tls.crt + - name: SSL_KEY_NAME + value: tls.key + - name: TZ + value: America/New_York + - name: SKIP_USERMOD + value: "true" + - name: JAVA_MAX_HEAP_SIZE + value: "512m" + - name: JAVA_MIN_HEAP_SIZE + value: "128m" + - name: MONGOD_EXTRA_ARGS + value: "--wiredTigerCacheSizeGB 0.25" + - name: OPENJ9_JAVA_OPTIONS + value: "-Xmx512m -Xms128m -XX:+IdleTuningGcOnIdle -XX:+IdleTuningCompileAtIdle" + volumeMounts: + - name: omada-data + mountPath: /opt/tplink/EAPController/data + - name: omada-logs + mountPath: /opt/tplink/EAPController/logs + volumes: + - name: omada-data + nfs: + server: birdfeeder2.home.nest + path: /k3s/omada-controller/data + - name: omada-logs + nfs: + server: birdfeeder2.home.nest + path: /k3s/omada-controller/logs + restartPolicy: Always diff --git a/services/omada-controller/omada-controller-ingress.yaml b/services/omada-controller/omada-controller-ingress.yaml new file mode 100644 index 0000000..8b773f4 --- /dev/null +++ b/services/omada-controller/omada-controller-ingress.yaml @@ -0,0 +1,37 @@ +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: omada-controller-proxy-headers + namespace: default +spec: + headers: + customRequestHeaders: + X-Forwarded-Proto: "https" +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: omada-controller-ingress + namespace: default + annotations: + traefik.ingress.kubernetes.io/router.entrypoints: websecure + traefik.ingress.kubernetes.io/router.tls: "true" + cert-manager.io/cluster-issuer: "letsencrypt-prod" + traefik.ingress.kubernetes.io/router.middlewares: default-omada-controller-proxy-headers@kubernetescrd +spec: + ingressClassName: traefik + tls: + - hosts: + - pigeon.mynest.love + secretName: omada-controller-tls + rules: + - host: pigeon.mynest.love + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: omada-controller-service + port: + name: manage-http diff --git a/services/omada-controller/omada-controller-service.yaml b/services/omada-controller/omada-controller-service.yaml new file mode 100644 index 0000000..e718bcf --- /dev/null +++ b/services/omada-controller/omada-controller-service.yaml @@ -0,0 +1,66 @@ +apiVersion: v1 +kind: Service +metadata: + name: omada-controller-service + namespace: default + annotations: + metallb.universe.tf/loadBalancerIPs: 192.168.1.152 +spec: + type: LoadBalancer + externalTrafficPolicy: Local + allocateLoadBalancerNodePorts: false + selector: + app: omada-controller + ports: + - name: manage-http + port: 8088 + targetPort: 8088 + protocol: TCP + - name: manage-https + port: 8043 + targetPort: 8043 + protocol: TCP + - name: portal-https + port: 8843 + targetPort: 8843 + protocol: TCP + - name: app-discovery + port: 27001 + targetPort: 27001 + protocol: UDP + - name: adopt-v1 + port: 29812 + targetPort: 29812 + protocol: TCP + - name: upgrade-v1 + port: 29813 + targetPort: 29813 + protocol: TCP + - name: manager-v1 + port: 29811 + targetPort: 29811 + protocol: TCP + - name: manager-v2 + port: 29814 + targetPort: 29814 + protocol: TCP + - name: udp-discovery + port: 29810 + targetPort: 29810 + protocol: UDP + - name: udp-management + protocol: UDP + port: 19810 + targetPort: 19810 + - name: transfer-v2 + port: 29815 + targetPort: 29815 + protocol: TCP + - name: rtty + port: 29816 + targetPort: 29816 + protocol: TCP + - name: device-monitor + port: 29817 + targetPort: 29817 + protocol: TCP diff --git a/services/vaultwarden/vaultwarden-ingress.yaml b/services/vaultwarden/vaultwarden-ingress.yaml index 681f0ee..3b77cd0 100644 --- a/services/vaultwarden/vaultwarden-ingress.yaml +++ b/services/vaultwarden/vaultwarden-ingress.yaml @@ -15,7 +15,7 @@ metadata: namespace: default annotations: cert-manager.io/cluster-issuer: "letsencrypt-prod" - traefik.ingress.kubernetes.io/router.entrypoints: web + traefik.ingress.kubernetes.io/router.entrypoints: websecure traefik.ingress.kubernetes.io/router.tls: "true" traefik.ingress.kubernetes.io/router.middlewares: default-vaultwarden-proxy-headers@kubernetescrd