Move to websecure

2026-05-04 17:28:34 +00:00 · 2026-05-04 17:28:34 +00:00 · cf0081bf12
commit cf0081bf12
parent 186221bc6d
10 changed files with 215 additions and 8 deletions
--- a/services/audiobookshelf/audiobookshelf-ingress.yaml
+++ b/services/audiobookshelf/audiobookshelf-ingress.yaml
@ -15,7 +15,7 @@ metadata:
  namespace: default
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
-    traefik.ingress.kubernetes.io/router.entrypoints: web
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    traefik.ingress.kubernetes.io/router.tls: "true"
    traefik.ingress.kubernetes.io/router.middlewares: default-audiobookshelf-proxy-headers@kubernetescrd

--- a/services/calibre-web/calibre-web-ingress.yaml
+++ b/services/calibre-web/calibre-web-ingress.yaml
@ -15,7 +15,7 @@ metadata:
  namespace: default
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
-    traefik.ingress.kubernetes.io/router.entrypoints: web
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    traefik.ingress.kubernetes.io/router.tls: "true"
    traefik.ingress.kubernetes.io/router.middlewares: default-calibre-web-proxy-headers@kubernetescrd
 spec:
--- a/services/foundryvtt/foundry-vtt-ingress.yaml
+++ b/services/foundryvtt/foundry-vtt-ingress.yaml
@ -29,7 +29,7 @@ metadata:
  namespace: default
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
-    traefik.ingress.kubernetes.io/router.entrypoints: web, websecure
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    traefik.ingress.kubernetes.io/router.tls: "true"
    traefik.ingress.kubernetes.io/router.middlewares: default-foundry-proxy-headers@kubernetescrd, default-foundry-vtt-oauth-auth@kubernetescrd
 spec:
@ -57,7 +57,7 @@ metadata:
  namespace: default
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
-    traefik.ingress.kubernetes.io/router.entrypoints: web, websecure
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    traefik.ingress.kubernetes.io/router.tls: "true"
    traefik.ingress.kubernetes.io/router.middlewares: default-foundry-proxy-headers@kubernetescrd
 spec:
--- a/services/jellyfin/jellyfin-ingress.yaml
+++ b/services/jellyfin/jellyfin-ingress.yaml
@ -15,7 +15,7 @@ metadata:
  namespace: default
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
-    traefik.ingress.kubernetes.io/router.entrypoints: web
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    traefik.ingress.kubernetes.io/router.tls: "true"
    traefik.ingress.kubernetes.io/router.middlewares: default-jellyfin-proxy-headers@kubernetescrd
 spec:
--- a/services/keycloak/keycloak-ingress.yaml
+++ b/services/keycloak/keycloak-ingress.yaml
@ -15,7 +15,7 @@ metadata:
  namespace: default
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure, web
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    traefik.ingress.kubernetes.io/router.tls: "true"
    traefik.ingress.kubernetes.io/router.middlewares: default-keycloak-proxy-headers@kubernetescrd
 spec:
--- a/services/navidrome/navidrome-ingress.yaml
+++ b/services/navidrome/navidrome-ingress.yaml
@ -15,7 +15,7 @@ metadata:
  namespace: default
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
-    traefik.ingress.kubernetes.io/router.entrypoints: web
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    traefik.ingress.kubernetes.io/router.tls: "true"
    traefik.ingress.kubernetes.io/router.middlewares: default-navidrome-proxy-headers@kubernetescrd
 spec:
--- a/services/omada-controller/omada-controller-deployment.yaml
+++ b/services/omada-controller/omada-controller-deployment.yaml
@ -0,0 +1,104 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: omada-controller
+  namespace: default
+  annotations:
+    reloader.stakater.com/auto: "true"
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: omada-controller
+  template:
+    metadata:
+      labels:
+        app: omada-controller
+    spec:
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+        runAsNonRoot: true
+        fsGroup: 1000
+        fsGroupChangePolicy: "OnRootMismatch"
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+      - name: omada-controller
+        image: mbentley/omada-controller:6.2
+        imagePullPolicy: Always
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+        env:
+        - name: ROOTLESS
+          value: "true"
+        - name: MANAGE_HTTP_PORT
+          value: "8088"
+        - name: MANAGE_HTTPS_PORT
+          value: "8043"
+        - name: PORTAL_HTTP_PORT
+          value: "8088"
+        - name: PORTAL_HTTPS_PORT
+          value: "8843"
+        - name: UPGRADE_HTTPS_PORT
+          value: "8043"
+        - name: PORT_APP_DISCOVERY
+          value: "27001"
+        - name: PORT_ADOPT_V1
+          value: "29812"
+        - name: PORT_UPGRADE_V1
+          value: "29813"
+        - name: PORT_MANAGER_V1
+          value: "29811"
+        - name: PORT_MANAGER_V2
+          value: "29814"
+        - name: PORT_DISCOVERY
+          value: "29810"
+        - name: PORT_TRANSFER_V2
+          value: "29815"
+        - name: PORT_RTTY
+          value: "29816"
+        - name: PORT_DEVICE_MONITOR
+          value: "29817"
+        - name: WEB_CONFIG_OVERRIDE
+          value: "false"
+        - name: SHOW_SERVER_LOGS
+          value: "true"
+        - name: SHOW_MONGODB_LOGS
+          value: "false"
+        - name: SSL_CERT_NAME
+          value: tls.crt
+        - name: SSL_KEY_NAME
+          value: tls.key
+        - name: TZ
+          value: America/New_York
+        - name: SKIP_USERMOD
+          value: "true"
+        - name: JAVA_MAX_HEAP_SIZE
+          value: "512m"
+        - name: JAVA_MIN_HEAP_SIZE
+          value: "128m"
+        - name: MONGOD_EXTRA_ARGS
+          value: "--wiredTigerCacheSizeGB 0.25"
+        - name: OPENJ9_JAVA_OPTIONS
+          value: "-Xmx512m -Xms128m -XX:+IdleTuningGcOnIdle -XX:+IdleTuningCompileAtIdle"
+        volumeMounts:
+        - name: omada-data
+          mountPath: /opt/tplink/EAPController/data
+        - name: omada-logs
+          mountPath: /opt/tplink/EAPController/logs
+      volumes:
+      - name: omada-data
+        nfs:
+          server: birdfeeder2.home.nest
+          path: /k3s/omada-controller/data
+      - name: omada-logs
+        nfs:
+          server: birdfeeder2.home.nest
+          path: /k3s/omada-controller/logs
+      restartPolicy: Always
--- a/services/omada-controller/omada-controller-ingress.yaml
+++ b/services/omada-controller/omada-controller-ingress.yaml
@ -0,0 +1,37 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: omada-controller-proxy-headers
+  namespace: default
+spec:
+  headers:
+    customRequestHeaders:
+      X-Forwarded-Proto: "https"
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: omada-controller-ingress
+  namespace: default
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    traefik.ingress.kubernetes.io/router.middlewares: default-omada-controller-proxy-headers@kubernetescrd
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+      - pigeon.mynest.love
+      secretName: omada-controller-tls
+  rules:
+    - host: pigeon.mynest.love
+      http:
+        paths:
+        - path: /
+          pathType: Prefix
+          backend:
+            service:
+              name: omada-controller-service
+              port:
+                name: manage-http
--- a/services/omada-controller/omada-controller-service.yaml
+++ b/services/omada-controller/omada-controller-service.yaml
@ -0,0 +1,66 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: omada-controller-service
+  namespace: default
+  annotations:
+    metallb.universe.tf/loadBalancerIPs: 192.168.1.152
+spec:
+  type: LoadBalancer
+  externalTrafficPolicy: Local
+  allocateLoadBalancerNodePorts: false
+  selector:
+    app: omada-controller
+  ports:
+  - name: manage-http
+    port: 8088
+    targetPort: 8088
+    protocol: TCP
+  - name: manage-https
+    port: 8043
+    targetPort: 8043
+    protocol: TCP
+  - name: portal-https
+    port: 8843
+    targetPort: 8843
+    protocol: TCP
+  - name: app-discovery
+    port: 27001
+    targetPort: 27001
+    protocol: UDP
+  - name: adopt-v1
+    port: 29812
+    targetPort: 29812
+    protocol: TCP
+  - name: upgrade-v1
+    port: 29813
+    targetPort: 29813
+    protocol: TCP
+  - name: manager-v1
+    port: 29811
+    targetPort: 29811
+    protocol: TCP
+  - name: manager-v2
+    port: 29814
+    targetPort: 29814
+    protocol: TCP
+  - name: udp-discovery
+    port: 29810
+    targetPort: 29810
+    protocol: UDP
+  - name: udp-management
+    protocol: UDP
+    port: 19810
+    targetPort: 19810
+  - name: transfer-v2
+    port: 29815
+    targetPort: 29815
+    protocol: TCP
+  - name: rtty
+    port: 29816
+    targetPort: 29816
+    protocol: TCP
+  - name: device-monitor
+    port: 29817
+    targetPort: 29817
+    protocol: TCP
--- a/services/vaultwarden/vaultwarden-ingress.yaml
+++ b/services/vaultwarden/vaultwarden-ingress.yaml
@ -15,7 +15,7 @@ metadata:
  namespace: default
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
-    traefik.ingress.kubernetes.io/router.entrypoints: web
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    traefik.ingress.kubernetes.io/router.tls: "true"
    traefik.ingress.kubernetes.io/router.middlewares: default-vaultwarden-proxy-headers@kubernetescrd