feat: lan-only + force-ssl for argocd/authentik/adguard labzand.com ingresses

ipAllowList middleware (192.168.0.0/16) on the websecure routers blocks external access; separate IngressRoute on web 301-redirects http->https. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <[email protected]>
2026-11-14 16:37:02 +01:00
parent e857cb989c
commit 43fdc020f4
9 changed files with 134 additions and 0 deletions
@@ -0,0 +1,23 @@
+# Middlewares voor adguard.labzand.com (alleen intern):
+# - redirect-https: http (web) -> https
+# - lan-only: blokkeert verkeer van buiten het LAN op de websecure-router
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: redirect-https
+  namespace: adguard
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: lan-only
+  namespace: adguard
+spec:
+  ipAllowList:
+    sourceRange:
+      - 192.168.0.0/16
+      - 127.0.0.1/32