feat: lan-only + force-ssl for argocd/authentik/adguard labzand.com ingresses

ipAllowList middleware (192.168.0.0/16) on the websecure routers blocks
external access; separate IngressRoute on web 301-redirects http->https.

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <[email protected]>

services/authentik/ingress.yaml

@@ -6,6 +6,7 @@ metadata:
   annotations:
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
+    traefik.ingress.kubernetes.io/router.middlewares: authentik-lan-only@kubernetescrd
 spec:
   ingressClassName: traefik
   rules:

services/authentik/middleware-lan.yaml

@@ -0,0 +1,13 @@
+# Middleware voor auth.labzand.com (alleen intern): blokkeert verkeer
+# van buiten het LAN op de websecure-router.
+# (redirect-https staat in redirect.yaml)
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: lan-only
+  namespace: authentik
+spec:
+  ipAllowList:
+    sourceRange:
+      - 192.168.0.0/16
+      - 127.0.0.1/32

services/authentik/redirect.yaml

@@ -0,0 +1,27 @@
+# HTTP (entrypoint web) -> HTTPS redirect voor auth.labzand.com.
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: redirect-https
+  namespace: authentik
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: auth-redirect
+  namespace: authentik
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`auth.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService