From 9bbdf7d5d65c1f542420748f2e330057b4aa3e71 Mon Sep 17 00:00:00 2001
From: willemjan <wulsspaans@gmail.com>
Date: Sat, 14 Nov 2026 21:34:01 +0100
Subject: [PATCH] fix: required tls

---
 services/external-omada/ingress.yaml      | 25 -------------------
 services/external-omada/ingressroute.yaml | 29 +++++++++++++++++++++++
 2 files changed, 29 insertions(+), 25 deletions(-)
 delete mode 100644 services/external-omada/ingress.yaml
 create mode 100644 services/external-omada/ingressroute.yaml

diff --git a/services/external-omada/ingress.yaml b/services/external-omada/ingress.yaml
deleted file mode 100644
index d957359..0000000
--- a/services/external-omada/ingress.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: external-omada
-  namespace: external
-  annotations:
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
-    traefik.ingress.kubernetes.io/router.tls: "true"
-spec:
-  ingressClassName: traefik
-  rules:
-  - host: omada.labzand.com
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: omada-external
-            port:
-              number: 8043
-  tls:
-  - hosts:
-    - omada.labzand.com
-    secretName: external-omada-labzand-tls
\ No newline at end of file
diff --git a/services/external-omada/ingressroute.yaml b/services/external-omada/ingressroute.yaml
new file mode 100644
index 0000000..249882c
--- /dev/null
+++ b/services/external-omada/ingressroute.yaml
@@ -0,0 +1,29 @@
+# omada (:8043) spricht HTTPS met een self-signed cert — daarom een
+# IngressRoute (i.p.v. een plain Ingress, die altijd HTTP naar de backend praat)
+# met scheme: https en een ServersTransport die het cert niet checkt.
+apiVersion: traefik.io/v1alpha1
+kind: ServersTransport
+metadata:
+  name: omada-insecure
+  namespace: external
+spec:
+  insecureSkipVerify: true
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: external-omada
+  namespace: external
+spec:
+  entryPoints:
+    - websecure
+  tls:
+    secretName: external-omada-labzand-tls
+  routes:
+    - match: Host(`omada.labzand.com`)
+      kind: Rule
+      services:
+        - name: omada-external
+          port: 8043
+          scheme: https
+          serversTransport: omada-insecure