From db1adfc229cc76ddc498d5dda87377822e0206c1 Mon Sep 17 00:00:00 2001
From: willemjan <wulsspaans@gmail.com>
Date: Fri, 6 Nov 2026 20:10:38 +0100
Subject: [PATCH] feat: redirect http->https for ns.labzand.com (web entrypoint
 + redirect-https middleware)

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
---
 services/external-nightscout/ingress.yaml    |  3 ++-
 services/external-nightscout/middleware.yaml | 11 +++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)
 create mode 100644 services/external-nightscout/middleware.yaml

diff --git a/services/external-nightscout/ingress.yaml b/services/external-nightscout/ingress.yaml
index 95eb0f5..f3c5655 100644
--- a/services/external-nightscout/ingress.yaml
+++ b/services/external-nightscout/ingress.yaml
@@ -4,8 +4,9 @@ metadata:
   name: ns
   namespace: external
   annotations:
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
+    traefik.ingress.kubernetes.io/router.middlewares: external-redirect-https@kubernetescrd
 spec:
   ingressClassName: traefik
   rules:
diff --git a/services/external-nightscout/middleware.yaml b/services/external-nightscout/middleware.yaml
new file mode 100644
index 0000000..9f2ab97
--- /dev/null
+++ b/services/external-nightscout/middleware.yaml
@@ -0,0 +1,11 @@
+# Redirect plain HTTP (entrypoint web) naar HTTPS.
+# Op websecure is het scheme al https, dus daar doet deze middleware niets.
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: redirect-https
+  namespace: external
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true