From f585fa0aa9bc3bcd04eebd3dc1e77842e3b49efe Mon Sep 17 00:00:00 2001
From: willemjan <wulsspaans@gmail.com>
Date: Fri, 6 Nov 2026 20:20:23 +0100
Subject: [PATCH] fix: separate web-entrypoint IngressRoute for http->https
 redirect

A router with TLS enabled (from the Ingress tls section) never matches on
the plain web entrypoint, so entrypoints web,websecure on the Ingress itself
still 404'd on :80. Keep the Ingress on websecure only and add an
IngressRoute on web with the redirect-https middleware.

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
---
 services/external-nightscout/ingress.yaml     |  3 +--
 .../ingressroute-redirect.yaml                | 21 +++++++++++++++++++
 2 files changed, 22 insertions(+), 2 deletions(-)
 create mode 100644 services/external-nightscout/ingressroute-redirect.yaml

diff --git a/services/external-nightscout/ingress.yaml b/services/external-nightscout/ingress.yaml
index f3c5655..95eb0f5 100644
--- a/services/external-nightscout/ingress.yaml
+++ b/services/external-nightscout/ingress.yaml
@@ -4,9 +4,8 @@ metadata:
   name: ns
   namespace: external
   annotations:
-    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
-    traefik.ingress.kubernetes.io/router.middlewares: external-redirect-https@kubernetescrd
 spec:
   ingressClassName: traefik
   rules:
diff --git a/services/external-nightscout/ingressroute-redirect.yaml b/services/external-nightscout/ingressroute-redirect.yaml
new file mode 100644
index 0000000..810e9c6
--- /dev/null
+++ b/services/external-nightscout/ingressroute-redirect.yaml
@@ -0,0 +1,21 @@
+# HTTP (entrypoint web) -> HTTPS redirect voor ns.labzand.com.
+# De Ingress zelf heeft een tls-sectie, waardoor Traefik die router alleen
+# op websecure matcht; daarom hier een aparte router op web.
+# services: api@internal is een dummy - de redirect middleware stuurt
+# nooit door naar een backend.
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: ns-redirect
+  namespace: external
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`ns.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService