feat: cloudflare cert issuer

apps/external-ns.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-nightscout
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.zb-kw.duckdns.org/willemjan/cluster.git
+    targetRevision: main
+    path: services/external-nightscout
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external
+  syncPolicy:
+    automated: {prune: true, selfHeal: true}
+    syncOptions:
+      - CreateNamespace=true

infrastructure/cert-manager/cloudflare-issuer.yaml

@@ -0,0 +1,27 @@
+# ClusterIssuer voor Let's Encrypt via Cloudflare DNS-01 (voor labzand.com).
+# Vereist een secret in namespace cert-manager (ClusterIssuer mag alleen
+# secrets uit de cert-manager namespace lezen), bijv. via sealed-secrets:
+#
+#   apiVersion: v1
+#   kind: Secret
+#   metadata:
+#     name: cloudflare-api-token
+#     namespace: cert-manager
+#   stringData:
+#     api-token: <CLOUDFLARE_API_TOKEN>
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: cloudflare-dns
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: [email protected]
+    privateKeySecretRef:
+      name: cloudflare-dns-account-key
+    solvers:
+      - dns01:
+          cloudflare:
+            apiTokenSecretRef:
+              name: cloudflare-api-token
+              key: api-token

infrastructure/cert-manager/cloudflare-token-sealed.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: cloudflare-api-token
+  namespace: cert-manager
+spec:
+  encryptedData:
+    api-token: AgA+SL4T6mIhlShhHf7wEJhXWGCo2lmtFhNlWJotBlIvaZttsknSaaAzmEwolk+Kk5i8JA6yTSkgi2dux0EVkl3waLgnEFvmcHMSgKbJDiosgVOgIjPOriy5rrgeqZaWLplmkqVEI20NYe/6rW9ByVBf38RAaQsx2msxO7u3dKXC5fJXlDwCosdNKo4eik7OFJrb+X9nBc3gpF3DgBQeWK/QtdC9di3fVpYlRhxC2X0o73rDaqauUvERG1fl78DtuteRiIFpRESstP9cyjgdDRNH5WvSX+Wc+TgUOPk/LmnO0gnfTwhk1GK//2NdO065tQeAkM9aaajOLgyC5rTvo7cK+4FcG92wb1aPU0Vr93V4rj8lgBFOBWmg/64r25rNSNEA/eOpyDw4Vzb3c7PyqRUlMQ1xNoMNXfBzBHlS5wjn5nJm8A9TwDPEKHbYVLzvUkMpaXYUJUOVqBL5czOIcr2UdaOEK6sIFtLVe/dGejT+ZlgM4V9BfQGXJYS1NdWtHX2iXKWhAWU4EyodS5MaQMjggW/VN8CsRvnLZo3m+YLCZmH7FVQisjovhhhon+IFyzzggWtDy3NiKGx1pfVN1x/bvFJ/MkaS5kbxFwvvqh3A1cJSnsAAVV4qJ12MwSawh++QzNG7b/plOgLtDnzTrofjcsgf6iBuGBPI6xYPlWKxp4kPqGjpi/rAqMD/0ZzpQz2fu92gEBBjsKNGYbIf1k+IFy8DoGbu8Y172OLGa1JrLZcgmm8bMuYEiZqQrLb84lqHOg4rkuw=
+  template:
+    metadata:
+      name: cloudflare-api-token
+      namespace: cert-manager

services/external-ns/cert.yaml

@@ -0,0 +1,14 @@
+# Certificaat voor ns.labzand.com via Cloudflare DNS-01.
+# Vereist: ClusterIssuer 'cloudflare-dns' (infrastructure/cert-manager/cloudflare-issuer.yaml)
+# en een secret 'cloudflare-api-token' in namespace cert-manager.
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: ns-labzand
+  namespace: external
+spec:
+  secretName: ns-labzand-tls
+  dnsNames: ["ns.labzand.com"]
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer

services/external-ns/ingress.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: ns
+  namespace: external
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: ns.labzand.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: ns-external
+            port:
+              number: 1337
+  tls:
+  - hosts:
+    - ns.labzand.com
+    secretName: ns-labzand-tls

services/external-ns/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: external
+  labels:
+    name: external

services/external-ns/service.yaml

@@ -0,0 +1,27 @@
+# Service zonder selector: Kubernetes maakt zelf geen Endpoints aan.
+# Het Endpoints-object hieronder levert het externe adres (buiten het cluster).
+apiVersion: v1
+kind: Service
+metadata:
+  name: ns-external
+  namespace: external
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 1337
+      targetPort: 1337
+      protocol: TCP
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: ns-external
+  namespace: external
+subsets:
+  - addresses:
+      - ip: 192.168.2.12
+    ports:
+      - name: http
+        port: 1337
+        protocol: TCP