feat: add route to external firefly service

Cloudflare's edge 308-redirects git smart-http info/refs requests when the
record is proxied, breaking git/ArgoCD. DNS-only sends traffic straight to
the router -> node -> Traefik, which terminates TLS with a valid LE cert.

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <[email protected]>

apps/adguard.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.zb-kw.duckdns.org/willemjan/cluster.git
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
     targetRevision: main
     path: services/adguard
   destination:

apps/argocd.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.zb-kw.duckdns.org/willemjan/cluster.git
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
     targetRevision: main
     path: services/argocd
   destination:

apps/authentik.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.zb-kw.duckdns.org/willemjan/cluster.git
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
     targetRevision: main
     path: services/authentik
   destination:

apps/cloudfare-ddns.yaml

@@ -0,0 +1,16 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cloudfare-ddns
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
+    targetRevision: main
+    path: services/cloudfare-ddns
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: cloudfare-ddns
+  syncPolicy:
+    automated: {prune: true, selfHeal: true}

apps/external-adguard.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-adguard
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
+    targetRevision: main
+    path: services/external-adguard
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external
+  syncPolicy:
+    automated: {prune: true, selfHeal: true}
+    syncOptions:
+      - CreateNamespace=false

apps/external-autotune.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-autotune
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
+    targetRevision: main
+    path: services/external/external-autotune
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external
+  syncPolicy:
+    automated: {prune: true, selfHeal: true}
+    syncOptions:
+      - CreateNamespace=false

apps/external-beszel.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-beszel
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
+    targetRevision: main
+    path: services/external/external-beszel
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external
+  syncPolicy:
+    automated: {prune: true, selfHeal: true}
+    syncOptions:
+      - CreateNamespace=false

apps/external-firefly.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-firefly
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
+    targetRevision: main
+    path: services/external/external-firefly
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external
+  syncPolicy:
+    automated: {prune: true, selfHeal: true}
+    syncOptions:
+      - CreateNamespace=false

apps/external-gitea.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-gitea
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
+    targetRevision: main
+    path: services/external-gitea
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external
+  syncPolicy:
+    automated: {prune: true, selfHeal: true}
+    syncOptions:
+      - CreateNamespace=false

apps/external-homeassistant.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-homeassistant
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
+    targetRevision: main
+    path: services/external-homeassistant
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external
+  syncPolicy:
+    automated: {prune: true, selfHeal: true}
+    syncOptions:
+      - CreateNamespace=false

apps/external-ns.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-nightscout
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
+    targetRevision: main
+    path: services/external-nightscout
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external
+  syncPolicy:
+    automated: {prune: true, selfHeal: true}
+    syncOptions:
+      - CreateNamespace=false

apps/external-omada.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-omada
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
+    targetRevision: main
+    path: services/external-omada
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external
+  syncPolicy:
+    automated: {prune: true, selfHeal: true}
+    syncOptions:
+      - CreateNamespace=false

apps/external-proxmox.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-proxmox
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
+    targetRevision: main
+    path: services/external-proxmox
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external
+  syncPolicy:
+    automated: {prune: true, selfHeal: true}
+    syncOptions:
+      - CreateNamespace=false

apps/external-sonarqube.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-sonarqube
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
+    targetRevision: main
+    path: services/external-sonarqube
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external
+  syncPolicy:
+    automated: {prune: true, selfHeal: true}
+    syncOptions:
+      - CreateNamespace=false

apps/external.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
+    targetRevision: main
+    path: services/external
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external
+  syncPolicy:
+    automated: {prune: true, selfHeal: true}
+    syncOptions:
+      - CreateNamespace=true

bootstrap/root-app.yaml

@@ -7,7 +7,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.zb-kw.duckdns.org/willemjan/cluster.git
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
     targetRevision: main
     path: apps                  # elke yaml hierin = één Application
     directory:

infrastructure/cert-manager/cloudflare-issuer.yaml

@@ -0,0 +1,27 @@
+# ClusterIssuer voor Let's Encrypt via Cloudflare DNS-01 (voor labzand.com).
+# Vereist een secret in namespace cert-manager (ClusterIssuer mag alleen
+# secrets uit de cert-manager namespace lezen), bijv. via sealed-secrets:
+#
+#   apiVersion: v1
+#   kind: Secret
+#   metadata:
+#     name: cloudflare-api-token
+#     namespace: cert-manager
+#   stringData:
+#     api-token: <CLOUDFLARE_API_TOKEN>
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: cloudflare-dns
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: [email protected]
+    privateKeySecretRef:
+      name: cloudflare-dns-account-key
+    solvers:
+      - dns01:
+          cloudflare:
+            apiTokenSecretRef:
+              name: cloudflare-api-token
+              key: api-token

infrastructure/cert-manager/cloudflare-token-sealed.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: cloudflare-api-token
+  namespace: cert-manager
+spec:
+  encryptedData:
+    api-token: AgBeOIVgJuFtfm4XMy9NqTCqaJ5Gmckk95koM0g6frGZA/FvU87hVGl9rwL/eZ9lSPAdEBTVXelo0pi5cJfFebhjoJfzse3TcfoJGPo5B41167pyrsVsfSailk3ZPwB6rPWoWMRGtct4SLIK4makh2xTE9ez7rZRxEXi8DGPWf7Bn7IIiV27R4MARR6SWeB9F4svvbJOgAfRjf+7pY95epHaFiNy2BUBkjrT6To98XlhsENNgLTTiS8kj6guT5BoPM+hKzQnHF+fCF6nucyddnnYvfxptjSNLEoDY2b2Iy2OUimb7arZXjmGBhAyH4ZQLsLQbF6OrixlR1Q60XsGcZkXebEC7nBDiaAvs7FFUeBO4gdvWIUeADqRkJLxETL3nodhFPjV6MaDJcH4ZGG4FOHA7ytWJ1n6+RJ0WaxC+JcYi5R6DvqNOFPJsvaKcr8aeG5YdrCLYeXzU95huNkX/AnDgAqcXVJAaWI+LN40B6Oq5z2lyz/oO1edOk170G52Qm7D+NwYq5/Dzm6oCuct2jieu/oI07784Ja1r9bMobIJr7cTBe2mHoEDvencFrc/vLViRXj/B6lfxQOcrkaKa+Bu4hOGlmBkLEqAlhyxVfSXk3EO6iqveahcdMmhngtrxmcjJW2WZQUNMBAGxo8kGGas8UFjzfdLD4zAqSl4Tmz6zcy3xO1z0FHfDRYplmAmFU+ji2C5qQVIczZOzAIuO6lN0JXUpo8Bk+jAZiM5Ic8RYQud30j+gQZMhFQfyRy99qdbOC6Ihr0=
+  template:
+    metadata:
+      name: cloudflare-api-token
+      namespace: cert-manager

services/adguard/app.yaml

@@ -85,9 +85,12 @@ kind: Ingress
 metadata:
   name: adguard
   namespace: adguard
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
   rules:
-  - host: adguard-cluster.zb-kw.duckdns.org
+  - host: adguard.labzand.com
     http:
       paths:
       - path: /
@@ -95,5 +98,5 @@ spec:
         backend:
           service: {name: adguard-service, port: {number: 80}}
   tls:
-  - hosts: [adguard-cluster.zb-kw.duckdns.org]
+  - hosts: [adguard.labzand.com]
-    secretName: zb-kw-wildcard-tls
+    secretName: labzand-wildcard-tls

services/adguard/cert.yaml

@@ -1,10 +1,14 @@
 # services/<naam>/cert.yaml
+# Wildcard-certificaat voor *.labzand.com via Cloudflare DNS-01.
+# Vervangt de oude duckdns-cert (zb-kw-wildcard-tls).
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
-  name: zb-kw-wildcard
+  name: labzand-wildcard
   namespace: adguard
 spec:
-  secretName: zb-kw-wildcard-tls
+  secretName: labzand-wildcard-tls
-  dnsNames: ["adguard-cluster.zb-kw.duckdns.org"]
+  dnsNames: ["*.labzand.com"]
-  issuerRef: {name: duckdns, kind: ClusterIssuer}
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer

services/adguard/ingressroute-redirect.yaml

@@ -0,0 +1,19 @@
+# HTTP (entrypoint web) -> HTTPS redirect voor adguard.labzand.com.
+# services: api@internal is een dummy - de redirect middleware stuurt
+# nooit door naar een backend.
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: adguard-redirect
+  namespace: adguard
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`adguard.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService

services/adguard/middleware.yaml

@@ -0,0 +1,11 @@
+# Middleware voor adguard.labzand.com: http (web) -> https redirect.
+# (lan-only verwijderd: klipper-lb SNAT't al verkeer naar 10.42.0.1, zie argocd/middleware.yaml)
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: redirect-https
+  namespace: adguard
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true

services/argocd/cert.yaml

@@ -0,0 +1,13 @@
+# Wildcard-certificaat voor *.labzand.com via Cloudflare DNS-01.
+# DNS-01 werkt ook voor hostnames die niet publiek bereikbaar zijn.
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: labzand-wildcard
+  namespace: argocd
+spec:
+  secretName: labzand-wildcard-tls
+  dnsNames: ["*.labzand.com"]
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer

services/argocd/ingress.yaml

@@ -3,9 +3,13 @@ kind: Ingress
 metadata:
   name: argocd
   namespace: argocd
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
+  ingressClassName: traefik
   rules:
-  - host: argocd.zb-kw.duckdns.org
+  - host: argocd.labzand.com
     http:
       paths:
       - path: /
@@ -16,5 +20,5 @@ spec:
             port:
               number: 80        # poort 80 van de svc = HTTP-backend
   tls:
-  - hosts: [argocd.zb-kw.duckdns.org]
+  - hosts: [argocd.labzand.com]
-    secretName: zb-kw-wildcard-tls
+    secretName: labzand-wildcard-tls

services/argocd/ingressroute-redirect.yaml

@@ -0,0 +1,19 @@
+# HTTP (entrypoint web) -> HTTPS redirect voor argocd.labzand.com.
+# services: api@internal is een dummy - de redirect middleware stuurt
+# nooit door naar een backend.
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: argocd-redirect
+  namespace: argocd
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`argocd.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService

services/argocd/middleware.yaml

@@ -0,0 +1,13 @@
+# Middleware voor argocd.labzand.com: http (web) -> https redirect.
+# (lan-only ipAllowList verwijderd: k3s klipper-lb SNAT't al LB-verkeer naar
+# 10.42.0.1, waardoor Traefik nooit het echte client-IP ziet. Internal-only
+# wordt afgedwongen via DNS: geen publiek A-record voor interne namen.)
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: redirect-https
+  namespace: argocd
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true

services/authentik/cert.yaml

@@ -1,9 +1,13 @@
+# Wildcard-certificaat voor *.labzand.com via Cloudflare DNS-01.
+# Vervangt de oude duckdns-cert (zb-kw-wildcard-tls).
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
-  name: zb-kw-wildcard
+  name: labzand-wildcard
   namespace: authentik
 spec:
-  secretName: zb-kw-wildcard-tls
+  secretName: labzand-wildcard-tls
-  dnsNames: ["auth.zb-kw.duckdns.org"]
+  dnsNames: ["*.labzand.com"]
-  issuerRef: {name: duckdns, kind: ClusterIssuer}
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer

services/authentik/ingress.yaml

@@ -9,16 +9,17 @@ metadata:
 spec:
   ingressClassName: traefik
   rules:
-  - host: auth.zb-kw.duckdns.org
+  - host: auth.labzand.com
-    paths:
+    http:
-    - path: /
+      paths:
-      pathType: Prefix
+      - path: /
-      backend:
+        pathType: Prefix
-        service:
+        backend:
-          name: authentik-server
+          service:
-          port:
+            name: authentik-server
-            number: 9000
+            port:
+              number: 9000
   tls:
   - hosts:
-    - auth.zb-kw.duckdns.org
+    - auth.labzand.com
-    secretName: zb-kw-wildcard-tls
+    secretName: labzand-wildcard-tls

services/authentik/redirect.yaml

@@ -0,0 +1,27 @@
+# HTTP (entrypoint web) -> HTTPS redirect voor auth.labzand.com.
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: redirect-https
+  namespace: authentik
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: auth-redirect
+  namespace: authentik
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`auth.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService

services/cloudfare-ddns/configmap.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cloudflare-ddns-config
+  namespace: cloudflare-ddns
+data:
+  # Comma-separated list of domains to update
+  # Format: subdomain.domain.tld,subdomain2.domain.tld
+  # Alleen namen die écht publiek bereikbaar moeten zijn (via router -> cluster).
+  # Interne-only namen (argocd/auth/adguard.labzand.com) bewust NIET hier:
+  # die krijgen geen publiek A-record en resolven alleen intern via AdGuard.
+  DOMAINS: "ns.labzand.com, ha.labzand.com, gitea.labzand.com"
+  ZONE_ID: "6093605ad5a8db13e9c9d9faad240ca6"

services/cloudfare-ddns/cronjob.yaml

@@ -0,0 +1,50 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: cloudflare-ddns
+  namespace: cloudflare-ddns
+spec:
+  # Run every hour at the top of the hour
+  schedule: "0 * * * *"
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  concurrencyPolicy: Forbid
+  jobTemplate:
+    spec:
+      template:
+        metadata:
+          labels:
+            app: cloudflare-ddns
+        spec:
+          restartPolicy: OnFailure
+          containers:
+          - name: cloudflare-ddns
+            image: curlimages/curl:latest
+            command:
+            - /bin/sh
+            - /scripts/update-dns.sh
+            env:
+            - name: DOMAINS
+              valueFrom:
+                configMapKeyRef:
+                  name: cloudflare-ddns-config
+                  key: DOMAINS
+            - name: ZONE_ID
+              valueFrom:
+                configMapKeyRef:
+                  name: cloudflare-ddns-config
+                  key: ZONE_ID
+            - name: API_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: cloudflare-ddns-secret
+                  key: API_TOKEN
+            volumeMounts:
+            - name: scripts
+              mountPath: /scripts
+              readOnly: true
+          volumes:
+          - name: scripts
+            configMap:
+              name: cloudflare-ddns-script
+              defaultMode: 0755

services/cloudfare-ddns/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cloudflare-ddns
+  labels:
+    name: cloudflare-ddns

services/cloudfare-ddns/script-configmap.yaml

@@ -0,0 +1,127 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cloudflare-ddns-script
+  namespace: cloudflare-ddns
+data:
+  update-dns.sh: |
+    #!/bin/sh
+
+    set -e
+
+    # Colors for output
+    RED='\033[0;31m'
+    GREEN='\033[0;32m'
+    YELLOW='\033[1;33m'
+    NC='\033[0m' # No Color
+
+    echo "Starting Cloudflare DDNS update..."
+    echo "Timestamp: $(date)"
+
+    # Check required environment variables
+    if [ -z "$API_TOKEN" ]; then
+      echo "${RED}ERROR: API_TOKEN is not set${NC}"
+      exit 1
+    fi
+
+    if [ -z "$ZONE_ID" ]; then
+      echo "${RED}ERROR: ZONE_ID is not set${NC}"
+      exit 1
+    fi
+
+    if [ -z "$DOMAINS" ]; then
+      echo "${RED}ERROR: DOMAINS is not set${NC}"
+      exit 1
+    fi
+
+    # Get current public IP address
+    echo "Fetching current public IP address..."
+    PUBLIC_IP=$(curl -s https://api.ipify.org)
+
+    if [ -z "$PUBLIC_IP" ]; then
+      echo "First attempt failed, trying alternative service..."
+      PUBLIC_IP=$(curl -s https://ifconfig.me)
+    fi
+
+    if [ -z "$PUBLIC_IP" ]; then
+      echo "${RED}ERROR: Could not determine public IP address${NC}"
+      exit 1
+    fi
+
+    echo "${GREEN}Current public IP: $PUBLIC_IP${NC}"
+
+    # Process each domain
+    echo "$DOMAINS" | tr ',' '\n' | while IFS= read -r DOMAIN; do
+      # Trim whitespace
+      DOMAIN=$(echo "$DOMAIN" | xargs)
+
+      echo ""
+      echo "Processing domain: $DOMAIN"
+
+      # Get DNS record ID for the domain
+      echo "Fetching DNS record for $DOMAIN..."
+      RECORD_RESPONSE=$(curl -s -X GET "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records?name=$DOMAIN&type=A" \
+        -H "Authorization: Bearer $API_TOKEN" \
+        -H "Content-Type: application/json")
+
+      # Check if the request was successful
+      SUCCESS=$(echo "$RECORD_RESPONSE" | grep -o '"success":[^,]*' | cut -d':' -f2)
+
+      if [ "$SUCCESS" != "true" ]; then
+        echo "${RED}ERROR: Failed to fetch DNS record for $DOMAIN${NC}"
+        echo "$RECORD_RESPONSE"
+        continue
+      fi
+
+      # Extract record ID and current IP
+      RECORD_ID=$(echo "$RECORD_RESPONSE" | grep -o '"id":"[^"]*"' | head -1 | cut -d'"' -f4)
+      CURRENT_IP=$(echo "$RECORD_RESPONSE" | grep -o '"content":"[^"]*"' | head -1 | cut -d'"' -f4)
+
+      if [ -z "$RECORD_ID" ]; then
+        echo "${YELLOW}WARNING: DNS record not found for $DOMAIN. Creating new record...${NC}"
+
+        # Create new DNS record
+        CREATE_RESPONSE=$(curl -s -X POST "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records" \
+          -H "Authorization: Bearer $API_TOKEN" \
+          -H "Content-Type: application/json" \
+          --data "{\"type\":\"A\",\"name\":\"$DOMAIN\",\"content\":\"$PUBLIC_IP\",\"ttl\":120,\"proxied\":false}")
+
+        CREATE_SUCCESS=$(echo "$CREATE_RESPONSE" | grep -o '"success":[^,]*' | cut -d':' -f2)
+
+        if [ "$CREATE_SUCCESS" = "true" ]; then
+          echo "${GREEN}Successfully created DNS record for $DOMAIN with IP $PUBLIC_IP${NC}"
+        else
+          echo "${RED}ERROR: Failed to create DNS record for $DOMAIN${NC}"
+          echo "$CREATE_RESPONSE"
+        fi
+        continue
+      fi
+
+      echo "Current DNS IP: $CURRENT_IP"
+
+      # Check if IP needs to be updated
+      if [ "$CURRENT_IP" = "$PUBLIC_IP" ]; then
+        echo "${GREEN}IP address is already up to date for $DOMAIN${NC}"
+        continue
+      fi
+
+      echo "${YELLOW}Updating DNS record for $DOMAIN from $CURRENT_IP to $PUBLIC_IP${NC}"
+
+      # Update DNS record
+      UPDATE_RESPONSE=$(curl -s -X PUT "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records/$RECORD_ID" \
+        -H "Authorization: Bearer $API_TOKEN" \
+        -H "Content-Type: application/json" \
+        --data "{\"type\":\"A\",\"name\":\"$DOMAIN\",\"content\":\"$PUBLIC_IP\",\"ttl\":120,\"proxied\":false}")
+
+      UPDATE_SUCCESS=$(echo "$UPDATE_RESPONSE" | grep -o '"success":[^,]*' | cut -d':' -f2)
+
+      if [ "$UPDATE_SUCCESS" = "true" ]; then
+        echo "${GREEN}Successfully updated DNS record for $DOMAIN to $PUBLIC_IP${NC}"
+      else
+        echo "${RED}ERROR: Failed to update DNS record for $DOMAIN${NC}"
+        echo "$UPDATE_RESPONSE"
+      fi
+    done
+
+    echo ""
+    echo "Cloudflare DDNS update completed at $(date)"

services/cloudfare-ddns/sealed-secret.yaml

@@ -0,0 +1,19 @@
+{
+  "kind": "SealedSecret",
+  "apiVersion": "bitnami.com/v1alpha1",
+  "metadata": {
+    "name": "cloudflare-ddns-secret",
+    "namespace": "cloudflare-ddns"
+  },
+  "spec": {
+    "template": {
+      "metadata": {
+        "name": "cloudflare-ddns-secret",
+        "namespace": "cloudflare-ddns"
+      }
+    },
+    "encryptedData": {
+      "API_TOKEN": "AgASyHk4o7tXdEY9QRROjxx51GDpzYQ13mj3hHYHNYkmQ5r3DH1j1sDZKv4Psf10krEhLdNzHPqbmn9IQYP6VyNIRG1E2YmTNBjx5ePp4TPSu0Ya/h6BGnCaMW8rcLSzy+dhsuPJby/PL7trQRvNkhCIY0YUZV2jmIHaWU8TQrBTHF6yxDFL98IePYM5VFLgajEz+kuVROVhxMXCW9jfKTzeWoI0edXCDx8qvFiMC9c8nBoLbbcLkXPxP0803S3kE8qX1BnCJN9gZSDbOPHkB7f9b/6JztjBK2cWhA8bjhHX6geC54PZJ9HRYoM9cghSg4ug3G02d0uQ186GSIELTYSLtHkOlYjuTcvs8PO5cwRR3sk2Dm06NyH2fAsWEfbE3OsOqyOgvEnOUt65li4MEbeBsjyrp2AY3xypOffbTgWKAnyTlaRMtDlUN4VERzc046lZAPEsPEadIcv2BarM3LllFPD8svXxNhieY+lihD5LAD7xqZkCxvPB3cjFwvFdU9ZSpC9J9108P5XKfvSsUa6O2cBC42VEd1BnsyWt0jsRhJrRHPpmtjrCP9kyzbByIp+tlML2LwXm42+9smr+cPesJuawk2texEmXERu3R9U7SidKizXOjrUl32oNgYFPPb18oFCluvyyry8g/MUs+gf4mug56lMU6uuHLqD+i74WL2jhyQe0lJeVkm9IVDykS5sJnoP02Sgb9b74lr9ctPK8CUVupamAV14OAYqi/9IjcGcZpgWw677cH+Kt8rbLlUrX8sFyVA=="
+    }
+  }
+}

services/external-adguard/cert.yaml

@@ -0,0 +1,11 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: external-adguard-labzand
+  namespace: external
+spec:
+  secretName: external-adguard-labzand-tls
+  dnsNames: ["adguard1.labzand.com"]
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer

services/external-adguard/ingress.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: external-adguard
+  namespace: external
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: adguard1.labzand.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: adguard-external
+            port:
+              number: 80
+  tls:
+  - hosts:
+    - adguard1.labzand.com
+    secretName: external-adguard-labzand-tls

services/external-adguard/ingressroute-redirect.yaml

@@ -0,0 +1,16 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: external-adguard-redirect
+  namespace: external
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`adguard1.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService

services/external-adguard/service.yaml

@@ -0,0 +1,27 @@
+# Service zonder selector: Kubernetes maakt zelf geen Endpoints aan.
+# Het Endpoints-object hieronder levert het externe adres (buiten het cluster).
+apiVersion: v1
+kind: Service
+metadata:
+  name: adguard-external
+  namespace: external
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80
+      protocol: TCP
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: adguard-external
+  namespace: external
+subsets:
+  - addresses:
+      - ip: 192.168.2.53
+    ports:
+      - name: http
+        port: 80
+        protocol: TCP

services/external-gitea/cert.yaml

@@ -0,0 +1,11 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: gitea-labzand
+  namespace: external
+spec:
+  secretName: gitea-labzand-tls
+  dnsNames: ["gitea.labzand.com"]
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer

services/external-gitea/ingress.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: gitea
+  namespace: external
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: gitea.labzand.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: gitea-external
+            port:
+              number: 3000
+  tls:
+  - hosts:
+    - gitea.labzand.com
+    secretName: gitea-labzand-tls

services/external-gitea/ingressroute-redirect.yaml

@@ -0,0 +1,16 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: gitea-redirect
+  namespace: external
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`gitea.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService

services/external-gitea/service.yaml

@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitea-external
+  namespace: external
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 3000
+      targetPort: 3000
+      protocol: TCP
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: gitea-external
+  namespace: external
+subsets:
+  - addresses:
+      - ip: 192.168.2.52
+    ports:
+      - name: http
+        port: 3000
+        protocol: TCP

services/external-homeassistant/cert.yaml

@@ -0,0 +1,14 @@
+# Certificaat voor ns.labzand.com via Cloudflare DNS-01.
+# Vereist: ClusterIssuer 'cloudflare-dns' (infrastructure/cert-manager/cloudflare-issuer.yaml)
+# en een secret 'cloudflare-api-token' in namespace cert-manager.
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: ha-labzand
+  namespace: external
+spec:
+  secretName: ha-labzand-tls
+  dnsNames: ["ha.labzand.com"]
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer

services/external-homeassistant/ingress.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: homeassistant
+  namespace: external
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: ha.labzand.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: ha-external
+            port:
+              number: 8123
+  tls:
+  - hosts:
+    - ha.labzand.com
+    secretName: ha-labzand-tls

services/external-homeassistant/ingressroute-redirect.yaml

@@ -0,0 +1,21 @@
+# HTTP (entrypoint web) -> HTTPS redirect voor ns.labzand.com.
+# De Ingress zelf heeft een tls-sectie, waardoor Traefik die router alleen
+# op websecure matcht; daarom hier een aparte router op web.
+# services: api@internal is een dummy - de redirect middleware stuurt
+# nooit door naar een backend.
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: ha-redirect
+  namespace: external
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`ha.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService

services/external-homeassistant/service.yaml

@@ -0,0 +1,27 @@
+# Service zonder selector: Kubernetes maakt zelf geen Endpoints aan.
+# Het Endpoints-object hieronder levert het externe adres (buiten het cluster).
+apiVersion: v1
+kind: Service
+metadata:
+  name: ha-external
+  namespace: external
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 8123
+      targetPort: 8123
+      protocol: TCP
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: ha-external
+  namespace: external
+subsets:
+  - addresses:
+      - ip: 192.168.2.146
+    ports:
+      - name: http
+        port: 8123
+        protocol: TCP

services/external-nightscout/cert.yaml

@@ -0,0 +1,14 @@
+# Certificaat voor ns.labzand.com via Cloudflare DNS-01.
+# Vereist: ClusterIssuer 'cloudflare-dns' (infrastructure/cert-manager/cloudflare-issuer.yaml)
+# en een secret 'cloudflare-api-token' in namespace cert-manager.
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: ns-labzand
+  namespace: external
+spec:
+  secretName: ns-labzand-tls
+  dnsNames: ["ns.labzand.com"]
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer

services/external-nightscout/ingress.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: ns
+  namespace: external
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: ns.labzand.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: ns-external
+            port:
+              number: 1337
+  tls:
+  - hosts:
+    - ns.labzand.com
+    secretName: ns-labzand-tls

services/external-nightscout/ingressroute-redirect.yaml

@@ -0,0 +1,21 @@
+# HTTP (entrypoint web) -> HTTPS redirect voor ns.labzand.com.
+# De Ingress zelf heeft een tls-sectie, waardoor Traefik die router alleen
+# op websecure matcht; daarom hier een aparte router op web.
+# services: api@internal is een dummy - de redirect middleware stuurt
+# nooit door naar een backend.
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: ns-redirect
+  namespace: external
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`ns.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService

services/external-nightscout/service.yaml

@@ -0,0 +1,27 @@
+# Service zonder selector: Kubernetes maakt zelf geen Endpoints aan.
+# Het Endpoints-object hieronder levert het externe adres (buiten het cluster).
+apiVersion: v1
+kind: Service
+metadata:
+  name: ns-external
+  namespace: external
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 1337
+      targetPort: 1337
+      protocol: TCP
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: ns-external
+  namespace: external
+subsets:
+  - addresses:
+      - ip: 192.168.2.12
+    ports:
+      - name: http
+        port: 1337
+        protocol: TCP

services/external-omada/cert.yaml

@@ -0,0 +1,11 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: external-omada-labzand
+  namespace: external
+spec:
+  secretName: external-omada-labzand-tls
+  dnsNames: ["omada.labzand.com"]
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer

services/external-omada/ingressroute-redirect.yaml

@@ -0,0 +1,16 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: external-omada-redirect
+  namespace: external
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`omada.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService

services/external-omada/ingressroute.yaml

@@ -0,0 +1,29 @@
+# omada (:8043) spricht HTTPS met een self-signed cert — daarom een
+# IngressRoute (i.p.v. een plain Ingress, die altijd HTTP naar de backend praat)
+# met scheme: https en een ServersTransport die het cert niet checkt.
+apiVersion: traefik.io/v1alpha1
+kind: ServersTransport
+metadata:
+  name: omada-insecure
+  namespace: external
+spec:
+  insecureSkipVerify: true
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: external-omada
+  namespace: external
+spec:
+  entryPoints:
+    - websecure
+  tls:
+    secretName: external-omada-labzand-tls
+  routes:
+    - match: Host(`omada.labzand.com`)
+      kind: Rule
+      services:
+        - name: omada-external
+          port: 8043
+          scheme: https
+          serversTransport: omada-insecure

services/external-omada/service.yaml

@@ -0,0 +1,27 @@
+# Service zonder selector: Kubernetes maakt zelf geen Endpoints aan.
+# Het Endpoints-object hieronder levert het externe adres (buiten het cluster).
+apiVersion: v1
+kind: Service
+metadata:
+  name: omada-external
+  namespace: external
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 8043
+      targetPort: 8043
+      protocol: TCP
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: omada-external
+  namespace: external
+subsets:
+  - addresses:
+      - ip: 192.168.2.62
+    ports:
+      - name: http
+        port: 8043
+        protocol: TCP

services/external-proxmox/cert.yaml

@@ -0,0 +1,11 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: external-proxmox-labzand
+  namespace: external
+spec:
+  secretName: external-proxmox-labzand-tls
+  dnsNames: ["proxmox.labzand.com"]
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer

services/external-proxmox/ingressroute-redirect.yaml

@@ -0,0 +1,16 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: external-proxmox-redirect
+  namespace: external
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`proxmox.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService

services/external-proxmox/ingressroute.yaml

@@ -0,0 +1,29 @@
+# Proxmox (:8006) spricht HTTPS met een self-signed cert — daarom een
+# IngressRoute (i.p.v. een plain Ingress, die altijd HTTP naar de backend praat)
+# met scheme: https en een ServersTransport die het cert niet checkt.
+apiVersion: traefik.io/v1alpha1
+kind: ServersTransport
+metadata:
+  name: proxmox-insecure
+  namespace: external
+spec:
+  insecureSkipVerify: true
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: external-proxmox
+  namespace: external
+spec:
+  entryPoints:
+    - websecure
+  tls:
+    secretName: external-proxmox-labzand-tls
+  routes:
+    - match: Host(`proxmox.labzand.com`)
+      kind: Rule
+      services:
+        - name: proxmox-external
+          port: 8006
+          scheme: https
+          serversTransport: proxmox-insecure

services/external-proxmox/service.yaml

@@ -0,0 +1,33 @@
+# Service zonder selector: Kubernetes maakt zelf geen endpoints aan.
+# Het Endpoints-object hieronder levert het externe adres (Proxmox, buiten het cluster).
+# De endpoints-controller mirrored dit automatisch naar een EndpointSlice.
+# (Een handmatige discovery.k8s.io/v1 EndpointSlice faalt op deze cluster met
+#  kubectl 1.31 tegen server 1.36: "unknown field spec" — daher v1 Endpoints.)
+# Let op: ArgoCD trackt Endpoints/EndpointSlice niet — apply deze file handmatig
+# als het endpoint ontbreekt:
+#   kubectl apply -f services/external-proxmox/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: proxmox-external
+  namespace: external
+spec:
+  type: ClusterIP
+  ports:
+    - name: https
+      port: 8006
+      targetPort: 8006
+      protocol: TCP
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: proxmox-external
+  namespace: external
+subsets:
+  - addresses:
+      - ip: 192.168.2.64
+    ports:
+      - name: https
+        port: 8006
+        protocol: TCP

services/external-sonarqube/cert.yaml

@@ -0,0 +1,11 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: external-sonarqube-labzand
+  namespace: external
+spec:
+  secretName: external-sonarqube-labzand-tls
+  dnsNames: ["sonarqube.labzand.com"]
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer

services/external-sonarqube/ingress.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: external-sonarqube
+  namespace: external
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: sonarqube.labzand.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: sonarqube-external
+            port:
+              number: 9000
+  tls:
+  - hosts:
+    - sonarqube.labzand.com
+    secretName: external-sonarqube-labzand-tls

services/external-sonarqube/ingressroute-redirect.yaml

@@ -0,0 +1,16 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: external-sonarqube-redirect
+  namespace: external
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`sonarqube.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService

services/external-sonarqube/service.yaml

@@ -0,0 +1,27 @@
+# Service zonder selector: Kubernetes maakt zelf geen Endpoints aan.
+# Het Endpoints-object hieronder levert het externe adres (buiten het cluster).
+apiVersion: v1
+kind: Service
+metadata:
+  name: sonarqube-external
+  namespace: external
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 9000
+      targetPort: 9000
+      protocol: TCP
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: sonarqube-external
+  namespace: external
+subsets:
+  - addresses:
+      - ip: 192.168.2.49
+    ports:
+      - name: http
+        port: 9000
+        protocol: TCP

services/external/external-autotune/cert.yaml

@@ -0,0 +1,11 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: external-autotune-labzand
+  namespace: external
+spec:
+  secretName: external-autotune-labzand-tls
+  dnsNames: ["autotune.labzand.com"]
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer

services/external/external-autotune/ingressroute-redirect.yaml

@@ -0,0 +1,16 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: external-autotune-redirect
+  namespace: external
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`autotune.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService

services/external/external-autotune/ingressroute.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: external-autotune
+  namespace: external
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: autotune.labzand.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: autotune-external
+            port:
+              number: 8502
+  tls:
+  - hosts:
+    - autotune.labzand.com
+    secretName: external-autotune-labzand-tls

services/external/external-autotune/service.yaml

@@ -0,0 +1,27 @@
+# Service zonder selector: Kubernetes maakt zelf geen Endpoints aan.
+# Het Endpoints-object hieronder levert het externe adres (buiten het cluster).
+apiVersion: v1
+kind: Service
+metadata:
+  name: autotune-external
+  namespace: external
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 8502
+      targetPort: 8502
+      protocol: TCP
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: autotune-external
+  namespace: external
+subsets:
+  - addresses:
+      - ip: 192.168.2.51
+    ports:
+      - name: http
+        port: 8502
+        protocol: TCP

services/external/external-beszel/cert.yaml

@@ -0,0 +1,11 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: external-beszel-labzand
+  namespace: external
+spec:
+  secretName: external-beszel-labzand-tls
+  dnsNames: ["beszel.labzand.com"]
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer

services/external/external-beszel/ingressroute-redirect.yaml

@@ -0,0 +1,16 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: external-beszel-redirect
+  namespace: external
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`beszel.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService

services/external/external-beszel/ingressroute.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: external-beszel
+  namespace: external
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: beszel.labzand.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: beszel-external
+            port:
+              number: 8090
+  tls:
+  - hosts:
+    - beszel.labzand.com
+    secretName: external-beszel-labzand-tls

services/external/external-beszel/service.yaml

@@ -0,0 +1,27 @@
+# Service zonder selector: Kubernetes maakt zelf geen Endpoints aan.
+# Het Endpoints-object hieronder levert het externe adres (buiten het cluster).
+apiVersion: v1
+kind: Service
+metadata:
+  name: beszel-external
+  namespace: external
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 8090
+      targetPort: 8090
+      protocol: TCP
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: beszel-external
+  namespace: external
+subsets:
+  - addresses:
+      - ip: 192.168.2.61
+    ports:
+      - name: http
+        port: 8090
+        protocol: TCP

services/external/external-firefly/cert.yaml

@@ -0,0 +1,11 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: external-firefly-labzand
+  namespace: external
+spec:
+  secretName: external-firefly-labzand-tls
+  dnsNames: ["firefly.labzand.com"]
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer

services/external/external-firefly/ingressroute-redirect.yaml

@@ -0,0 +1,16 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: external-firefly-redirect
+  namespace: external
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`firefly.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService

services/external/external-firefly/ingressroute.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: external-firefly
+  namespace: external
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: firefly.labzand.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: firefly-external
+            port:
+              number: 80
+  tls:
+  - hosts:
+    - firefly.labzand.com
+    secretName: external-firefly-labzand-tls

services/external/external-firefly/service.yaml

@@ -0,0 +1,27 @@
+# Service zonder selector: Kubernetes maakt zelf geen Endpoints aan.
+# Het Endpoints-object hieronder levert het externe adres (buiten het cluster).
+apiVersion: v1
+kind: Service
+metadata:
+  name: firefly-external
+  namespace: external
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80
+      protocol: TCP
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: firefly-external
+  namespace: external
+subsets:
+  - addresses:
+      - ip: 192.168.2.59
+    ports:
+      - name: http
+        port: 80
+        protocol: TCP

services/external/middleware.yaml

@@ -0,0 +1,11 @@
+# Redirect plain HTTP (entrypoint web) naar HTTPS.
+# Op websecure is het scheme al https, dus daar doet deze middleware niets.
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: redirect-https
+  namespace: external
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true

services/external/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: external
+  labels:
+    name: external