feat: add route to external firefly service

Cloudflare's edge 308-redirects git smart-http info/refs requests when the
record is proxied, breaking git/ArgoCD. DNS-only sends traffic straight to
the router -> node -> Traefik, which terminates TLS with a valid LE cert.

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <[email protected]>

apps/adguard.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.zb-kw.duckdns.org/willemjan/cluster.git
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
     targetRevision: main
     path: services/adguard
   destination:

apps/argocd.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.zb-kw.duckdns.org/willemjan/cluster.git
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
     targetRevision: main
     path: services/argocd
   destination:

apps/authentik.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.zb-kw.duckdns.org/willemjan/cluster.git
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
     targetRevision: main
     path: services/authentik
   destination:

apps/cloudfare-ddns.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.zb-kw.duckdns.org/willemjan/cluster.git
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
     targetRevision: main
     path: services/cloudfare-ddns
   destination:

apps/external-adguard.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-adguard
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
+    targetRevision: main
+    path: services/external-adguard
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external
+  syncPolicy:
+    automated: {prune: true, selfHeal: true}
+    syncOptions:
+      - CreateNamespace=false

apps/external-autotune.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-autotune
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
+    targetRevision: main
+    path: services/external/external-autotune
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external
+  syncPolicy:
+    automated: {prune: true, selfHeal: true}
+    syncOptions:
+      - CreateNamespace=false

apps/external-beszel.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-beszel
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
+    targetRevision: main
+    path: services/external/external-beszel
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external
+  syncPolicy:
+    automated: {prune: true, selfHeal: true}
+    syncOptions:
+      - CreateNamespace=false

apps/external-firefly.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-firefly
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
+    targetRevision: main
+    path: services/external/external-firefly
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external
+  syncPolicy:
+    automated: {prune: true, selfHeal: true}
+    syncOptions:
+      - CreateNamespace=false

apps/external-gitea.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-gitea
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
+    targetRevision: main
+    path: services/external-gitea
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external
+  syncPolicy:
+    automated: {prune: true, selfHeal: true}
+    syncOptions:
+      - CreateNamespace=false

apps/external-homeassistant.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-homeassistant
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
+    targetRevision: main
+    path: services/external-homeassistant
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external
+  syncPolicy:
+    automated: {prune: true, selfHeal: true}
+    syncOptions:
+      - CreateNamespace=false

apps/external-ns.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.zb-kw.duckdns.org/willemjan/cluster.git
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
     targetRevision: main
     path: services/external-nightscout
   destination:
@@ -15,4 +15,4 @@ spec:
   syncPolicy:
     automated: {prune: true, selfHeal: true}
     syncOptions:
-      - CreateNamespace=true
+      - CreateNamespace=false

apps/external-omada.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-omada
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
+    targetRevision: main
+    path: services/external-omada
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external
+  syncPolicy:
+    automated: {prune: true, selfHeal: true}
+    syncOptions:
+      - CreateNamespace=false

apps/external-proxmox.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-proxmox
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
+    targetRevision: main
+    path: services/external-proxmox
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external
+  syncPolicy:
+    automated: {prune: true, selfHeal: true}
+    syncOptions:
+      - CreateNamespace=false

apps/external-sonarqube.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-sonarqube
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
+    targetRevision: main
+    path: services/external-sonarqube
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external
+  syncPolicy:
+    automated: {prune: true, selfHeal: true}
+    syncOptions:
+      - CreateNamespace=false

apps/external.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
+    targetRevision: main
+    path: services/external
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external
+  syncPolicy:
+    automated: {prune: true, selfHeal: true}
+    syncOptions:
+      - CreateNamespace=true

bootstrap/root-app.yaml

@@ -7,7 +7,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.zb-kw.duckdns.org/willemjan/cluster.git
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
     targetRevision: main
     path: apps                  # elke yaml hierin = één Application
     directory:

infrastructure/cert-manager/cloudflare-token-sealed.yaml

@@ -6,7 +6,7 @@ metadata:
   namespace: cert-manager
 spec:
   encryptedData:
-    api-token: AgA+SL4T6mIhlShhHf7wEJhXWGCo2lmtFhNlWJotBlIvaZttsknSaaAzmEwolk+Kk5i8JA6yTSkgi2dux0EVkl3waLgnEFvmcHMSgKbJDiosgVOgIjPOriy5rrgeqZaWLplmkqVEI20NYe/6rW9ByVBf38RAaQsx2msxO7u3dKXC5fJXlDwCosdNKo4eik7OFJrb+X9nBc3gpF3DgBQeWK/QtdC9di3fVpYlRhxC2X0o73rDaqauUvERG1fl78DtuteRiIFpRESstP9cyjgdDRNH5WvSX+Wc+TgUOPk/LmnO0gnfTwhk1GK//2NdO065tQeAkM9aaajOLgyC5rTvo7cK+4FcG92wb1aPU0Vr93V4rj8lgBFOBWmg/64r25rNSNEA/eOpyDw4Vzb3c7PyqRUlMQ1xNoMNXfBzBHlS5wjn5nJm8A9TwDPEKHbYVLzvUkMpaXYUJUOVqBL5czOIcr2UdaOEK6sIFtLVe/dGejT+ZlgM4V9BfQGXJYS1NdWtHX2iXKWhAWU4EyodS5MaQMjggW/VN8CsRvnLZo3m+YLCZmH7FVQisjovhhhon+IFyzzggWtDy3NiKGx1pfVN1x/bvFJ/MkaS5kbxFwvvqh3A1cJSnsAAVV4qJ12MwSawh++QzNG7b/plOgLtDnzTrofjcsgf6iBuGBPI6xYPlWKxp4kPqGjpi/rAqMD/0ZzpQz2fu92gEBBjsKNGYbIf1k+IFy8DoGbu8Y172OLGa1JrLZcgmm8bMuYEiZqQrLb84lqHOg4rkuw=
+    api-token: AgBeOIVgJuFtfm4XMy9NqTCqaJ5Gmckk95koM0g6frGZA/FvU87hVGl9rwL/eZ9lSPAdEBTVXelo0pi5cJfFebhjoJfzse3TcfoJGPo5B41167pyrsVsfSailk3ZPwB6rPWoWMRGtct4SLIK4makh2xTE9ez7rZRxEXi8DGPWf7Bn7IIiV27R4MARR6SWeB9F4svvbJOgAfRjf+7pY95epHaFiNy2BUBkjrT6To98XlhsENNgLTTiS8kj6guT5BoPM+hKzQnHF+fCF6nucyddnnYvfxptjSNLEoDY2b2Iy2OUimb7arZXjmGBhAyH4ZQLsLQbF6OrixlR1Q60XsGcZkXebEC7nBDiaAvs7FFUeBO4gdvWIUeADqRkJLxETL3nodhFPjV6MaDJcH4ZGG4FOHA7ytWJ1n6+RJ0WaxC+JcYi5R6DvqNOFPJsvaKcr8aeG5YdrCLYeXzU95huNkX/AnDgAqcXVJAaWI+LN40B6Oq5z2lyz/oO1edOk170G52Qm7D+NwYq5/Dzm6oCuct2jieu/oI07784Ja1r9bMobIJr7cTBe2mHoEDvencFrc/vLViRXj/B6lfxQOcrkaKa+Bu4hOGlmBkLEqAlhyxVfSXk3EO6iqveahcdMmhngtrxmcjJW2WZQUNMBAGxo8kGGas8UFjzfdLD4zAqSl4Tmz6zcy3xO1z0FHfDRYplmAmFU+ji2C5qQVIczZOzAIuO6lN0JXUpo8Bk+jAZiM5Ic8RYQud30j+gQZMhFQfyRy99qdbOC6Ihr0=
   template:
     metadata:
       name: cloudflare-api-token

services/adguard/app.yaml

@@ -85,9 +85,12 @@ kind: Ingress
 metadata:
   name: adguard
   namespace: adguard
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
   rules:
-  - host: adguard-cluster.zb-kw.duckdns.org
+  - host: adguard.labzand.com
     http:
       paths:
       - path: /
@@ -95,5 +98,5 @@ spec:
         backend:
           service: {name: adguard-service, port: {number: 80}}
   tls:
-  - hosts: [adguard-cluster.zb-kw.duckdns.org]
+  - hosts: [adguard.labzand.com]
-    secretName: zb-kw-wildcard-tls
+    secretName: labzand-wildcard-tls

services/adguard/cert.yaml

@@ -1,10 +1,14 @@
 # services/<naam>/cert.yaml
+# Wildcard-certificaat voor *.labzand.com via Cloudflare DNS-01.
+# Vervangt de oude duckdns-cert (zb-kw-wildcard-tls).
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
-  name: zb-kw-wildcard
+  name: labzand-wildcard
   namespace: adguard
 spec:
-  secretName: zb-kw-wildcard-tls
+  secretName: labzand-wildcard-tls
-  dnsNames: ["adguard-cluster.zb-kw.duckdns.org"]
+  dnsNames: ["*.labzand.com"]
-  issuerRef: {name: duckdns, kind: ClusterIssuer}
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer

services/adguard/ingressroute-redirect.yaml

@@ -0,0 +1,19 @@
+# HTTP (entrypoint web) -> HTTPS redirect voor adguard.labzand.com.
+# services: api@internal is een dummy - de redirect middleware stuurt
+# nooit door naar een backend.
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: adguard-redirect
+  namespace: adguard
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`adguard.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService

services/adguard/middleware.yaml

@@ -0,0 +1,11 @@
+# Middleware voor adguard.labzand.com: http (web) -> https redirect.
+# (lan-only verwijderd: klipper-lb SNAT't al verkeer naar 10.42.0.1, zie argocd/middleware.yaml)
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: redirect-https
+  namespace: adguard
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true

services/argocd/cert.yaml

@@ -0,0 +1,13 @@
+# Wildcard-certificaat voor *.labzand.com via Cloudflare DNS-01.
+# DNS-01 werkt ook voor hostnames die niet publiek bereikbaar zijn.
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: labzand-wildcard
+  namespace: argocd
+spec:
+  secretName: labzand-wildcard-tls
+  dnsNames: ["*.labzand.com"]
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer

services/argocd/ingress.yaml

@@ -3,9 +3,13 @@ kind: Ingress
 metadata:
   name: argocd
   namespace: argocd
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
+  ingressClassName: traefik
   rules:
-  - host: argocd.zb-kw.duckdns.org
+  - host: argocd.labzand.com
     http:
       paths:
       - path: /
@@ -16,5 +20,5 @@ spec:
             port:
               number: 80        # poort 80 van de svc = HTTP-backend
   tls:
-  - hosts: [argocd.zb-kw.duckdns.org]
+  - hosts: [argocd.labzand.com]
-    secretName: zb-kw-wildcard-tls
+    secretName: labzand-wildcard-tls

services/argocd/ingressroute-redirect.yaml

@@ -0,0 +1,19 @@
+# HTTP (entrypoint web) -> HTTPS redirect voor argocd.labzand.com.
+# services: api@internal is een dummy - de redirect middleware stuurt
+# nooit door naar een backend.
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: argocd-redirect
+  namespace: argocd
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`argocd.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService

services/argocd/middleware.yaml

@@ -0,0 +1,13 @@
+# Middleware voor argocd.labzand.com: http (web) -> https redirect.
+# (lan-only ipAllowList verwijderd: k3s klipper-lb SNAT't al LB-verkeer naar
+# 10.42.0.1, waardoor Traefik nooit het echte client-IP ziet. Internal-only
+# wordt afgedwongen via DNS: geen publiek A-record voor interne namen.)
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: redirect-https
+  namespace: argocd
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true

services/authentik/cert.yaml

@@ -1,9 +1,13 @@
+# Wildcard-certificaat voor *.labzand.com via Cloudflare DNS-01.
+# Vervangt de oude duckdns-cert (zb-kw-wildcard-tls).
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
-  name: zb-kw-wildcard
+  name: labzand-wildcard
   namespace: authentik
 spec:
-  secretName: zb-kw-wildcard-tls
+  secretName: labzand-wildcard-tls
-  dnsNames: ["auth.zb-kw.duckdns.org"]
+  dnsNames: ["*.labzand.com"]
-  issuerRef: {name: duckdns, kind: ClusterIssuer}
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer

services/authentik/ingress.yaml

@@ -9,7 +9,7 @@ metadata:
 spec:
   ingressClassName: traefik
   rules:
-  - host: auth.zb-kw.duckdns.org
+  - host: auth.labzand.com
     http:
       paths:
       - path: /
@@ -21,5 +21,5 @@ spec:
               number: 9000
   tls:
   - hosts:
-    - auth.zb-kw.duckdns.org
+    - auth.labzand.com
-    secretName: zb-kw-wildcard-tls
+    secretName: labzand-wildcard-tls

services/authentik/redirect.yaml

@@ -0,0 +1,27 @@
+# HTTP (entrypoint web) -> HTTPS redirect voor auth.labzand.com.
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: redirect-https
+  namespace: authentik
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: auth-redirect
+  namespace: authentik
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`auth.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService

services/cloudfare-ddns/configmap.yaml

@@ -6,5 +6,8 @@ metadata:
 data:
   # Comma-separated list of domains to update
   # Format: subdomain.domain.tld,subdomain2.domain.tld
-  DOMAINS: "*.labzand.com"
+  # Alleen namen die écht publiek bereikbaar moeten zijn (via router -> cluster).
-  ZONE_ID: "6093605ad5a8db13e9c9d9faad240ca6"
+  # Interne-only namen (argocd/auth/adguard.labzand.com) bewust NIET hier:
+  # die krijgen geen publiek A-record en resolven alleen intern via AdGuard.
+  DOMAINS: "ns.labzand.com, ha.labzand.com, gitea.labzand.com"
+  ZONE_ID: "6093605ad5a8db13e9c9d9faad240ca6"

services/cloudfare-ddns/script-configmap.yaml

@@ -84,7 +84,7 @@ data:
         CREATE_RESPONSE=$(curl -s -X POST "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records" \
           -H "Authorization: Bearer $API_TOKEN" \
           -H "Content-Type: application/json" \
-          --data "{\"type\":\"A\",\"name\":\"$DOMAIN\",\"content\":\"$PUBLIC_IP\",\"ttl\":120,\"proxied\":true}")
+          --data "{\"type\":\"A\",\"name\":\"$DOMAIN\",\"content\":\"$PUBLIC_IP\",\"ttl\":120,\"proxied\":false}")
 
         CREATE_SUCCESS=$(echo "$CREATE_RESPONSE" | grep -o '"success":[^,]*' | cut -d':' -f2)
 

services/external-adguard/cert.yaml

@@ -0,0 +1,11 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: external-adguard-labzand
+  namespace: external
+spec:
+  secretName: external-adguard-labzand-tls
+  dnsNames: ["adguard1.labzand.com"]
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer

services/external-adguard/ingress.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: external-adguard
+  namespace: external
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: adguard1.labzand.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: adguard-external
+            port:
+              number: 80
+  tls:
+  - hosts:
+    - adguard1.labzand.com
+    secretName: external-adguard-labzand-tls

services/external-adguard/ingressroute-redirect.yaml

@@ -0,0 +1,16 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: external-adguard-redirect
+  namespace: external
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`adguard1.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService

services/external-adguard/service.yaml

@@ -0,0 +1,27 @@
+# Service zonder selector: Kubernetes maakt zelf geen Endpoints aan.
+# Het Endpoints-object hieronder levert het externe adres (buiten het cluster).
+apiVersion: v1
+kind: Service
+metadata:
+  name: adguard-external
+  namespace: external
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80
+      protocol: TCP
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: adguard-external
+  namespace: external
+subsets:
+  - addresses:
+      - ip: 192.168.2.53
+    ports:
+      - name: http
+        port: 80
+        protocol: TCP

services/external-gitea/cert.yaml

@@ -0,0 +1,11 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: gitea-labzand
+  namespace: external
+spec:
+  secretName: gitea-labzand-tls
+  dnsNames: ["gitea.labzand.com"]
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer

services/external-gitea/ingress.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: gitea
+  namespace: external
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: gitea.labzand.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: gitea-external
+            port:
+              number: 3000
+  tls:
+  - hosts:
+    - gitea.labzand.com
+    secretName: gitea-labzand-tls

services/external-gitea/ingressroute-redirect.yaml

@@ -0,0 +1,16 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: gitea-redirect
+  namespace: external
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`gitea.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService

services/external-gitea/service.yaml

@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitea-external
+  namespace: external
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 3000
+      targetPort: 3000
+      protocol: TCP
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: gitea-external
+  namespace: external
+subsets:
+  - addresses:
+      - ip: 192.168.2.52
+    ports:
+      - name: http
+        port: 3000
+        protocol: TCP

services/external-homeassistant/cert.yaml

@@ -0,0 +1,14 @@
+# Certificaat voor ns.labzand.com via Cloudflare DNS-01.
+# Vereist: ClusterIssuer 'cloudflare-dns' (infrastructure/cert-manager/cloudflare-issuer.yaml)
+# en een secret 'cloudflare-api-token' in namespace cert-manager.
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: ha-labzand
+  namespace: external
+spec:
+  secretName: ha-labzand-tls
+  dnsNames: ["ha.labzand.com"]
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer

services/external-homeassistant/ingress.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: homeassistant
+  namespace: external
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: ha.labzand.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: ha-external
+            port:
+              number: 8123
+  tls:
+  - hosts:
+    - ha.labzand.com
+    secretName: ha-labzand-tls

services/external-homeassistant/ingressroute-redirect.yaml

@@ -0,0 +1,21 @@
+# HTTP (entrypoint web) -> HTTPS redirect voor ns.labzand.com.
+# De Ingress zelf heeft een tls-sectie, waardoor Traefik die router alleen
+# op websecure matcht; daarom hier een aparte router op web.
+# services: api@internal is een dummy - de redirect middleware stuurt
+# nooit door naar een backend.
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: ha-redirect
+  namespace: external
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`ha.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService

services/external-homeassistant/service.yaml

@@ -0,0 +1,27 @@
+# Service zonder selector: Kubernetes maakt zelf geen Endpoints aan.
+# Het Endpoints-object hieronder levert het externe adres (buiten het cluster).
+apiVersion: v1
+kind: Service
+metadata:
+  name: ha-external
+  namespace: external
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 8123
+      targetPort: 8123
+      protocol: TCP
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: ha-external
+  namespace: external
+subsets:
+  - addresses:
+      - ip: 192.168.2.146
+    ports:
+      - name: http
+        port: 8123
+        protocol: TCP

services/external-nightscout/ingressroute-redirect.yaml

@@ -0,0 +1,21 @@
+# HTTP (entrypoint web) -> HTTPS redirect voor ns.labzand.com.
+# De Ingress zelf heeft een tls-sectie, waardoor Traefik die router alleen
+# op websecure matcht; daarom hier een aparte router op web.
+# services: api@internal is een dummy - de redirect middleware stuurt
+# nooit door naar een backend.
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: ns-redirect
+  namespace: external
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`ns.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService

services/external-omada/cert.yaml

@@ -0,0 +1,11 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: external-omada-labzand
+  namespace: external
+spec:
+  secretName: external-omada-labzand-tls
+  dnsNames: ["omada.labzand.com"]
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer

services/external-omada/ingressroute-redirect.yaml

@@ -0,0 +1,16 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: external-omada-redirect
+  namespace: external
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`omada.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService

services/external-omada/ingressroute.yaml

@@ -0,0 +1,29 @@
+# omada (:8043) spricht HTTPS met een self-signed cert — daarom een
+# IngressRoute (i.p.v. een plain Ingress, die altijd HTTP naar de backend praat)
+# met scheme: https en een ServersTransport die het cert niet checkt.
+apiVersion: traefik.io/v1alpha1
+kind: ServersTransport
+metadata:
+  name: omada-insecure
+  namespace: external
+spec:
+  insecureSkipVerify: true
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: external-omada
+  namespace: external
+spec:
+  entryPoints:
+    - websecure
+  tls:
+    secretName: external-omada-labzand-tls
+  routes:
+    - match: Host(`omada.labzand.com`)
+      kind: Rule
+      services:
+        - name: omada-external
+          port: 8043
+          scheme: https
+          serversTransport: omada-insecure

services/external-omada/service.yaml

@@ -0,0 +1,27 @@
+# Service zonder selector: Kubernetes maakt zelf geen Endpoints aan.
+# Het Endpoints-object hieronder levert het externe adres (buiten het cluster).
+apiVersion: v1
+kind: Service
+metadata:
+  name: omada-external
+  namespace: external
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 8043
+      targetPort: 8043
+      protocol: TCP
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: omada-external
+  namespace: external
+subsets:
+  - addresses:
+      - ip: 192.168.2.62
+    ports:
+      - name: http
+        port: 8043
+        protocol: TCP

services/external-proxmox/cert.yaml

@@ -0,0 +1,11 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: external-proxmox-labzand
+  namespace: external
+spec:
+  secretName: external-proxmox-labzand-tls
+  dnsNames: ["proxmox.labzand.com"]
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer

services/external-proxmox/ingressroute-redirect.yaml

@@ -0,0 +1,16 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: external-proxmox-redirect
+  namespace: external
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`proxmox.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService

services/external-proxmox/ingressroute.yaml

@@ -0,0 +1,29 @@
+# Proxmox (:8006) spricht HTTPS met een self-signed cert — daarom een
+# IngressRoute (i.p.v. een plain Ingress, die altijd HTTP naar de backend praat)
+# met scheme: https en een ServersTransport die het cert niet checkt.
+apiVersion: traefik.io/v1alpha1
+kind: ServersTransport
+metadata:
+  name: proxmox-insecure
+  namespace: external
+spec:
+  insecureSkipVerify: true
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: external-proxmox
+  namespace: external
+spec:
+  entryPoints:
+    - websecure
+  tls:
+    secretName: external-proxmox-labzand-tls
+  routes:
+    - match: Host(`proxmox.labzand.com`)
+      kind: Rule
+      services:
+        - name: proxmox-external
+          port: 8006
+          scheme: https
+          serversTransport: proxmox-insecure

services/external-proxmox/service.yaml

@@ -0,0 +1,33 @@
+# Service zonder selector: Kubernetes maakt zelf geen endpoints aan.
+# Het Endpoints-object hieronder levert het externe adres (Proxmox, buiten het cluster).
+# De endpoints-controller mirrored dit automatisch naar een EndpointSlice.
+# (Een handmatige discovery.k8s.io/v1 EndpointSlice faalt op deze cluster met
+#  kubectl 1.31 tegen server 1.36: "unknown field spec" — daher v1 Endpoints.)
+# Let op: ArgoCD trackt Endpoints/EndpointSlice niet — apply deze file handmatig
+# als het endpoint ontbreekt:
+#   kubectl apply -f services/external-proxmox/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: proxmox-external
+  namespace: external
+spec:
+  type: ClusterIP
+  ports:
+    - name: https
+      port: 8006
+      targetPort: 8006
+      protocol: TCP
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: proxmox-external
+  namespace: external
+subsets:
+  - addresses:
+      - ip: 192.168.2.64
+    ports:
+      - name: https
+        port: 8006
+        protocol: TCP

services/external-sonarqube/cert.yaml

@@ -0,0 +1,11 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: external-sonarqube-labzand
+  namespace: external
+spec:
+  secretName: external-sonarqube-labzand-tls
+  dnsNames: ["sonarqube.labzand.com"]
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer

services/external-sonarqube/ingress.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: external-sonarqube
+  namespace: external
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: sonarqube.labzand.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: sonarqube-external
+            port:
+              number: 9000
+  tls:
+  - hosts:
+    - sonarqube.labzand.com
+    secretName: external-sonarqube-labzand-tls

services/external-sonarqube/ingressroute-redirect.yaml

@@ -0,0 +1,16 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: external-sonarqube-redirect
+  namespace: external
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`sonarqube.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService

services/external-sonarqube/service.yaml

@@ -0,0 +1,27 @@
+# Service zonder selector: Kubernetes maakt zelf geen Endpoints aan.
+# Het Endpoints-object hieronder levert het externe adres (buiten het cluster).
+apiVersion: v1
+kind: Service
+metadata:
+  name: sonarqube-external
+  namespace: external
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 9000
+      targetPort: 9000
+      protocol: TCP
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: sonarqube-external
+  namespace: external
+subsets:
+  - addresses:
+      - ip: 192.168.2.49
+    ports:
+      - name: http
+        port: 9000
+        protocol: TCP

services/external/external-autotune/cert.yaml

@@ -0,0 +1,11 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: external-autotune-labzand
+  namespace: external
+spec:
+  secretName: external-autotune-labzand-tls
+  dnsNames: ["autotune.labzand.com"]
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer

services/external/external-autotune/ingressroute-redirect.yaml

@@ -0,0 +1,16 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: external-autotune-redirect
+  namespace: external
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`autotune.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService

services/external/external-autotune/ingressroute.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: external-autotune
+  namespace: external
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: autotune.labzand.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: autotune-external
+            port:
+              number: 8502
+  tls:
+  - hosts:
+    - autotune.labzand.com
+    secretName: external-autotune-labzand-tls

services/external/external-autotune/service.yaml

@@ -0,0 +1,27 @@
+# Service zonder selector: Kubernetes maakt zelf geen Endpoints aan.
+# Het Endpoints-object hieronder levert het externe adres (buiten het cluster).
+apiVersion: v1
+kind: Service
+metadata:
+  name: autotune-external
+  namespace: external
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 8502
+      targetPort: 8502
+      protocol: TCP
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: autotune-external
+  namespace: external
+subsets:
+  - addresses:
+      - ip: 192.168.2.51
+    ports:
+      - name: http
+        port: 8502
+        protocol: TCP

services/external/external-beszel/cert.yaml

@@ -0,0 +1,11 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: external-beszel-labzand
+  namespace: external
+spec:
+  secretName: external-beszel-labzand-tls
+  dnsNames: ["beszel.labzand.com"]
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer

services/external/external-beszel/ingressroute-redirect.yaml

@@ -0,0 +1,16 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: external-beszel-redirect
+  namespace: external
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`beszel.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService

services/external/external-beszel/ingressroute.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: external-beszel
+  namespace: external
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: beszel.labzand.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: beszel-external
+            port:
+              number: 8090
+  tls:
+  - hosts:
+    - beszel.labzand.com
+    secretName: external-beszel-labzand-tls

services/external/external-beszel/service.yaml

@@ -0,0 +1,27 @@
+# Service zonder selector: Kubernetes maakt zelf geen Endpoints aan.
+# Het Endpoints-object hieronder levert het externe adres (buiten het cluster).
+apiVersion: v1
+kind: Service
+metadata:
+  name: beszel-external
+  namespace: external
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 8090
+      targetPort: 8090
+      protocol: TCP
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: beszel-external
+  namespace: external
+subsets:
+  - addresses:
+      - ip: 192.168.2.61
+    ports:
+      - name: http
+        port: 8090
+        protocol: TCP

services/external/external-firefly/cert.yaml

@@ -0,0 +1,11 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: external-firefly-labzand
+  namespace: external
+spec:
+  secretName: external-firefly-labzand-tls
+  dnsNames: ["firefly.labzand.com"]
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer

services/external/external-firefly/ingressroute-redirect.yaml

@@ -0,0 +1,16 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: external-firefly-redirect
+  namespace: external
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`firefly.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService

services/external/external-firefly/ingressroute.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: external-firefly
+  namespace: external
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: firefly.labzand.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: firefly-external
+            port:
+              number: 80
+  tls:
+  - hosts:
+    - firefly.labzand.com
+    secretName: external-firefly-labzand-tls

services/external/external-firefly/service.yaml

@@ -0,0 +1,27 @@
+# Service zonder selector: Kubernetes maakt zelf geen Endpoints aan.
+# Het Endpoints-object hieronder levert het externe adres (buiten het cluster).
+apiVersion: v1
+kind: Service
+metadata:
+  name: firefly-external
+  namespace: external
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80
+      protocol: TCP
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: firefly-external
+  namespace: external
+subsets:
+  - addresses:
+      - ip: 192.168.2.59
+    ports:
+      - name: http
+        port: 80
+        protocol: TCP

services/external/middleware.yaml

@@ -0,0 +1,11 @@
+# Redirect plain HTTP (entrypoint web) naar HTTPS.
+# Op websecure is het scheme al https, dus daar doet deze middleware niets.
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: redirect-https
+  namespace: external
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true