feat: add route to external firefly service

Cloudflare's edge 308-redirects git smart-http info/refs requests when the
record is proxied, breaking git/ArgoCD. DNS-only sends traffic straight to
the router -> node -> Traefik, which terminates TLS with a valid LE cert.

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <[email protected]>

apps/adguard.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.zb-kw.duckdns.org/willemjan/cluster.git
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
     targetRevision: main
     path: services/adguard
   destination:

apps/argocd.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.zb-kw.duckdns.org/willemjan/cluster.git
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
     targetRevision: main
     path: services/argocd
   destination:

apps/authentik.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.zb-kw.duckdns.org/willemjan/cluster.git
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
     targetRevision: main
     path: services/authentik
   destination:

apps/cloudfare-ddns.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.zb-kw.duckdns.org/willemjan/cluster.git
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
     targetRevision: main
     path: services/cloudfare-ddns
   destination:

apps/external-adguard.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.zb-kw.duckdns.org/willemjan/cluster.git
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
     targetRevision: main
     path: services/external-adguard
   destination:

apps/external-autotune.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-autotune
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
+    targetRevision: main
+    path: services/external/external-autotune
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external
+  syncPolicy:
+    automated: {prune: true, selfHeal: true}
+    syncOptions:
+      - CreateNamespace=false

apps/external-beszel.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-beszel
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
+    targetRevision: main
+    path: services/external/external-beszel
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external
+  syncPolicy:
+    automated: {prune: true, selfHeal: true}
+    syncOptions:
+      - CreateNamespace=false

apps/external-firefly.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-firefly
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
+    targetRevision: main
+    path: services/external/external-firefly
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external
+  syncPolicy:
+    automated: {prune: true, selfHeal: true}
+    syncOptions:
+      - CreateNamespace=false

apps/external-gitea.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-gitea
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
+    targetRevision: main
+    path: services/external-gitea
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external
+  syncPolicy:
+    automated: {prune: true, selfHeal: true}
+    syncOptions:
+      - CreateNamespace=false

apps/external-homeassistant.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-homeassistant
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
+    targetRevision: main
+    path: services/external-homeassistant
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external
+  syncPolicy:
+    automated: {prune: true, selfHeal: true}
+    syncOptions:
+      - CreateNamespace=false

apps/external-ns.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.zb-kw.duckdns.org/willemjan/cluster.git
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
     targetRevision: main
     path: services/external-nightscout
   destination:

apps/external-omada.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-omada
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
+    targetRevision: main
+    path: services/external-omada
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external
+  syncPolicy:
+    automated: {prune: true, selfHeal: true}
+    syncOptions:
+      - CreateNamespace=false

apps/external-proxmox.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.zb-kw.duckdns.org/willemjan/cluster.git
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
     targetRevision: main
     path: services/external-proxmox
   destination:

apps/external-sonarqube.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-sonarqube
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
+    targetRevision: main
+    path: services/external-sonarqube
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external
+  syncPolicy:
+    automated: {prune: true, selfHeal: true}
+    syncOptions:
+      - CreateNamespace=false

apps/external.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.zb-kw.duckdns.org/willemjan/cluster.git
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
     targetRevision: main
     path: services/external
   destination:

bootstrap/root-app.yaml

@@ -7,7 +7,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.zb-kw.duckdns.org/willemjan/cluster.git
+    repoURL: https://gitea.labzand.com/willemjan/cluster.git
     targetRevision: main
     path: apps                  # elke yaml hierin = één Application
     directory:

services/cloudfare-ddns/configmap.yaml

@@ -9,5 +9,5 @@ data:
   # Alleen namen die écht publiek bereikbaar moeten zijn (via router -> cluster).
   # Interne-only namen (argocd/auth/adguard.labzand.com) bewust NIET hier:
   # die krijgen geen publiek A-record en resolven alleen intern via AdGuard.
-  DOMAINS: "ns.labzand.com"
+  DOMAINS: "ns.labzand.com, ha.labzand.com, gitea.labzand.com"
   ZONE_ID: "6093605ad5a8db13e9c9d9faad240ca6"

services/cloudfare-ddns/script-configmap.yaml

@@ -84,7 +84,7 @@ data:
         CREATE_RESPONSE=$(curl -s -X POST "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records" \
           -H "Authorization: Bearer $API_TOKEN" \
           -H "Content-Type: application/json" \
-          --data "{\"type\":\"A\",\"name\":\"$DOMAIN\",\"content\":\"$PUBLIC_IP\",\"ttl\":120,\"proxied\":true}")
+          --data "{\"type\":\"A\",\"name\":\"$DOMAIN\",\"content\":\"$PUBLIC_IP\",\"ttl\":120,\"proxied\":false}")
 
         CREATE_SUCCESS=$(echo "$CREATE_RESPONSE" | grep -o '"success":[^,]*' | cut -d':' -f2)
 

services/external-gitea/cert.yaml

@@ -0,0 +1,11 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: gitea-labzand
+  namespace: external
+spec:
+  secretName: gitea-labzand-tls
+  dnsNames: ["gitea.labzand.com"]
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer

services/external-gitea/ingress.yaml

@@ -1,7 +1,7 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: external-proxmox
+  name: gitea
   namespace: external
   annotations:
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
@@ -9,17 +9,17 @@ metadata:
 spec:
   ingressClassName: traefik
   rules:
-  - host: proxmox.labzand.com
+  - host: gitea.labzand.com
-    https:
+    http:
       paths:
       - path: /
         pathType: Prefix
         backend:
           service:
-            name: proxmox-external
+            name: gitea-external
             port:
-              number: 8006
+              number: 3000
   tls:
   - hosts:
-    - proxmox.labzand.com
+    - gitea.labzand.com
-    secretName: external-proxmox-labzand-tls
+    secretName: gitea-labzand-tls

services/external-gitea/ingressroute-redirect.yaml

@@ -0,0 +1,16 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: gitea-redirect
+  namespace: external
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`gitea.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService

services/external-gitea/service.yaml

@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitea-external
+  namespace: external
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 3000
+      targetPort: 3000
+      protocol: TCP
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: gitea-external
+  namespace: external
+subsets:
+  - addresses:
+      - ip: 192.168.2.52
+    ports:
+      - name: http
+        port: 3000
+        protocol: TCP

services/external-homeassistant/cert.yaml

@@ -0,0 +1,14 @@
+# Certificaat voor ns.labzand.com via Cloudflare DNS-01.
+# Vereist: ClusterIssuer 'cloudflare-dns' (infrastructure/cert-manager/cloudflare-issuer.yaml)
+# en een secret 'cloudflare-api-token' in namespace cert-manager.
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: ha-labzand
+  namespace: external
+spec:
+  secretName: ha-labzand-tls
+  dnsNames: ["ha.labzand.com"]
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer

services/external-homeassistant/ingress.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: homeassistant
+  namespace: external
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: ha.labzand.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: ha-external
+            port:
+              number: 8123
+  tls:
+  - hosts:
+    - ha.labzand.com
+    secretName: ha-labzand-tls

services/external-homeassistant/ingressroute-redirect.yaml

@@ -0,0 +1,21 @@
+# HTTP (entrypoint web) -> HTTPS redirect voor ns.labzand.com.
+# De Ingress zelf heeft een tls-sectie, waardoor Traefik die router alleen
+# op websecure matcht; daarom hier een aparte router op web.
+# services: api@internal is een dummy - de redirect middleware stuurt
+# nooit door naar een backend.
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: ha-redirect
+  namespace: external
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`ha.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService

services/external-homeassistant/service.yaml

@@ -0,0 +1,27 @@
+# Service zonder selector: Kubernetes maakt zelf geen Endpoints aan.
+# Het Endpoints-object hieronder levert het externe adres (buiten het cluster).
+apiVersion: v1
+kind: Service
+metadata:
+  name: ha-external
+  namespace: external
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 8123
+      targetPort: 8123
+      protocol: TCP
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: ha-external
+  namespace: external
+subsets:
+  - addresses:
+      - ip: 192.168.2.146
+    ports:
+      - name: http
+        port: 8123
+        protocol: TCP

services/external-omada/cert.yaml

@@ -0,0 +1,11 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: external-omada-labzand
+  namespace: external
+spec:
+  secretName: external-omada-labzand-tls
+  dnsNames: ["omada.labzand.com"]
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer

services/external-omada/ingressroute-redirect.yaml

@@ -0,0 +1,16 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: external-omada-redirect
+  namespace: external
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`omada.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService

services/external-omada/ingressroute.yaml

@@ -0,0 +1,29 @@
+# omada (:8043) spricht HTTPS met een self-signed cert — daarom een
+# IngressRoute (i.p.v. een plain Ingress, die altijd HTTP naar de backend praat)
+# met scheme: https en een ServersTransport die het cert niet checkt.
+apiVersion: traefik.io/v1alpha1
+kind: ServersTransport
+metadata:
+  name: omada-insecure
+  namespace: external
+spec:
+  insecureSkipVerify: true
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: external-omada
+  namespace: external
+spec:
+  entryPoints:
+    - websecure
+  tls:
+    secretName: external-omada-labzand-tls
+  routes:
+    - match: Host(`omada.labzand.com`)
+      kind: Rule
+      services:
+        - name: omada-external
+          port: 8043
+          scheme: https
+          serversTransport: omada-insecure

services/external-omada/service.yaml

@@ -0,0 +1,27 @@
+# Service zonder selector: Kubernetes maakt zelf geen Endpoints aan.
+# Het Endpoints-object hieronder levert het externe adres (buiten het cluster).
+apiVersion: v1
+kind: Service
+metadata:
+  name: omada-external
+  namespace: external
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 8043
+      targetPort: 8043
+      protocol: TCP
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: omada-external
+  namespace: external
+subsets:
+  - addresses:
+      - ip: 192.168.2.62
+    ports:
+      - name: http
+        port: 8043
+        protocol: TCP

services/external-proxmox/ingressroute.yaml

@@ -0,0 +1,29 @@
+# Proxmox (:8006) spricht HTTPS met een self-signed cert — daarom een
+# IngressRoute (i.p.v. een plain Ingress, die altijd HTTP naar de backend praat)
+# met scheme: https en een ServersTransport die het cert niet checkt.
+apiVersion: traefik.io/v1alpha1
+kind: ServersTransport
+metadata:
+  name: proxmox-insecure
+  namespace: external
+spec:
+  insecureSkipVerify: true
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: external-proxmox
+  namespace: external
+spec:
+  entryPoints:
+    - websecure
+  tls:
+    secretName: external-proxmox-labzand-tls
+  routes:
+    - match: Host(`proxmox.labzand.com`)
+      kind: Rule
+      services:
+        - name: proxmox-external
+          port: 8006
+          scheme: https
+          serversTransport: proxmox-insecure

services/external-proxmox/service.yaml

@@ -1,5 +1,11 @@
-# Service zonder selector: Kubernetes maakt zelf geen Endpoints aan.
+# Service zonder selector: Kubernetes maakt zelf geen endpoints aan.
-# Het Endpoints-object hieronder levert het externe adres (buiten het cluster).
+# Het Endpoints-object hieronder levert het externe adres (Proxmox, buiten het cluster).
+# De endpoints-controller mirrored dit automatisch naar een EndpointSlice.
+# (Een handmatige discovery.k8s.io/v1 EndpointSlice faalt op deze cluster met
+#  kubectl 1.31 tegen server 1.36: "unknown field spec" — daher v1 Endpoints.)
+# Let op: ArgoCD trackt Endpoints/EndpointSlice niet — apply deze file handmatig
+# als het endpoint ontbreekt:
+#   kubectl apply -f services/external-proxmox/service.yaml
 apiVersion: v1
 kind: Service
 metadata:
@@ -25,17 +31,3 @@ subsets:
       - name: https
         port: 8006
         protocol: TCP
----
-apiVersion: discovery.k8s.io/v1
-kind: EndpointSlice
-metadata:
-  name: proxmox-external
-  namespace: external
-  addressType: IPv4
-ports:
-  - name: https
-    protocol: TCP
-    port: 8006
-endpoints:
-  - addresses:
-      - "192.168.2.64"

services/external-sonarqube/cert.yaml

@@ -0,0 +1,11 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: external-sonarqube-labzand
+  namespace: external
+spec:
+  secretName: external-sonarqube-labzand-tls
+  dnsNames: ["sonarqube.labzand.com"]
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer

services/external-sonarqube/ingress.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: external-sonarqube
+  namespace: external
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: sonarqube.labzand.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: sonarqube-external
+            port:
+              number: 9000
+  tls:
+  - hosts:
+    - sonarqube.labzand.com
+    secretName: external-sonarqube-labzand-tls

services/external-sonarqube/ingressroute-redirect.yaml

@@ -0,0 +1,16 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: external-sonarqube-redirect
+  namespace: external
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`sonarqube.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService

services/external-sonarqube/service.yaml

@@ -0,0 +1,27 @@
+# Service zonder selector: Kubernetes maakt zelf geen Endpoints aan.
+# Het Endpoints-object hieronder levert het externe adres (buiten het cluster).
+apiVersion: v1
+kind: Service
+metadata:
+  name: sonarqube-external
+  namespace: external
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 9000
+      targetPort: 9000
+      protocol: TCP
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: sonarqube-external
+  namespace: external
+subsets:
+  - addresses:
+      - ip: 192.168.2.49
+    ports:
+      - name: http
+        port: 9000
+        protocol: TCP

services/external/external-autotune/cert.yaml

@@ -0,0 +1,11 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: external-autotune-labzand
+  namespace: external
+spec:
+  secretName: external-autotune-labzand-tls
+  dnsNames: ["autotune.labzand.com"]
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer

services/external/external-autotune/ingressroute-redirect.yaml

@@ -0,0 +1,16 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: external-autotune-redirect
+  namespace: external
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`autotune.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService

services/external/external-autotune/ingressroute.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: external-autotune
+  namespace: external
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: autotune.labzand.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: autotune-external
+            port:
+              number: 8502
+  tls:
+  - hosts:
+    - autotune.labzand.com
+    secretName: external-autotune-labzand-tls

services/external/external-autotune/service.yaml

@@ -0,0 +1,27 @@
+# Service zonder selector: Kubernetes maakt zelf geen Endpoints aan.
+# Het Endpoints-object hieronder levert het externe adres (buiten het cluster).
+apiVersion: v1
+kind: Service
+metadata:
+  name: autotune-external
+  namespace: external
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 8502
+      targetPort: 8502
+      protocol: TCP
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: autotune-external
+  namespace: external
+subsets:
+  - addresses:
+      - ip: 192.168.2.51
+    ports:
+      - name: http
+        port: 8502
+        protocol: TCP

services/external/external-beszel/cert.yaml

@@ -0,0 +1,11 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: external-beszel-labzand
+  namespace: external
+spec:
+  secretName: external-beszel-labzand-tls
+  dnsNames: ["beszel.labzand.com"]
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer

services/external/external-beszel/ingressroute-redirect.yaml

@@ -0,0 +1,16 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: external-beszel-redirect
+  namespace: external
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`beszel.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService

services/external/external-beszel/ingressroute.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: external-beszel
+  namespace: external
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: beszel.labzand.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: beszel-external
+            port:
+              number: 8090
+  tls:
+  - hosts:
+    - beszel.labzand.com
+    secretName: external-beszel-labzand-tls

services/external/external-beszel/service.yaml

@@ -0,0 +1,27 @@
+# Service zonder selector: Kubernetes maakt zelf geen Endpoints aan.
+# Het Endpoints-object hieronder levert het externe adres (buiten het cluster).
+apiVersion: v1
+kind: Service
+metadata:
+  name: beszel-external
+  namespace: external
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 8090
+      targetPort: 8090
+      protocol: TCP
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: beszel-external
+  namespace: external
+subsets:
+  - addresses:
+      - ip: 192.168.2.61
+    ports:
+      - name: http
+        port: 8090
+        protocol: TCP

services/external/external-firefly/cert.yaml

@@ -0,0 +1,11 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: external-firefly-labzand
+  namespace: external
+spec:
+  secretName: external-firefly-labzand-tls
+  dnsNames: ["firefly.labzand.com"]
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer

services/external/external-firefly/ingressroute-redirect.yaml

@@ -0,0 +1,16 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: external-firefly-redirect
+  namespace: external
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`firefly.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService

services/external/external-firefly/ingressroute.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: external-firefly
+  namespace: external
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: firefly.labzand.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: firefly-external
+            port:
+              number: 80
+  tls:
+  - hosts:
+    - firefly.labzand.com
+    secretName: external-firefly-labzand-tls

services/external/external-firefly/service.yaml

@@ -0,0 +1,27 @@
+# Service zonder selector: Kubernetes maakt zelf geen Endpoints aan.
+# Het Endpoints-object hieronder levert het externe adres (buiten het cluster).
+apiVersion: v1
+kind: Service
+metadata:
+  name: firefly-external
+  namespace: external
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80
+      protocol: TCP
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: firefly-external
+  namespace: external
+subsets:
+  - addresses:
+      - ip: 192.168.2.59
+    ports:
+      - name: http
+        port: 80
+        protocol: TCP