d4ccff518e
Adds Traefik Helm release (kube-system) with ACME HTTP-01 challenge configured for Let's Encrypt, replacing the k3s-disabled bundled Traefik. Migrates all hostnames from *.homelab.local to *.gugagr.xyz and upgrades all ingresses to HTTPS with certresolver=letsencrypt annotations. Adds var.domain (default homelab.local) to Terraform so the domain is a single config point for monitoring and Gitea ingresses. Gateway reads DOMAIN env var at runtime — falls back to homelab.local so local k3d dev continues to work without changes. Co-authored-by: Gonçalo Rodrigues <guga@Goncalos-MacBook-Pro.local> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
42 lines
955 B
HCL
42 lines
955 B
HCL
resource "helm_release" "traefik" {
|
|
name = "traefik"
|
|
namespace = "kube-system"
|
|
repository = "https://traefik.github.io/charts"
|
|
chart = "traefik"
|
|
version = "~> 33.0"
|
|
atomic = true
|
|
|
|
values = [yamlencode({
|
|
ports = {
|
|
web = {
|
|
redirectTo = { port = "websecure" }
|
|
}
|
|
}
|
|
|
|
ingressRoute = {
|
|
dashboard = { enabled = false }
|
|
}
|
|
|
|
additionalArguments = [
|
|
"--certificatesresolvers.letsencrypt.acme.email=goncalo.gr@proton.me",
|
|
"--certificatesresolvers.letsencrypt.acme.storage=/data/acme.json",
|
|
"--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web",
|
|
]
|
|
|
|
persistence = {
|
|
enabled = true
|
|
size = "128Mi"
|
|
storageClass = "local-path"
|
|
}
|
|
|
|
service = {
|
|
type = "LoadBalancer"
|
|
}
|
|
|
|
resources = {
|
|
requests = { cpu = "50m", memory = "64Mi" }
|
|
limits = { cpu = "200m", memory = "128Mi" }
|
|
}
|
|
})]
|
|
}
|