feat: migrate ingresses to nginx

cluster/apps/data/bookstack/helm-release.yaml

@@ -59,9 +59,10 @@ spec:
     ingress:
       main:
         enabled: true
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
+          # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
         hosts:
           - host: bookstack.${SECRET_CLUSTER_DOMAIN}
             paths:

cluster/apps/data/freshrss/helm-release.yaml

@@ -42,8 +42,9 @@ spec:
     ingress:
       main:
         enabled: true
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         annotations:
+          kubernetes.io/ingress.class: "nginx"
           traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
         hosts:
           - host: freshrss.${SECRET_CLUSTER_DOMAIN}

cluster/apps/data/homer/helm-release.yaml

@@ -40,10 +40,11 @@ spec:
     ingress:
       main:
         enabled: true
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
-          traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd
+          # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          # traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd
         hosts:
           - host: "homer.${SECRET_CLUSTER_DOMAIN}"
             paths:
@@ -70,10 +71,11 @@ spec:
           - "/www/assets/.vscode"
         ingress:
           enabled: true
-          ingressClassName: "traefik"
+          # ingressClassName: "traefik"
           annotations:
-            traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+            kubernetes.io/ingress.class: "nginx"
-            traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd
+            # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+            # traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd
           hosts:
             - host: "homer-config.${SECRET_CLUSTER_DOMAIN}"
               paths:

cluster/apps/data/joplin-server/helm-release.yaml

@@ -41,9 +41,10 @@ spec:
     ingress:
       main:
         enabled: true
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
+          # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
         hosts:
           - host: "joplin.${SECRET_CLUSTER_DOMAIN}"
             paths:

cluster/apps/data/pgadmin/helm-release.yaml

@@ -28,8 +28,9 @@ spec:
     ingress:
       enabled: true
       annotations:
-        traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+        kubernetes.io/ingress.class: "nginx"
-        traefik.ingress.kubernetes.io/router.middlewares: networking-buffering-medium@kubernetescrd
+        # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+        # traefik.ingress.kubernetes.io/router.middlewares: networking-buffering-medium@kubernetescrd
       hosts:
         - host: "pgadmin.${SECRET_CLUSTER_DOMAIN}"
           paths:
@@ -39,13 +40,13 @@ spec:
         - hosts:
             - "pgadmin.${SECRET_CLUSTER_DOMAIN}"
           secretName: "${SECRET_CLUSTER_CERTIFICATE_DEFAULT}"
-  postRenderers:
+  # postRenderers:
-    - kustomize:
+  #   - kustomize:
-        patchesJson6902:
+  #       patchesJson6902:
-          - target:
+  #         - target:
-              kind: Ingress
+  #             kind: Ingress
-              name: pgadmin-pgadmin4
+  #             name: pgadmin-pgadmin4
-            patch:
+  #           patch:
-              - op: add
+  #             - op: add
-                path: /spec/ingressClassName
+  #               path: /spec/ingressClassName
-                value: traefik
+  #               value: traefik

cluster/apps/data/recipes/helm-release.yaml

@@ -62,10 +62,11 @@ spec:
     ingress:
       main:
         enabled: true
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
-          traefik.ingress.kubernetes.io/router.middlewares: networking-buffering-small@kubernetescrd
+          # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          # traefik.ingress.kubernetes.io/router.middlewares: networking-buffering-small@kubernetescrd
         hosts:
           - host: "recipes.${SECRET_CLUSTER_DOMAIN}"
             paths:

cluster/apps/data/resilio-sync/statefulset.yaml

@@ -206,14 +206,15 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   annotations:
-    traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+    kubernetes.io/ingress.class: "nginx"
+    # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
   labels:
     app.kubernetes.io/instance: resilio-sync
     app.kubernetes.io/name: resilio-sync
   name: resilio-sync
   namespace: data
 spec:
-  ingressClassName: "traefik"
+  # ingressClassName: "traefik"
   tls:
     - hosts:
         - "resilio-sync-claude.${SECRET_CLUSTER_DOMAIN}"

cluster/apps/data/sharry/helm-release.yaml

@@ -114,10 +114,11 @@ spec:
     ingress:
       main:
         enabled: true
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
-          traefik.ingress.kubernetes.io/router.middlewares: networking-buffering-large@kubernetescrd
+          # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          # traefik.ingress.kubernetes.io/router.middlewares: networking-buffering-large@kubernetescrd
         hosts:
           - host: "sharry.${SECRET_CLUSTER_DOMAIN}"
             paths:

cluster/apps/data/vaultwarden/helm-release.yaml

@@ -52,9 +52,10 @@ spec:
     ingress:
       main:
         enabled: true
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
+          # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
         hosts:
           - host: "vaultwarden.${SECRET_CLUSTER_DOMAIN}"
             paths:

cluster/apps/data/vikunja/helm-release.yaml

@@ -42,9 +42,10 @@ spec:
     ingress:
       main:
         enabled: true
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
+          # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
         hosts:
           - host: "vikunja.${SECRET_CLUSTER_DOMAIN}"
             paths:

cluster/apps/data/wallabag/helm-release.yaml

@@ -63,9 +63,10 @@ spec:
     ingress:
       main:
         enabled: true
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
+          # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
         hosts:
           - host: "wallabag.${SECRET_CLUSTER_DOMAIN}"
             paths:

cluster/apps/development/docker-registry/helm-release.yaml

@@ -40,8 +40,12 @@ spec:
     ingress:
       enabled: true
       annotations:
-        traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+        kubernetes.io/ingress.class: "nginx"
-        traefik.ingress.kubernetes.io/router.middlewares: networking-buffering-large@kubernetescrd
+        nginx.ingress.kubernetes.io/proxy-body-size: "0"
+        nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
+        nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
+        # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+        # traefik.ingress.kubernetes.io/router.middlewares: networking-buffering-large@kubernetescrd
       hosts:
         - "registry.${SECRET_CLUSTER_DOMAIN}"
       tls:
@@ -49,13 +53,13 @@ spec:
             - "registry.${SECRET_CLUSTER_DOMAIN}"
           secretName: "${SECRET_CLUSTER_CERTIFICATE_DEFAULT}"
 
-  postRenderers:
+  # postRenderers:
-    - kustomize:
+  #   - kustomize:
-        patchesJson6902:
+  #       patchesJson6902:
-          - target:
+  #         - target:
-              kind: Ingress
+  #             kind: Ingress
-              name: docker-registry
+  #             name: docker-registry
-            patch:
+  #           patch:
-              - op: add
+  #             - op: add
-                path: /spec/ingressClassName
+  #               path: /spec/ingressClassName
-                value: traefik
+  #               value: traefik

cluster/apps/development/drone/helm-release.yaml

@@ -45,7 +45,8 @@ spec:
     ingress:
       enabled: true
       annotations:
-        traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+        kubernetes.io/ingress.class: "nginx"
+        # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
       hosts:
         - host: "drone.${SECRET_CLUSTER_DOMAIN}"
           paths: ["/"]
@@ -53,13 +54,11 @@ spec:
         - hosts:
             - "wallabag.${SECRET_CLUSTER_DOMAIN}"
           secretName: "${SECRET_CLUSTER_CERTIFICATE_DEFAULT}"
-  postRenderers:
+  # postRenderers:
-    - kustomize:
+  #   - kustomize:
-        patchesJson6902:
+  #       patchesJson6902:
-          - target:
+  #             name: drone
-              kind: Ingress
+  #           patch:
-              name: drone
+  #             - op: add
-            patch:
+  #               path: /spec/ingressClassName
-              - op: add
+  #               value: traefik
-                path: /spec/ingressClassName
-                value: traefik

cluster/apps/development/gitea/helm-release.yaml

@@ -88,7 +88,8 @@ spec:
     ingress:
       enabled: true
       annotations:
-        traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+        kubernetes.io/ingress.class: "nginx"
+        # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
       hosts:
         - host: "gitea.${SECRET_CLUSTER_DOMAIN}"
           paths:
@@ -99,13 +100,13 @@ spec:
             - "gitea.${SECRET_CLUSTER_DOMAIN}"
           secretName: "${SECRET_CLUSTER_CERTIFICATE_DEFAULT}"
 
-  postRenderers:
+  # postRenderers:
-    - kustomize:
+  #   - kustomize:
-        patchesJson6902:
+  #       patchesJson6902:
-          - target:
+  #         - target:
-              kind: Ingress
+  #             kind: Ingress
-              name: gitea
+  #             name: gitea
-            patch:
+  #           patch:
-              - op: add
+  #             - op: add
-                path: /spec/ingressClassName
+  #               path: /spec/ingressClassName
-                value: traefik
+  #               value: traefik

cluster/apps/home-automation/emqx/helm-release.yaml

@@ -61,7 +61,8 @@ spec:
       dashboard:
         enabled: true
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
+          # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
         path: /
         hosts:
           - emqx.${SECRET_CLUSTER_DOMAIN}
@@ -102,10 +103,10 @@ spec:
                 path: /spec/externalIPs
                 value:
                   - "${CLUSTER_LB_EMQX}"
-          - target:
+          # - target:
-              kind: Ingress
+          #     kind: Ingress
-              name: emqx-dashboard
+          #     name: emqx-dashboard
-            patch:
+          #   patch:
-              - op: add
+          #     - op: add
-                path: /spec/ingressClassName
+          #       path: /spec/ingressClassName
-                value: traefik
+          #       value: traefik

cluster/apps/home-automation/frigate/helm-release.yaml

@@ -95,10 +95,13 @@ spec:
     ingress:
       main:
         enabled: true
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
-          traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd
+          nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local/api/verify"
+          nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}"
+          # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          # traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd
         hosts:
           - host: "frigate.${SECRET_CLUSTER_DOMAIN}"
             paths:

cluster/apps/home-automation/home-assistant/helm-release.yaml

@@ -47,9 +47,10 @@ spec:
     ingress:
       main:
         enabled: true
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
+          # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
         hosts:
           - host: "hass.${SECRET_CLUSTER_DOMAIN}"
             paths:
@@ -101,10 +102,13 @@ spec:
           - "/config/.vscode"
         ingress:
           enabled: true
-          ingressClassName: "traefik"
+          # ingressClassName: "traefik"
           annotations:
-            traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
-            traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd
+          nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local/api/verify"
+          nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}"
+            # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+            # traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd
           hosts:
             - host: "hass-config.${SECRET_CLUSTER_DOMAIN}"
               paths:

cluster/apps/home-automation/zigbee2mqtt/helm-release.yaml

@@ -73,10 +73,13 @@ spec:
     ingress:
       main:
         enabled: true
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
-          traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd
+          nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local/api/verify"
+          nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}"
+          # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          # traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd
         hosts:
           - host: "zigbee.${SECRET_CLUSTER_DOMAIN}"
             paths:

cluster/apps/home-automation/zwavejs2mqtt/helm-release.yaml

@@ -37,10 +37,13 @@ spec:
     ingress:
       main:
         enabled: true
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
-          traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd
+          nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local/api/verify"
+          nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}"
+          # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          # traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd
         hosts:
           - host: zwave.${SECRET_CLUSTER_DOMAIN}
             paths:

cluster/apps/kasten-io/k10/helm-release.yaml

@@ -33,17 +33,18 @@ spec:
       create: true
       host: "k10.${SECRET_CLUSTER_DOMAIN}"
       annotations:
-        traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+        kubernetes.io/ingress.class: "nginx"
+        # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
       urlPath: k10
       hosts:
         - "k10.${SECRET_CLUSTER_DOMAIN}"
-  postRenderers:
+  # postRenderers:
-    - kustomize:
+  #   - kustomize:
-        patchesJson6902:
+  #       patchesJson6902:
-          - target:
+  #         - target:
-              kind: Ingress
+  #             kind: Ingress
-              name: k10-ingress
+  #             name: k10-ingress
-            patch:
+  #           patch:
-              - op: add
+  #             - op: add
-                path: /spec/ingressClassName
+  #               path: /spec/ingressClassName
-                value: traefik
+  #               value: traefik

cluster/apps/media/bazarr/helm-release.yaml

@@ -48,10 +48,17 @@ spec:
     ingress:
       main:
         enabled: true
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
-          traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd, networking-buffering-small@kubernetescrd
+          nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local/api/verify"
+          nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}"
+          nginx.ingress.kubernetes.io/configuration-snippet: |
+            proxy_set_header Accept-Encoding "";
+            sub_filter '</head>' '<link rel="stylesheet" type="text/css" href="https://gilbn.github.io/theme.park/CSS/themes/bazarr/space-gray.css"></head>';
+            sub_filter_once on;
+          # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          # traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd, networking-buffering-small@kubernetescrd
         hosts:
           - host: "bazarr.${SECRET_CLUSTER_DOMAIN}"
             paths:

cluster/apps/media/flood/helm-release.yaml

@@ -48,10 +48,17 @@ spec:
     ingress:
       main:
         enabled: true
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
-          traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd
+          nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local/api/verify"
+          nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}"
+          nginx.ingress.kubernetes.io/configuration-snippet: |
+            proxy_set_header Accept-Encoding "";
+            sub_filter '</head>' '<link rel="stylesheet" type="text/css" href="https://gilbn.github.io/theme.park/CSS/themes/flood/space-gray.css"></head>';
+            sub_filter_once on;
+          # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          # traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd
         hosts:
           - host: flood.${SECRET_CLUSTER_DOMAIN}
             paths:

cluster/apps/media/jellyfin/helm-release.yaml

@@ -48,9 +48,10 @@ spec:
     ingress:
       main:
         enabled: true
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
+        #  traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
         hosts:
           - host: "jellyfin.${SECRET_CLUSTER_DOMAIN}"
             paths:

cluster/apps/media/lidarr/helm-release.yaml

@@ -56,10 +56,17 @@ spec:
     ingress:
       main:
         enabled: true
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
-          traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd, networking-buffering-small@kubernetescrd
+          nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local/api/verify"
+          nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}"
+          nginx.ingress.kubernetes.io/configuration-snippet: |
+            proxy_set_header Accept-Encoding "";
+            sub_filter '</head>' '<link rel="stylesheet" type="text/css" href="https://gilbn.github.io/theme.park/CSS/themes/lidarr/space-gray.css"></head>';
+            sub_filter_once on;
+          # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          # traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd, networking-buffering-small@kubernetescrd
         hosts:
           - host: "lidarr.${SECRET_CLUSTER_DOMAIN}"
             paths:
@@ -70,9 +77,10 @@ spec:
               - "lidarr.${SECRET_CLUSTER_DOMAIN}"
       api:
         enabled: true
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
+          # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
         hosts:
           - host: "lidarr.${SECRET_CLUSTER_DOMAIN}"
             paths:

cluster/apps/media/lychee/helm-release.yaml

@@ -51,8 +51,9 @@ spec:
     ingress:
       main:
         enabled: true
-        ingressClassName: "nginx"
+        # ingressClassName: "traefik"
-        # annotations:
+        annotations:
+          kubernetes.io/ingress.class: "nginx"
         #   traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
         hosts:
           - host: "lychee.${SECRET_CLUSTER_DOMAIN}"

cluster/apps/media/navidrome/helm-release.yaml

@@ -48,9 +48,10 @@ spec:
     ingress:
       main:
         enabled: true
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
+          # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
         hosts:
           - host: "navidrome.${SECRET_CLUSTER_DOMAIN}"
             paths:

cluster/apps/media/prowlarr/helm-release.yaml

@@ -39,10 +39,17 @@ spec:
     ingress:
       main:
         enabled: true
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
-          traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd, networking-buffering-small@kubernetescrd
+          nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local/api/verify"
+          nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}"
+          nginx.ingress.kubernetes.io/configuration-snippet: |
+            proxy_set_header Accept-Encoding "";
+            sub_filter '</head>' '<link rel="stylesheet" type="text/css" href="https://gilbn.github.io/theme.park/CSS/themes/prowlarr/space-gray.css"></head>';
+            sub_filter_once on;
+          # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          # traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd, networking-buffering-small@kubernetescrd
         hosts:
           - host: "prowlarr.${SECRET_CLUSTER_DOMAIN}"
             paths:

cluster/apps/media/pyload/helm-release.yaml

@@ -43,9 +43,12 @@ spec:
     ingress:
       main:
         enabled: true
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
+          nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local/api/verify"
+          nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}"
+          # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
         hosts:
           - host: "pyload.${SECRET_CLUSTER_DOMAIN}"
             paths:

cluster/apps/media/qbittorrent/helm-release.yaml

@@ -63,9 +63,14 @@ spec:
     ingress:
       main:
         enabled: true
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
+          nginx.ingress.kubernetes.io/configuration-snippet: |
+            proxy_set_header Accept-Encoding "";
+            sub_filter '</head>' '<link rel="stylesheet" type="text/css" href="https://gilbn.github.io/theme.park/CSS/themes/qbittorrent/space-gray.css"></head>';
+            sub_filter_once on;
+        #  traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
         hosts:
           - host: "qbittorrent.${SECRET_CLUSTER_DOMAIN}"
             paths:

cluster/apps/media/radarr/helm-release.yaml

@@ -53,10 +53,17 @@ spec:
     ingress:
       main:
         enabled: true
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
-          traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd, networking-buffering-small@kubernetescrd
+          nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local/api/verify"
+          nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}"
+          nginx.ingress.kubernetes.io/configuration-snippet: |
+            proxy_set_header Accept-Encoding "";
+            sub_filter '</head>' '<link rel="stylesheet" type="text/css" href="https://gilbn.github.io/theme.park/CSS/themes/radarr/space-gray.css"></head>';
+            sub_filter_once on;
+          # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          # traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd, networking-buffering-small@kubernetescrd
         hosts:
           - host: "radarr.${SECRET_CLUSTER_DOMAIN}"
             paths:
@@ -67,9 +74,10 @@ spec:
               - "radarr.${SECRET_CLUSTER_DOMAIN}"
       api:
         enabled: true
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
+        #  traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
         hosts:
           - host: "radarr.${SECRET_CLUSTER_DOMAIN}"
             paths:

cluster/apps/media/readarr/helm-release.yaml

@@ -48,10 +48,17 @@ spec:
     ingress:
       main:
         enabled: true
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
-          traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd, networking-buffering-small@kubernetescrd
+          nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local/api/verify"
+          nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}"
+          nginx.ingress.kubernetes.io/configuration-snippet: |
+            proxy_set_header Accept-Encoding "";
+            sub_filter '</head>' '<link rel="stylesheet" type="text/css" href="https://gilbn.github.io/theme.park/CSS/themes/readarr/space-gray.css"></head>';
+            sub_filter_once on;
+          # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          # traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd, networking-buffering-small@kubernetescrd
         hosts:
           - host: "readarr.${SECRET_CLUSTER_DOMAIN}"
             paths:
@@ -62,9 +69,10 @@ spec:
               - "readarr.${SECRET_CLUSTER_DOMAIN}"
       api:
         enabled: true
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
+        #  traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
         hosts:
           - host: "readarr.${SECRET_CLUSTER_DOMAIN}"
             paths:

cluster/apps/media/sabnzbd/helm-release.yaml

@@ -46,10 +46,17 @@ spec:
     ingress:
       main:
         enabled: true
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
-          traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd, networking-buffering-small@kubernetescrd
+          nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local/api/verify"
+          nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}"
+          nginx.ingress.kubernetes.io/configuration-snippet: |
+            proxy_set_header Accept-Encoding "";
+            sub_filter '</head>' '<link rel="stylesheet" type="text/css" href="https://gilbn.github.io/theme.park/CSS/themes/sabnzbd/space-gray.css"></head>';
+            sub_filter_once on;
+          # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          # traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd, networking-buffering-small@kubernetescrd
         hosts:
           - host: "sabnzbd.${SECRET_CLUSTER_DOMAIN}"
             paths:
@@ -60,10 +67,11 @@ spec:
               - "sabnzbd.${SECRET_CLUSTER_DOMAIN}"
       api:
         enabled: true
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         nameSuffix: "api"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
+        #  traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
         hosts:
           - host: "sabnzbd.${SECRET_CLUSTER_DOMAIN}"
             paths:

cluster/apps/media/sonarr/helm-release.yaml

@@ -51,10 +51,17 @@ spec:
     ingress:
       main:
         enabled: true
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
-          traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd, networking-buffering-small@kubernetescrd
+          nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local/api/verify"
+          nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}"
+          nginx.ingress.kubernetes.io/configuration-snippet: |
+            proxy_set_header Accept-Encoding "";
+            sub_filter '</head>' '<link rel="stylesheet" type="text/css" href="https://gilbn.github.io/theme.park/CSS/themes/sonarr/space-gray.css"></head>';
+            sub_filter_once on;
+          # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          # traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd, networking-buffering-small@kubernetescrd
         hosts:
           - host: "sonarr.${SECRET_CLUSTER_DOMAIN}"
             paths:
@@ -65,9 +72,10 @@ spec:
               - "sonarr.${SECRET_CLUSTER_DOMAIN}"
       api:
         enabled: true
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
+        #   traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
         hosts:
           - host: "sonarr.${SECRET_CLUSTER_DOMAIN}"
             paths:

cluster/apps/media/tdarr/helm-release.yaml

@@ -62,10 +62,13 @@ spec:
     ingress:
       main:
         enabled: true
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
-          traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd
+          nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local/api/verify"
+          nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}"
+          # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          # traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd
         hosts:
           - host: "tdarr.${SECRET_CLUSTER_DOMAIN}"
             paths:

cluster/apps/media/travelstories/deployment.yaml

@@ -75,15 +75,18 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   annotations:
-    traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+    kubernetes.io/ingress.class: "nginx"
-    traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd, networking-buffering-small@kubernetescrd
+    nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local/api/verify"
+    nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}"
+    # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+    # traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd, networking-buffering-small@kubernetescrd
   labels:
     app.kubernetes.io/instance: travelstories
     app.kubernetes.io/name: travelstories
   name: travelstories
   namespace: media
 spec:
-  ingressClassName: "traefik"
+  # ingressClassName: "traefik"
   rules:
     - host: "travelstories.${SECRET_CLUSTER_DOMAIN}"
       http:

cluster/apps/monitoring/blackbox-exporter/helm-release.yaml

@@ -91,8 +91,11 @@ spec:
     ingress:
       enabled: true
       annotations:
-        traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+        kubernetes.io/ingress.class: "nginx"
-        traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd
+        nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local/api/verify"
+        nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}"
+        # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+        # traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd
       hosts:
         - host: "blackbox.${SECRET_CLUSTER_DOMAIN}"
           paths:
@@ -103,13 +106,13 @@ spec:
             - "blackbox.${SECRET_CLUSTER_DOMAIN}"
           secretName: "${SECRET_CLUSTER_CERTIFICATE_DEFAULT}"
 
-  postRenderers:
+  # postRenderers:
-    - kustomize:
+  #   - kustomize:
-        patchesJson6902:
+  #       patchesJson6902:
-          - target:
+  #         - target:
-              kind: Ingress
+  #             kind: Ingress
-              name: blackbox-exporter-prometheus-blackbox-exporter
+  #             name: blackbox-exporter-prometheus-blackbox-exporter
-            patch:
+  #           patch:
-              - op: add
+  #             - op: add
-                path: /spec/ingressClassName
+  #               path: /spec/ingressClassName
-                value: traefik
+  #               value: traefik

cluster/apps/monitoring/healthchecks/helm-release.yaml

@@ -54,9 +54,12 @@ spec:
     ingress:
       main:
         enabled: true
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
+          nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local/api/verify"
+          nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}"
+          # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
         hosts:
           - host: "healthchecks.${SECRET_CLUSTER_DOMAIN}"
             paths:

cluster/apps/monitoring/kube-prometheus-stack/helm-release.yaml

@@ -32,10 +32,13 @@ spec:
       ingress:
         enabled: true
         pathType: Prefix
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
-          traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd
+          nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local/api/verify"
+          nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}"
+          # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          # traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd
         hosts: ["alert-manager.${SECRET_CLUSTER_DOMAIN}"]
       config:
         global:
@@ -194,9 +197,10 @@ spec:
       ingress:
         enabled: true
         pathType: Prefix
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
+          # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
         hosts: ["grafana.${SECRET_CLUSTER_DOMAIN}"]
     kubeEtcd:
       enabled: false
@@ -210,10 +214,13 @@ spec:
       ingress:
         enabled: true
         pathType: Prefix
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
-          traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd
+          nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local/api/verify"
+          nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}"
+          # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          # traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd
         hosts: ["prometheus.${SECRET_CLUSTER_DOMAIN}"]
       prometheusSpec:
         replicas: 2

cluster/apps/monitoring/thanos/helm-release.yaml

@@ -29,8 +29,11 @@ spec:
         enabled: true
         hostname: "thanos.${SECRET_CLUSTER_DOMAIN}"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
-          traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd
+          nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local/api/verify"
+          nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}"
+          # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          # traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd
         tls: false
     queryFrontend:
       enabled: false
@@ -58,13 +61,13 @@ spec:
         secret_key: "${SECRET_MINIO_SECRET_KEY}"
         insecure: false
 
-  postRenderers:
+  # postRenderers:
-    - kustomize:
+  #   - kustomize:
-        patchesJson6902:
+  #       patchesJson6902:
-          - target:
+  #         - target:
-              kind: Ingress
+  #             kind: Ingress
-              name: thanos-query
+  #             name: thanos-query
-            patch:
+  #           patch:
-              - op: add
+  #             - op: add
-                path: /spec/ingressClassName
+  #               path: /spec/ingressClassName
-                value: traefik
+  #               value: traefik

cluster/apps/monitoring/uptime-kuma/statefulset.yaml

@@ -68,14 +68,15 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   annotations:
-    traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+    kubernetes.io/ingress.class: "nginx"
+    # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
   labels:
     app.kubernetes.io/instance: uptime-kuma
     app.kubernetes.io/name: uptime-kuma
   name: uptime-kuma
   namespace: monitoring
 spec:
-  ingressClassName: "traefik"
+  # ingressClassName: "traefik"
   rules:
     - host: "uptime-kuma.${SECRET_CLUSTER_DOMAIN}"
       http:

cluster/apps/networking/authelia/helm-release.yaml

@@ -28,7 +28,8 @@ spec:
     ingress:
       enabled: true
       annotations:
-        traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+        kubernetes.io/ingress.class: "nginx"
+        # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
       subdomain: login
 
       tls:

cluster/apps/networking/authentik/helm-release.yaml

@@ -23,9 +23,10 @@ spec:
 
     ingress:
       enabled: true
-      ingressClassName: "traefik"
+      # ingressClassName: "traefik"
       annotations:
-        traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+        kubernetes.io/ingress.class: "nginx"
+        # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
       hosts:
         - host: "id.${SECRET_CLUSTER_DOMAIN}"
           paths:

cluster/apps/networking/unifi/helm-release.yaml

@@ -38,10 +38,11 @@ spec:
     ingress:
       main:
         enabled: true
-        ingressClassName: "traefik"
+        # ingressClassName: "traefik"
         annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          kubernetes.io/ingress.class: "nginx"
-          traefik.ingress.kubernetes.io/router.middlewares: networking-buffering-medium@kubernetescrd
+          # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          # traefik.ingress.kubernetes.io/router.middlewares: networking-buffering-medium@kubernetescrd
         hosts:
           - host: "unifi.${SECRET_CLUSTER_DOMAIN}"
             paths:

cluster/core/rook-ceph/dashboard/ingress.yaml

@@ -5,12 +5,13 @@ metadata:
   name: rook-ceph-mgr-dashboard
   namespace: rook-ceph
   annotations:
-    traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+    kubernetes.io/ingress.class: "nginx"
+    # traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
   labels:
     app.kubernetes.io/instance: rook-ceph-mgr-dashboard
     app.kubernetes.io/name: rook-ceph-mgr-dashboard
 spec:
-  ingressClassName: "traefik"
+  # ingressClassName: "traefik"
   rules:
     - host: "rook.${SECRET_CLUSTER_DOMAIN}"
       http: