changed traefik edge to k3s traefik

infrastructure/traefik-edge/configmap-dynamic-k3s.yaml

@@ -0,0 +1,26 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: traefik-edge-dynamic-k3s
+  namespace: traefik-system
+  labels:
+    app.kubernetes.io/name: traefik
+    app.kubernetes.io/component: edge-dynamic
+data:
+  10-k3s.yaml: |
+    tcp:
+      routers:
+        # Alle k3s Domains (inkl. *.apps.internal.*) über TLS Passthrough
+        k3s-passthrough:
+          rule: "HostSNIRegexp(`^.+\\.k3s\\.stabify\\.de$`)"
+          entryPoints:
+            - websecure
+          service: k3s-cluster
+          tls:
+            passthrough: true
+
+      services:
+        k3s-cluster:
+          loadBalancer:
+            servers:
+              - address: "10.100.40.6:443"

infrastructure/traefik-edge/configmap-dynamic-legacy.yaml

@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: traefik-edge-dynamic-legacy
+  namespace: traefik-system
+  labels:
+    app.kubernetes.io/name: traefik
+    app.kubernetes.io/component: edge-dynamic
+data:
+  20-legacy-vm.yaml: |
+    http:
+      routers:
+        # Route für Apps auf VM 301
+        to-apps-vm:
+          rule: HostRegexp(`^[a-z0-9-]+\.apps\.stabify\.de$`)
+          service: apps-vm-service
+          entryPoints: [ websecure ]
+          tls:
+            certResolver: le
+            domains:
+              - main: "*.apps.stabify.de"
+
+      services:
+        apps-vm-service:
+          loadBalancer:
+            servers:
+              - url: "http://vm-docker-apps-301.stabify.de:80"
+            passHostHeader: true

infrastructure/traefik-edge/external-secret-app.yaml

@@ -0,0 +1,26 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: traefik-edge-secrets
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "-3"  # Vor ConfigMaps und Traefik
+spec:
+  project: default
+  source:
+    repoURL: https://git.cloud-infra.prod.openmailserver.de/stabify/gitops.git
+    targetRevision: HEAD
+    path: infrastructure/traefik-edge
+    directory:
+      recurse: false
+      include: external-secret.yaml
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: traefik-system
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

infrastructure/traefik-edge/external-secret.yaml

@@ -0,0 +1,22 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: traefik-edge-cloudflare
+  namespace: traefik-system
+spec:
+  refreshInterval: "1h"
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  target:
+    name: traefik-edge-cloudflare
+    creationPolicy: Owner
+  data:
+  - secretKey: CF_DNS_API_TOKEN
+    remoteRef:
+      key: secret/infrastructure/cloudflare
+      property: api_token
+  - secretKey: CF_API_EMAIL
+    remoteRef:
+      key: secret/infrastructure/cloudflare
+      property: email

infrastructure/traefik-edge/pvc-acme.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: traefik-edge-acme
+  namespace: traefik-system
+  labels:
+    app.kubernetes.io/name: traefik
+    app.kubernetes.io/component: edge-acme
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 1Gi