feat(ingress): replace traefik crowdsec plugin with firewall bouncer

Move L3 enforcement to the host firewall-bouncer (systemd, nftables): drop the Traefik plugin, its secrets volume and the crowdsec Middleware, remove bouncer refs from all IngressRoutes. Disable the http-generic-bf scenario (403-burst bans hurt legit automation under L3 enforcement). Add a Gateway API PoC for homepages prod and CrowdSec PrometheusRule alerts.

traefik/k8s/ingress.yaml

@@ -10,9 +10,6 @@ spec:
   routes:
     - match: Host(`traefik.forust.xyz`)
       kind: Rule
-      middlewares:
-        - name: crowdsec-bouncer
-          namespace: crowdsec
       services:
         - name: api@internal
           kind: TraefikService

traefik/k8s/traefik-values.yaml

@@ -68,7 +68,7 @@ providers:
   kubernetesCRD:
     enabled: true
   kubernetesGateway:
-    enabled: false
+    enabled: true
   file:
     enabled: false
 
@@ -161,14 +161,13 @@ persistence:
   path: /data
 
 # No certificatesResolvers: public TLS comes from cert-manager.
+# No plugins: L3 enforcement moved to the host firewall bouncer,
+# nothing runs in the request path anymore.
 
 volumes:
   - name: traefik-dynamic
     mountPath: /etc/traefik/dynamic
     type: configMap
-  - name: crowdsec-bouncer-secrets
-    mountPath: /etc/traefik/secrets
-    type: secret
 additionalArguments:
   - "--providers.file.directory=/etc/traefik/dynamic"
   - "--providers.file.watch=true"
@@ -177,12 +176,6 @@ additionalArguments:
   - "--entryPoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22,192.168.1.1,192.168.1.0/24,192.168.88.0/24,192.168.88.1"
   - "--entryPoints.web.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22,192.168.1.1,192.168.1.0/24,192.168.88.0/24,192.168.88.1"
 
-experimental:
-  plugins:
-    crowdsec-bouncer:
-      moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
-      version: v1.3.3
-
 log:
   level: INFO
 accessLog: