feat(xui): add 3x-ui VPN panel behind cloudflared tunnel

VLESS+WS inbound (port 10000) via Traefik IngressRoute, panel on internal domains only with public route commented out. gitignore now covers nested k8s secrets and local-only grafana values.

vpn/xui/k8s/ingress.yaml

@@ -0,0 +1,81 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: xui-local
+  namespace: xui
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`xui.workstation.internal`) || Host(`xui.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: xui-service
+          port: 30379
+---
+# Public panel access (optional).
+# Realistic, but intentionally disabled: the panel has its own login,
+# security-chain adds Authentik in front of it.
+# To enable: uncomment and add Public Hostname `xui.forust.xyz`
+# in the Cloudflare tunnel (same as other *.forust.xyz hosts).
+# ---
+# apiVersion: traefik.io/v1alpha1
+# kind: IngressRoute
+# metadata:
+#   name: xui-prod
+#   namespace: xui
+# spec:
+#   entryPoints:
+#     - websecure
+#   routes:
+#     - match: Host(`xui.forust.xyz`)
+#       kind: Rule
+#       middlewares:
+#         - name: security-chain@file
+#       services:
+#         - name: xui-service
+#           port: 30379
+#   tls:
+#     certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: xray-prod
+  namespace: xui
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`xray.forust.xyz`) && PathPrefix(`/pzzfpz6oi281f0u8`)
+      kind: Rule
+      services:
+        - name: xui-service
+          port: 2096
+    - match: Host(`xray.forust.xyz`)
+      kind: Rule
+      services:
+        - name: xui-service
+          port: 10000
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: xray-local
+  namespace: xui
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: (Host(`xray.workstation.internal`) || Host(`xray.gigaforust.internal`)) && PathPrefix(`/pzzfpz6oi281f0u8`)
+      kind: Rule
+      services:
+        - name: xui-service
+          port: 2096
+    - match: Host(`xray.workstation.internal`) || Host(`xray.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: xui-service
+          port: 10000