# Auto-generated by forust | See https://github.com/traefik/traefik-helm-chart/blob/master/values.yaml
hostNetwork: false
image:
  registry: docker.io/library
  repository: traefik
  tag: v3.7.13

securityContext:
  capabilities:
    add:
      - NET_BIND_SERVICE

podSecurityContext: ~

service:
  enabled: true
  type: LoadBalancer
  annotations:
    metallb.io/loadBalancerIPs: "192.168.80.2"
  spec:
    externalTrafficPolicy: Local
api:
  dashboard: true
  insecure: true

updateStrategy:
  type: Recreate

deployment:
  enabled: true
  additionalVolumes:
    - name: plugins
      persistentVolumeClaim:
        claimName: traefik-plugins
additionalVolumeMounts:
  - name: plugins
    mountPath: /plugins-storage

# BestEffort (no requests) meant kubelet squeezed traefik first under node
# pressure, down to /ping timeouts and liveness restarts. Burstable instead.
resources:
  requests:
    cpu: "200m"
    memory: "256Mi"
  limits:
    cpu: "1000m"
    memory: "1Gi"

# Single replica is the whole ingress: a SIGKILL here takes every public
# service down. Budgets are sized for HDD stalls on a loaded node, not for a
# healthy disk — same treatment as immich postgres and metallb speaker.
readinessProbe:
  failureThreshold: 6
  initialDelaySeconds: 10
  periodSeconds: 10
  successThreshold: 1
  timeoutSeconds: 5
livenessProbe:
  failureThreshold: 6
  initialDelaySeconds: 30
  periodSeconds: 30
  successThreshold: 1
  timeoutSeconds: 5

providers:
  kubernetesIngress:
    enabled: true
  kubernetesCRD:
    enabled: true
  kubernetesGateway:
    enabled: true
  file:
    enabled: false

# Entrypoints
ports:
  web:
    port: 80
    http:
      aliasHeadersStrategy: delete
      redirections:
        entryPoint:
          to: websecure
          scheme: https
          permanent: true
  websecure:
    port: 443
    http:
      aliasHeadersStrategy: delete
      tls:
        enabled: true
  traefik:
    port: 8080
    exposedPort: 8080
    protocol: TCP
    expose:
      default: false
    http:
      aliasHeadersStrategy: delete
  ssh:
    port: 2221
    exposedPort: 2221
    protocol: TCP
    expose:
      default: true
    http:
      aliasHeadersStrategy: delete
  minecraft-tcp:
    port: 25565
    exposedPort: 25565
    protocol: TCP
    expose:
      default: true
    http:
      aliasHeadersStrategy: delete
  minecraft-udp:
    port: 19132
    exposedPort: 19132
    protocol: UDP
    expose:
      default: true
  netbird-stun:
    port: 3478
    exposedPort: 3478
    protocol: UDP
    expose:
      default: true
  checkmk-agent:
    port: 8000
    protocol: TCP
    expose:
      default: true
    http:
      aliasHeadersStrategy: delete
  metrics:
    port: 9100
    exposedPort: 9100
    protocol: TCP
    expose:
      default: false
    http:
      aliasHeadersStrategy: delete

metrics:
  prometheus:
    enabled: true
    entryPoint: metrics
    serviceMonitor:
      enabled: true
      additionalLabels:
        release: prometheus-stack
      namespace: prometheus

ingressRoute:
  dashboard:
    enabled: false

persistence:
  enabled: true
  size: 100Mi
  path: /data

# No certificatesResolvers: public TLS comes from cert-manager.
# No plugins: L3 enforcement moved to the host firewall bouncer,
# nothing runs in the request path anymore.

volumes:
  - name: traefik-dynamic
    mountPath: /etc/traefik/dynamic
    type: configMap
additionalArguments:
  - "--providers.file.directory=/etc/traefik/dynamic"
  - "--providers.file.watch=true"
  - "--providers.kubernetesCRD.allowCrossNamespace=true"
  - "--providers.kubernetesCRD.safeNaming=false"
  - "--entryPoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22,192.168.1.1,192.168.1.0/24,192.168.88.0/24,192.168.88.1"
  - "--entryPoints.web.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22,192.168.1.1,192.168.1.0/24,192.168.88.0/24,192.168.88.1"

log:
  level: INFO
accessLog:
  enabled: true
  format: common