forust
0859479c0f
ci / lint-compose (push) Successful in 9s
ci / lint-actionlint (push) Successful in 4s
ci / lint-shellcheck (push) Successful in 7s
ci / lint-prettier (push) Successful in 12s
ci / lint-ruff (push) Successful in 6s
ci / lint-yaml (push) Successful in 9s
ci / lint-dockerfiles (push) Successful in 5s
ci / validate (push) Successful in 5s
renovate-ci / validate-renovate (push) Successful in 7s
ci / build (push) Failing after 14m22s
Move L3 enforcement to the host firewall-bouncer (systemd, nftables): drop the Traefik plugin, its secrets volume and the crowdsec Middleware, remove bouncer refs from all IngressRoutes. Disable the http-generic-bf scenario (403-burst bans hurt legit automation under L3 enforcement). Add a Gateway API PoC for homepages prod and CrowdSec PrometheusRule alerts.
32 lines
871 B
YAML
32 lines
871 B
YAML
# Gateway API PoC for homepages. Lives next to the TLS secrets so
|
|
# certificateRefs stay same-namespace and no ReferenceGrant is needed.
|
|
# Listener ports must match the Traefik entryPoints (80/443),
|
|
# otherwise Traefik marks the listener Invalid.
|
|
# Local .internal hosts are deliberately left on IngressRoute,
|
|
# only prod is migrated here.
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
name: homepages
|
|
namespace: homepages
|
|
spec:
|
|
gatewayClassName: traefik
|
|
listeners:
|
|
- name: http
|
|
protocol: HTTP
|
|
port: 80
|
|
allowedRoutes:
|
|
namespaces:
|
|
from: Same
|
|
- name: https
|
|
protocol: HTTPS
|
|
port: 443
|
|
tls:
|
|
mode: Terminate
|
|
certificateRefs:
|
|
- name: forust-homepage-prod-tls
|
|
- name: xdfnx-homepage-prod-tls
|
|
allowedRoutes:
|
|
namespaces:
|
|
from: Same
|