forust
1d81410cd8
ci / lint-compose (push) Successful in 4s
ci / lint-actionlint (push) Successful in 3s
ci / lint-shellcheck (push) Successful in 4s
ci / lint-prettier (push) Successful in 5s
ci / lint-ruff (push) Successful in 3s
ci / lint-yaml (push) Successful in 2s
ci / lint-dockerfiles (push) Successful in 3s
ci / scan-deps (push) Successful in 18s
ci / test-backend (push) Successful in 8s
ci / test-frontend (push) Successful in 11s
ci / validate (push) Successful in 4s
renovate-ci / validate-renovate (push) Successful in 1m28s
ci / build (push) Successful in 37s
Mount traefik-plugins PVC at /plugins-storage instead of the chart default emptyDir, so the crowdsec-bouncer download survives node reboots. Without this Traefik starts before the network is ready, the download from plugins.traefik.io times out, plugins get disabled and every route behind the middleware returns 404/503 until a manual restart.
165 lines
3.7 KiB
YAML
165 lines
3.7 KiB
YAML
# Auto-generated by forust | See https://github.com/traefik/traefik-helm-chart/blob/master/values.yaml
|
|
hostNetwork: false
|
|
image:
|
|
registry: docker.io/library
|
|
repository: traefik
|
|
tag: v3.7.13
|
|
|
|
securityContext:
|
|
capabilities:
|
|
add:
|
|
- NET_BIND_SERVICE
|
|
|
|
podSecurityContext: ~
|
|
|
|
service:
|
|
enabled: true
|
|
type: LoadBalancer
|
|
annotations:
|
|
metallb.io/loadBalancerIPs: "192.168.80.2"
|
|
spec:
|
|
externalTrafficPolicy: Local
|
|
api:
|
|
dashboard: true
|
|
insecure: true
|
|
|
|
updateStrategy:
|
|
type: Recreate
|
|
|
|
deployment:
|
|
enabled: true
|
|
additionalVolumes:
|
|
- name: plugins
|
|
persistentVolumeClaim:
|
|
claimName: traefik-plugins
|
|
additionalVolumeMounts:
|
|
- name: plugins
|
|
mountPath: /plugins-storage
|
|
|
|
providers:
|
|
kubernetesIngress:
|
|
enabled: true
|
|
kubernetesCRD:
|
|
enabled: true
|
|
kubernetesGateway:
|
|
enabled: false
|
|
file:
|
|
enabled: false
|
|
|
|
# Entrypoints
|
|
ports:
|
|
web:
|
|
port: 80
|
|
http:
|
|
aliasHeadersStrategy: delete
|
|
redirections:
|
|
entryPoint:
|
|
to: websecure
|
|
scheme: https
|
|
permanent: true
|
|
websecure:
|
|
port: 443
|
|
http:
|
|
aliasHeadersStrategy: delete
|
|
tls:
|
|
enabled: true
|
|
traefik:
|
|
port: 8080
|
|
exposedPort: 8080
|
|
protocol: TCP
|
|
expose:
|
|
default: false
|
|
http:
|
|
aliasHeadersStrategy: delete
|
|
ssh:
|
|
port: 2221
|
|
exposedPort: 2221
|
|
protocol: TCP
|
|
expose:
|
|
default: true
|
|
http:
|
|
aliasHeadersStrategy: delete
|
|
minecraft-tcp:
|
|
port: 25565
|
|
exposedPort: 25565
|
|
protocol: TCP
|
|
expose:
|
|
default: true
|
|
http:
|
|
aliasHeadersStrategy: delete
|
|
minecraft-udp:
|
|
port: 19132
|
|
exposedPort: 19132
|
|
protocol: UDP
|
|
expose:
|
|
default: true
|
|
netbird-stun:
|
|
port: 3478
|
|
exposedPort: 3478
|
|
protocol: UDP
|
|
expose:
|
|
default: true
|
|
checkmk-agent:
|
|
port: 8000
|
|
protocol: TCP
|
|
expose:
|
|
default: true
|
|
http:
|
|
aliasHeadersStrategy: delete
|
|
metrics:
|
|
port: 9100
|
|
exposedPort: 9100
|
|
protocol: TCP
|
|
expose:
|
|
default: false
|
|
http:
|
|
aliasHeadersStrategy: delete
|
|
|
|
metrics:
|
|
prometheus:
|
|
enabled: true
|
|
entryPoint: metrics
|
|
serviceMonitor:
|
|
enabled: true
|
|
additionalLabels:
|
|
release: prometheus-stack
|
|
namespace: prometheus
|
|
|
|
ingressRoute:
|
|
dashboard:
|
|
enabled: false
|
|
|
|
persistence:
|
|
enabled: true
|
|
size: 100Mi
|
|
path: /data
|
|
|
|
# No certificatesResolvers: public TLS comes from cert-manager.
|
|
|
|
volumes:
|
|
- name: traefik-dynamic
|
|
mountPath: /etc/traefik/dynamic
|
|
type: configMap
|
|
- name: crowdsec-bouncer-secrets
|
|
mountPath: /etc/traefik/secrets
|
|
type: secret
|
|
additionalArguments:
|
|
- "--providers.file.directory=/etc/traefik/dynamic"
|
|
- "--providers.file.watch=true"
|
|
- "--providers.kubernetesCRD.allowCrossNamespace=true"
|
|
- "--providers.kubernetesCRD.safeNaming=false"
|
|
- "--entryPoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22,192.168.1.1,192.168.1.0/24,192.168.88.0/24,192.168.88.1"
|
|
- "--entryPoints.web.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22,192.168.1.1,192.168.1.0/24,192.168.88.0/24,192.168.88.1"
|
|
|
|
experimental:
|
|
plugins:
|
|
crowdsec-bouncer:
|
|
moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
|
|
version: v1.3.3
|
|
|
|
log:
|
|
level: INFO
|
|
accessLog:
|
|
enabled: true
|
|
format: common
|