diff --git a/apps/home-assistant/ingress.yaml b/apps/home-assistant/ingress.yaml index 3ff6161..05b3c46 100644 --- a/apps/home-assistant/ingress.yaml +++ b/apps/home-assistant/ingress.yaml @@ -10,7 +10,4 @@ spec: kind: Rule services: - name: home-assistant - port: 8123 - tls: - store: - name: cloudflare-tls \ No newline at end of file + port: 8123 \ No newline at end of file diff --git a/apps/plex/ingress.yaml b/apps/plex/ingress.yaml index 9e9f810..9c94006 100644 --- a/apps/plex/ingress.yaml +++ b/apps/plex/ingress.yaml @@ -10,6 +10,4 @@ spec: kind: Rule services: - name: plex - port: 32400 - tls: - certResolver: letsencrypt + port: 32400 \ No newline at end of file diff --git a/apps/stonegarden/ingress.yaml b/apps/stonegarden/ingress.yaml index 7a2850b..9a0057b 100644 --- a/apps/stonegarden/ingress.yaml +++ b/apps/stonegarden/ingress.yaml @@ -10,7 +10,4 @@ spec: kind: Rule services: - name: stonegarden - port: web - tls: - store: - name: cloudflare-tls \ No newline at end of file + port: web \ No newline at end of file diff --git a/apps/whoami/ingress-route.yaml b/apps/whoami/ingress-route.yaml index 161842a..2cb335a 100644 --- a/apps/whoami/ingress-route.yaml +++ b/apps/whoami/ingress-route.yaml @@ -26,8 +26,4 @@ spec: kind: Rule services: - name: whoami - port: 80 - tls: - store: - name: cloudflare-tls - certResolver: letsencrypt + port: 80 \ No newline at end of file diff --git a/charts/application/templates/ingress-route.yaml b/charts/application/templates/ingress-route.yaml index af5697a..7270dcd 100644 --- a/charts/application/templates/ingress-route.yaml +++ b/charts/application/templates/ingress-route.yaml @@ -9,9 +9,6 @@ metadata: spec: entryPoints: - websecure - tls: - store: - name: cloudflare-tls routes: {{- if include "service.create" . }} - match: Host(`{{ .Values.name }}.stonegarden.dev`) diff --git a/infra/argocd/ingress.yaml b/infra/argocd/ingress.yaml index 1f80f65..a91debc 100644 --- a/infra/argocd/ingress.yaml +++ b/infra/argocd/ingress.yaml @@ -19,6 +19,4 @@ spec: services: - name: argocd-server port: 80 - scheme: h2c - tls: - certResolver: letsencrypt \ No newline at end of file + scheme: h2c \ No newline at end of file diff --git a/infra/cilium/ingress-route.yaml b/infra/cilium/ingress-route.yaml index 64e8aaf..8d89256 100644 --- a/infra/cilium/ingress-route.yaml +++ b/infra/cilium/ingress-route.yaml @@ -20,6 +20,4 @@ spec: - name: hubble-ui port: 80 middlewares: - - name: traefik-forward-auth - tls: - certResolver: letsencrypt + - name: traefik-forward-auth \ No newline at end of file diff --git a/infra/dashboard/ingress.yaml b/infra/dashboard/ingress.yaml index 72ffa5f..e11da81 100644 --- a/infra/dashboard/ingress.yaml +++ b/infra/dashboard/ingress.yaml @@ -24,6 +24,4 @@ spec: - name: kubernetes-dashboard port: 80 middlewares: - - name: traefik-forward-auth - tls: - certResolver: letsencrypt + - name: traefik-forward-auth \ No newline at end of file diff --git a/infra/monitoring/ingress-route.yaml b/infra/monitoring/ingress-route.yaml index 48df63a..532c92e 100644 --- a/infra/monitoring/ingress-route.yaml +++ b/infra/monitoring/ingress-route.yaml @@ -32,6 +32,4 @@ spec: port: http-web # 9093 middlewares: - name: traefik-forward-auth - namespace: kube-system - tls: - certResolver: letsencrypt + namespace: kube-system \ No newline at end of file diff --git a/infra/net-aux/ingress-route.yaml b/infra/net-aux/ingress-route.yaml index 1051b21..d7a052f 100644 --- a/infra/net-aux/ingress-route.yaml +++ b/infra/net-aux/ingress-route.yaml @@ -12,7 +12,4 @@ spec: - name: pi-hole-web port: http middlewares: - - name: traefik-forward-auth - tls: - store: - name: cloudflare-tls \ No newline at end of file + - name: traefik-forward-auth \ No newline at end of file diff --git a/infra/pi-hole/ingress-route.yaml b/infra/pi-hole/ingress-route.yaml index f51dc12..fca8cb9 100644 --- a/infra/pi-hole/ingress-route.yaml +++ b/infra/pi-hole/ingress-route.yaml @@ -12,7 +12,4 @@ spec: - name: pi-hole-web port: http middlewares: - - name: traefik-forward-auth - tls: - store: - name: cloudflare-tls \ No newline at end of file + - name: traefik-forward-auth \ No newline at end of file diff --git a/infra/traefik/cloudflare-cert.yaml b/infra/traefik/cloudflare-cert.yaml new file mode 100644 index 0000000..a200a99 --- /dev/null +++ b/infra/traefik/cloudflare-cert.yaml @@ -0,0 +1,13 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: wildcard-stonegarden-dev + namespace: traefik-system +spec: + secretName: wildcard-stonegarden-dev-tls + dnsNames: + - "stonegarden.dev" + - "*.stonegarden.dev" + issuerRef: + name: cloudflare-issuer + kind: Issuer \ No newline at end of file diff --git a/infra/traefik/cloudflare-issuer.yaml b/infra/traefik/cloudflare-issuer.yaml new file mode 100644 index 0000000..9b735f8 --- /dev/null +++ b/infra/traefik/cloudflare-issuer.yaml @@ -0,0 +1,17 @@ +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: cloudflare-issuer + namespace: traefik-system +spec: + acme: + server: https://acme-v02.api.letsencrypt.org/directory + email: veghag@gmail.com + privateKeySecretRef: + name: cloudflare-key + solvers: + - dns01: + cloudflare: + apiTokenSecretRef: + name: cloudflare + key: api-token \ No newline at end of file diff --git a/infra/traefik/cloudflare-token-cert-manager.yaml b/infra/traefik/cloudflare-token-cert-manager.yaml new file mode 100644 index 0000000..cd08e15 --- /dev/null +++ b/infra/traefik/cloudflare-token-cert-manager.yaml @@ -0,0 +1,14 @@ +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + name: cloudflare-token-cert-manager + namespace: traefik-system +spec: + encryptedData: + api-token: AgAJwhExpbTIdzVFXRdBw4tuKHtVMsUuee8Gewjr4Kft+O/RWJ3Gfe9VHmpHNsBFM0oOsCZ5d69JTVfNrLQ531ig+Ed3KcAaxVfUx/ksvLwNnzKEaKWSLmOLDQdqs9yLPJ01K/rhCGDkO7nciXgo+KOJLWUbOwlS/p0E+IMYuS1lFxURb/mARwBvYUvvLlRRmCy9l56LrqEBCpcoC+8Gh+1rrwh/ccrxDYi6cpTmGcPhSJrfHQiQFcjEIPVcwsane3LBwnytJhFCOf25KIp3GGHsikkSpyOugXxqwl37d1nSRDUA8wVas1oTdqts+ipdWkDxAvkCSRW/VdufnipJSmXNgO5CYqQ+PBW1WBtYoXjGaWCt1g+5o5SHdmogu4zr//UQUZ/by03LDitfNNkONWQ4CnrBDxHb8sS8PZI3yMIEfayAhFeGbmka9w0PcwojlWXDwqK3KdfN+heIDT5xh40uNmE/vPmHs1eAxSxrtbfVpag51gZ32cnJKSizEy8HyV6m8D7SLRCJrM2hcOooQG/74ZukB/BflTyASfcTJZ1bJ4DL8Sv5bMYWQHtrTVvQhtfO7UKcOrc6L3Tp082npngyNRDPBMhDxFdfzxa3VXICxfwBp/CL7XMMNuFlFkhbx7xCrx9SiuUyfemOSLeVlKf+zVZ+ASD6A+TUNVHa6YaTj05WDmkrSArrfvmZQ2l3rd4EZ4uaN44g9zrxW/67ThtlhS4A0HH9cK28vMxaFouBzXz6K2y3dTb2 + template: + metadata: + name: cloudflare-token-cert-manager + namespace: traefik-system + type: Opaque + diff --git a/infra/traefik/tlsStore.yaml b/infra/traefik/tlsStore.yaml index 1363f58..2477d43 100644 --- a/infra/traefik/tlsStore.yaml +++ b/infra/traefik/tlsStore.yaml @@ -1,8 +1,8 @@ -apiVersion: traefik.containo.us/v1alpha1 +apiVersion: traefik.io/v1alpha1 kind: TLSStore metadata: - name: cloudflare-tls - namespace: kube-system + name: cloudflare + namespace: traefik-system spec: defaultCertificate: secretName: cloudflare-tls diff --git a/infra/traefik/values.yaml b/infra/traefik/values.yaml index 17e4bfa..c985dda 100644 --- a/infra/traefik/values.yaml +++ b/infra/traefik/values.yaml @@ -34,10 +34,7 @@ persistence: storageClass: cert-storage path: /data -certResolvers: - letsencrypt: - email: veghag@gmail.com - tlsChallenge: true - storage: /data/acme.json - # Remove staging server when it's working - #caServer: https://acme-staging-v02.api.letsencrypt.org/directory \ No newline at end of file +tlsStore: + default: + defaultCertificate: + secretName: wildcard-stonegarden-dev-tls \ No newline at end of file