switch to traefik

traefik/basicauth.yaml

@@ -0,0 +1,20 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: basic-auth
+  namespace: traefik
+spec:
+  basicAuth:
+    secret: authsecret
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: authsecret
+  namespace: traefik
+data:
+  users: |2
+    YWFyb246JDJ5JDA1JEIyLlEuOS9lNFZFWHNub2UueXBqWU9raXlrbXJGMmhwQXBFN0NZYzJEUEly
+    MHBGSWRETzFPCnRvbTokMnkkMDUkQnNNN2Z2bWYzR3B1em5hazVPU2dyZTB4ODFLNC52eFVRTy9h
+    S1c1Y1k0Z21RT3p2c3NQTE8KYmFzdGk6JCRhcHIxJCRYYUdERnByYiQkTzlZMW9SaFROWTdVNWFh
+    NUxqM3dhMQo=

traefik/values.yaml

@@ -0,0 +1,49 @@
+deployment:
+  kind: DaemonSet
+hostNetwork: true
+ports:
+  web:
+    port: 80
+    redirectTo:
+      port: "websecure"
+  websecure:
+    port: 443
+    tls:
+      certResolver: "letsencrypt"
+
+securityContext:
+  capabilities:
+    drop: [ALL]
+    add: [NET_BIND_SERVICE]
+  readOnlyRootFilesystem: true
+  runAsGroup: 0
+  runAsNonRoot: false
+  runAsUser: 0
+
+service:
+  type: NodePort
+  ipFamilyPolicy: PreferDualStack
+
+persistence:
+  enabled: true
+
+certResolvers:
+  letsencrypt:
+    email: letsencrypt@ar21.de
+    tlsChallenge: true
+    httpChallenge:
+      entryPoint: "web"
+    storage: /data/acme.json
+
+updateStrategy:
+  type: RollingUpdate
+  rollingUpdate:
+    maxUnavailable: 1
+    maxSurge: 0
+
+ingressRoute:
+  dashboard:
+    matchRule: Host(`traefik.lab.ar21.de`)
+    entryPoints: ["traefik", "websecure"]
+    middlewares:
+      - name: basic-auth