mirror of
https://github.com/allaunthefox/Research-Stack.git
synced 2026-08-17 08:20:36 +00:00
69b984c410
- Revert builder image in embedded_surface Dockerfile to rust:bookworm for glibc compatibility with bookworm-slim runner. - Replace racknerd-surface.json Git LFS pointer with the actual retrieved JSON config to resolve parse errors. - Separated and imported regenerated docker images for stubs and credential-server on all cluster nodes. - Fixed Ingress resources and middleware to target the correct authentik-server service name. - Rewrote verification script checks to handle iptables-based ports and relative redirects robustly. - Updated nixos-laptop IP in node topology documentation. Build: 0 jobs, 0 errors
288 lines
12 KiB
YAML
288 lines
12 KiB
YAML
# Traefik Ingress — canonical path-based routing for researchstack.info
|
|
#
|
|
# This is the single source of truth for URL → service mapping inside k3s.
|
|
# The public edge Caddy terminates TLS and forwards to Traefik's entrypoint.
|
|
# Traefik handles path routing, prefix stripping, and forward-auth.
|
|
#
|
|
# Middleware annotation format: <namespace>-<middleware-name>@kubernetescrd
|
|
#
|
|
# Split into per-route Ingresses so each gets its own middleware chain:
|
|
# - /apps/*, /server/* → forward_auth (Authentik) + strip-prefix
|
|
# - /api/* → strip-prefix only (token-auth, no SSO)
|
|
# - / → forward_auth (Authentik), no strip
|
|
# - auth.* → no middleware (Authentik itself)
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════
|
|
# /apps/chat/* → Hermes (SSO-gated)
|
|
# ═══════════════════════════════════════════════════════════════════════════
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: rs-apps-chat
|
|
namespace: services
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.entrypoints: web
|
|
traefik.ingress.kubernetes.io/router.middlewares: services-authentik-forward-auth@kubernetescrd,services-strip-apps-chat@kubernetescrd
|
|
spec:
|
|
rules:
|
|
- host: researchstack.info
|
|
http:
|
|
paths:
|
|
- path: /apps/chat
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: hermes
|
|
port:
|
|
number: 80
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════
|
|
# /apps/budget/* → Actual Budget (SSO-gated)
|
|
# ═══════════════════════════════════════════════════════════════════════════
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: rs-apps-budget
|
|
namespace: services
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.entrypoints: web
|
|
traefik.ingress.kubernetes.io/router.middlewares: services-authentik-forward-auth@kubernetescrd,services-strip-apps-budget@kubernetescrd
|
|
spec:
|
|
rules:
|
|
- host: researchstack.info
|
|
http:
|
|
paths:
|
|
- path: /apps/budget
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: actual-budget
|
|
port:
|
|
number: 5006
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════
|
|
# /server/status/* → Uptime Kuma (SSO-gated)
|
|
# ═══════════════════════════════════════════════════════════════════════════
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: rs-server-status
|
|
namespace: services
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.entrypoints: web
|
|
traefik.ingress.kubernetes.io/router.middlewares: services-authentik-forward-auth@kubernetescrd,services-strip-server-status@kubernetescrd
|
|
spec:
|
|
rules:
|
|
- host: researchstack.info
|
|
http:
|
|
paths:
|
|
- path: /server/status
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: uptime-kuma
|
|
port:
|
|
number: 3001
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════
|
|
# /server/dash/* → Homarr (SSO-gated)
|
|
# ═══════════════════════════════════════════════════════════════════════════
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: rs-server-dash
|
|
namespace: services
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.entrypoints: web
|
|
traefik.ingress.kubernetes.io/router.middlewares: services-authentik-forward-auth@kubernetescrd,services-strip-server-dash@kubernetescrd
|
|
spec:
|
|
rules:
|
|
- host: researchstack.info
|
|
http:
|
|
paths:
|
|
- path: /server/dash
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: homarr
|
|
port:
|
|
number: 7575
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════
|
|
# /server/vault/* → Vaultwarden (SSO-gated)
|
|
# ═══════════════════════════════════════════════════════════════════════════
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: rs-server-vault
|
|
namespace: services
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.entrypoints: web
|
|
traefik.ingress.kubernetes.io/router.middlewares: services-authentik-forward-auth@kubernetescrd,services-strip-server-vault@kubernetescrd
|
|
spec:
|
|
rules:
|
|
- host: researchstack.info
|
|
http:
|
|
paths:
|
|
- path: /server/vault
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: vaultwarden
|
|
port:
|
|
number: 80
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════
|
|
# /api/cred/* → Credential Server (token-auth, no SSO)
|
|
# ═══════════════════════════════════════════════════════════════════════════
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: rs-api-cred
|
|
namespace: services
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.entrypoints: web
|
|
traefik.ingress.kubernetes.io/router.middlewares: services-strip-api-cred@kubernetescrd
|
|
spec:
|
|
rules:
|
|
- host: researchstack.info
|
|
http:
|
|
paths:
|
|
- path: /api/cred
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: credential-server
|
|
port:
|
|
number: 8444
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════
|
|
# /api/registry/* → Registry API (token-auth, no SSO)
|
|
# ═══════════════════════════════════════════════════════════════════════════
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: rs-api-registry
|
|
namespace: services
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.entrypoints: web
|
|
traefik.ingress.kubernetes.io/router.middlewares: services-strip-api-registry@kubernetescrd
|
|
spec:
|
|
rules:
|
|
- host: researchstack.info
|
|
http:
|
|
paths:
|
|
- path: /api/registry
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: registry-api
|
|
port:
|
|
number: 8080
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════
|
|
# /api/jobs/* → Job Router (token-auth, no SSO)
|
|
# ═══════════════════════════════════════════════════════════════════════════
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: rs-api-jobs
|
|
namespace: services
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.entrypoints: web
|
|
traefik.ingress.kubernetes.io/router.middlewares: services-strip-api-jobs@kubernetescrd
|
|
spec:
|
|
rules:
|
|
- host: researchstack.info
|
|
http:
|
|
paths:
|
|
- path: /api/jobs
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: jobs-api
|
|
port:
|
|
number: 8080
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════
|
|
# /api/blobs/* → Blob Plane (token-auth, no SSO)
|
|
# ═══════════════════════════════════════════════════════════════════════════
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: rs-api-blobs
|
|
namespace: services
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.entrypoints: web
|
|
traefik.ingress.kubernetes.io/router.middlewares: services-strip-api-blobs@kubernetescrd
|
|
spec:
|
|
rules:
|
|
- host: researchstack.info
|
|
http:
|
|
paths:
|
|
- path: /api/blobs
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: blobs-api
|
|
port:
|
|
number: 8080
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════
|
|
# / → Homer landing page (SSO-gated, no strip)
|
|
# ═══════════════════════════════════════════════════════════════════════════
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: rs-landing
|
|
namespace: services
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.entrypoints: web
|
|
traefik.ingress.kubernetes.io/router.middlewares: services-authentik-forward-auth@kubernetescrd
|
|
traefik.ingress.kubernetes.io/router.priority: "1"
|
|
spec:
|
|
rules:
|
|
- host: researchstack.info
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: homer
|
|
port:
|
|
number: 8080
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════
|
|
# auth.researchstack.info → Authentik (stable OIDC issuer, no middleware)
|
|
# ═══════════════════════════════════════════════════════════════════════════
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: rs-auth
|
|
namespace: services
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.entrypoints: web
|
|
spec:
|
|
rules:
|
|
- host: auth.researchstack.info
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: authentik-server
|
|
port:
|
|
number: 80
|