viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

[ci skip] Refactor raw ingresses to use ingress_factory module

Browse source 
Enhance ingress_factory with full_host, extra_middlewares, and
skip_default_rate_limit variables. Fix TLS hosts bug to use
effective_host. Migrate 13 services from raw kubernetes_ingress_v1
resources to centralized ingress_factory module calls, removing
manual rybbit middleware CRDs where the factory now handles them.
This commit is contained in:
Viktor Barzin 2026-02-10 21:11:46 +00:00
parent 97175c5444
commit 348d706a48
No known key found for this signature in database
GPG key ID: 0EB088298288D958
15 changed files with 177 additions and 627 deletions
Download patch file Download diff file Expand all files Collapse all files

61
modules/kubernetes/headscale/main.tf
View file

@ -183,52 +183,23 @@ resource "kubernetes_service" "headscale" {
}
}
resource "kubernetes_ingress_v1" "headscale" {
metadata {
name = "headscale-ingress"
namespace = kubernetes_namespace.headscale.metadata[0].name
annotations = {
// DO NOT ADD CLIENT TLS AUTH as this breaks vpn auth
"traefik.ingress.kubernetes.io/router.middlewares" = "traefik-rate-limit@kubernetescrd,traefik-csp-headers@kubernetescrd,traefik-crowdsec@kubernetescrd"
"traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
}
}
module "ingress" {
source = "../ingress_factory"
namespace = kubernetes_namespace.headscale.metadata[0].name
name = "headscale"
port = 8080
tls_secret_name = var.tls_secret_name
}
spec {
ingress_class_name = "traefik"
tls {
hosts = ["headscale.viktorbarzin.me"]
secret_name = var.tls_secret_name
}
rule {
host = "headscale.viktorbarzin.me"
http {
path {
path = "/web"
# path = "/admin"
backend {
service {
name = "headscale"
port {
number = 8081
}
}
}
}
path {
path = "/"
backend {
service {
name = "headscale"
port {
number = 8080
}
}
}
}
}
}
}
module "ingress-ui" {
source = "../ingress_factory"
namespace = kubernetes_namespace.headscale.metadata[0].name
name = "headscale-ui"
host = "headscale"
service_name = "headscale"
port = 8081
ingress_path = ["/web"]
tls_secret_name = var.tls_secret_name
}
resource "kubernetes_service" "headscale-server" {