From 090a357ef46473e76b0cd0e0e1b013e6080a7360 Mon Sep 17 00:00:00 2001
From: Robert Günzler <r@gnzler.io>
Date: Mon, 23 Feb 2026 14:10:11 +0100
Subject: refactor traefik middlewares into separate files
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Robert Günzler <r@gnzler.io>
---
 bundles/traefik/files/common-middlewares.yaml | 30 +++++++++++++++++++++++++++
 bundles/traefik/files/kube.yaml               | 23 --------------------
 bundles/traefik/items.py                      |  3 +++
 3 files changed, 33 insertions(+), 23 deletions(-)
 create mode 100644 bundles/traefik/files/common-middlewares.yaml

(limited to 'bundles/traefik')

diff --git a/bundles/traefik/files/common-middlewares.yaml b/bundles/traefik/files/common-middlewares.yaml
new file mode 100644
index 0000000..5f2cb2e
--- /dev/null
+++ b/bundles/traefik/files/common-middlewares.yaml
@@ -0,0 +1,30 @@
+http:
+  middlewares:
+
+    # metrics
+    replacepath-bare:
+      replacepath:
+        path: /
+    replacepath-metrics:
+      replacepath:
+        path: /metrics
+
+    # authelia
+    authelia:
+      forwardAuth:
+        trustForwardHeader: true
+        authResponseHeaders: Remote-User,Remote-Groups,Remote-Email,Remote-Name
+% if node.name == "inazuma":
+        address: http://authelia:9091/api/authz/forward-auth
+% elif node.name == "shimakaze":
+        address: http://inazuma:9091/api/authz/forward-auth
+% endif
+
+% if node.name == "inazuma--TODO":
+    # tsauth
+    tsauth:
+      forwardAuth:
+        trustForwardHeader: true
+        authResponseHeaders: ^Tailscale-
+        address: http://localhost:3000
+% endif
diff --git a/bundles/traefik/files/kube.yaml b/bundles/traefik/files/kube.yaml
index 2849091..87202fc 100644
--- a/bundles/traefik/files/kube.yaml
+++ b/bundles/traefik/files/kube.yaml
@@ -4,29 +4,6 @@ kind: Pod
 metadata:
   name: traefik
   labels:
-    traefik.enable: true
-    traefik.http.routers.traefik-metrics.entrypoints: metrics
-    traefik.http.routers.traefik-metrics.rule: Path(`/metrics/traefik`)
-    traefik.http.routers.traefik-metrics.middlewares: replacepath-bare
-    traefik.http.routers.traefik-metrics.service: prometheus@internal
-    # common middleware
-    ## metrics
-    traefik.http.middlewares.replacepath-bare.replacepath.path: /
-    traefik.http.middlewares.replacepath-metrics.replacepath.path: /metrics
-    ## authelia
-    traefik.http.middlewares.authelia.forwardAuth.trustForwardHeader: true
-    traefik.http.middlewares.authelia.forwardAuth.authResponseHeaders: Remote-User,Remote-Groups,Remote-Email,Remote-Name
-% if node.name == "inazuma":
-    traefik.http.middlewares.authelia.forwardAuth.address: http://authelia:9091/api/authz/forward-auth
-% elif node.name == "shimakaze":
-    traefik.http.middlewares.authelia.forwardAuth.address: http://inazuma:9091/api/authz/forward-auth
-% endif
-% if node.name == "inazuma--TODO":
-    ## tsauth
-    traefik.http.middlewares.tsauth.forwardAuth.trustForwardHeader: true
-    traefik.http.middlewares.tsauth.forwardAuth.authResponseHeaders: ^Tailscale-
-    traefik.http.middlewares.tsauth.forwardAuth.address: http://localhost:3000
-% endif
 spec:
   restartPolicy: Never
   dnsPolicy: Default
diff --git a/bundles/traefik/items.py b/bundles/traefik/items.py
index 8b4eec7..ecb3d66 100644
--- a/bundles/traefik/items.py
+++ b/bundles/traefik/items.py
@@ -10,6 +10,9 @@ files = {
         "triggers": {"svc_s6rc:traefik:restart"},
     },
     "/etc/traefik/tls-redirect.yaml": {},
+    "/etc/traefik/common-middlewares.yaml": {
+        "content_type": "mako",
+    },
     "/etc/logrotate.d/traefik": {
         "source": "logrotate.conf",
     },
-- 
cgit 1.4.1