# TODO: how to handle services going away (e.g. during update/backup)
apiVersion: v1
kind: Pod
metadata:
  name: traefik
  labels:
spec:
  restartPolicy: Never
  dnsPolicy: Default
  containers:
    - name: traefik
      image: index.docker.io/library/traefik:v${version}
      args:
        - --log.level=info
        - --accesslog=true
        - --accesslog.format=json
        - --accesslog.filepath=/data/access.log
        - --accesslog.bufferingsize=0
        - --accesslog.fields.headers.defaultmode=drop
        - --accesslog.fields.headers.names.User-Agent=keep
        - --api.dashboard=true
        - --api.insecure=true
        - --metrics.prometheus=true
        - --metrics.prometheus.manualrouting=true
        # healthcheck
        - --ping=true
        - --ping.entrypoint=traefik
        - --ping.terminatingstatuscode=204
        # providers
        - --providers.file.directory=/etc/traefik
        - --providers.file.watch=true
        - --providers.docker=true
        - --providers.docker.exposedByDefault=false
        # entrypoints
        - --entrypoints.metrics.address=:9010
        - --entrypoints.traefik.address=:4000
        - --entrypoints.http.address=:80
        - --entrypoints.https.address=:443
        # entrypoints (web) should handle large blobs
        - --entrypoints.http.transport.respondingTimeouts.readTimeout=0s
        - --entrypoints.https.transport.respondingTimeouts.readTimeout=0s
        # certs
        - --certificatesresolvers.le.acme.email=r+acme@gnzler.io
        - --certificatesresolvers.le.acme.storage=/data/acme.json
        # - --certificatesresolvers.le.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
        # http challenge doesn't work for tailscale endpoints
        # - --certificatesresolvers.le.acme.httpchallenge.entrypoint=http
        - --certificatesresolvers.le.acme.dnschallenge.provider=porkbun
        - --certificatesresolvers.ts.tailscale=true
      envFrom:
        - secretRef:
            name: traefik
      volumeMounts:
        - name: traefik-data
          mountPath: /data
        - name: traefik-file-provider
          mountPath: /etc/traefik
          readOnly: true
        - mountPath: /var/run/docker.sock:z
          name: podmansock
          readOnly: true
        - mountPath: /var/run/tailscale/tailscaled.sock:z
          name: tailscaledsock
      ports:
        - containerPort: 80
          hostPort: 80
          protocol: TCP
        - containerPort: 443
          hostPort: 443
          protocol: TCP
        - containerPort: 4000
          hostPort: 4000
          protocol: TCP
        - containerPort: 9010
          hostPort: 9010
          protocol: TCP
      livenessProbe:
        exec:
          command: ["wget", "-qO-", "http://localhost:4000/ping"]
      resources:
        limits:
          cpu: 1000m
          memory: 512Mi
        requests:
          cpu: 10m
          memory: 75Mi
% if node.name == "inazuma--TODO":
    - name: tsauth
      image: docker.io/library/busybox:stable-uclibc
      command:
        - /tsauth
      volumeMounts:
        - name: tsauthbin
          mountPath: /tsauth
          readOnly: true
        - mountPath: /var/run/tailscale/tailscaled.sock:z
          name: tailscaledsock
% endif
  volumes:
  - name: traefik-data
    hostPath:
      path: /var/lib/traefik
      type: DirectoryOrCreate
  - name: traefik-file-provider
    hostPath:
      path: /etc/traefik
      type: DirectoryOrCreate
  - name: podmansock
    hostPath:
      path: /run/podman/podman.sock
      type: File
  - name: tailscaledsock
    hostPath:
      path: /run/tailscale/tailscaled.sock
      type: File
% if node.name == "inazuma--TODO":
  - name: tsauthbin
    hostPath:
      path: /home/robert/tsauth
      type: File
% endif