# TODO: how to handle services going away (e.g. during update/backup)
apiVersion: v1
kind: Pod
metadata:
  name: traefik
  labels:
    traefik.enable: true
    traefik.http.routers.traefik-metrics.entrypoints: metrics
    traefik.http.routers.traefik-metrics.rule: Path(`/metrics/traefik`)
    traefik.http.routers.traefik-metrics.middlewares: replacepath-bare
    traefik.http.routers.traefik-metrics.service: prometheus@internal
    # common middleware
    ## metrics
    traefik.http.middlewares.replacepath-bare.replacepath.path: /
    traefik.http.middlewares.replacepath-metrics.replacepath.path: /metrics
    ## authelia
    traefik.http.middlewares.authelia.forwardAuth.trustForwardHeader: true
    traefik.http.middlewares.authelia.forwardAuth.authResponseHeaders: Remote-User,Remote-Groups,Remote-Email,Remote-Name
% if node.name == "inazuma":
    traefik.http.middlewares.authelia.forwardAuth.address: http://authelia:9091/api/authz/forward-auth
% elif node.name == "shimakaze":
    traefik.http.middlewares.authelia.forwardAuth.address: http://inazuma:9091/api/authz/forward-auth
% endif
% if node.name == "inazuma--TODO":
    ## tsauth
    traefik.http.middlewares.tsauth.forwardAuth.trustForwardHeader: true
    traefik.http.middlewares.tsauth.forwardAuth.authResponseHeaders: ^Tailscale-
    traefik.http.middlewares.tsauth.forwardAuth.address: http://localhost:3000
% endif
spec:
  restartPolicy: Never
  dnsPolicy: Default
  containers:
    - name: traefik
      image: docker.io/library/traefik:v3.4.3
      args:
        - --log.level=info
        - --accesslog=true
        - --accesslog.format=json
        - --accesslog.filepath=/data/access.log
        - --accesslog.bufferingsize=0
        - --accesslog.fields.headers.defaultmode=drop
        - --accesslog.fields.headers.names.User-Agent=keep
        - --api.dashboard=true
        - --api.insecure=true
        - --metrics.prometheus=true
        - --metrics.prometheus.manualrouting=true
        # providers
        - --providers.file.directory=/etc/traefik
        - --providers.file.watch=true
        - --providers.docker=true
        - --providers.docker.exposedByDefault=false
        # entrypoints
        - --entrypoints.metrics.address=:9010
        - --entrypoints.traefik.address=:4000
        - --entrypoints.http.address=:80
        - --entrypoints.https.address=:443
        # certs
        - --certificatesresolvers.le.acme.email=r+acme@gnzler.io
        - --certificatesresolvers.le.acme.storage=/data/acme.json
        # - --certificatesresolvers.le.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
        # http challenge doesn't work for tailscale endpoints
        # - --certificatesresolvers.le.acme.httpchallenge.entrypoint=http
        - --certificatesresolvers.le.acme.dnschallenge.provider=cloudflare
        - --certificatesresolvers.ts.tailscale=true
      envFrom:
        - secretRef:
            name: traefik
      volumeMounts:
        - name: traefik-data
          mountPath: /data
        - name: traefik-file-provider
          mountPath: /etc/traefik
          readOnly: true
        - mountPath: /var/run/docker.sock:z
          name: podmansock
          readOnly: true
        - mountPath: /var/run/tailscale/tailscaled.sock:z
          name: tailscaledsock
      ports:
        - containerPort: 80
          hostPort: 80
          protocol: TCP
        - containerPort: 443
          hostPort: 443
          protocol: TCP
        - containerPort: 4000
          hostPort: 4000
          protocol: TCP
        - containerPort: 9010
          hostPort: 9010
          protocol: TCP

      # TODO: investigate, not useful on it's own because:
      #       httpGet translates to a curl invocation inside the container, puts
      #       a requirement on the container
      #       https://github.com/containers/podman/blob/v4.8.3/pkg/specgen/generate/kube/kube.go#L647

      # livenessProbe:
      #   httpGet:
      #     path: /ping # needs --ping=true
      #     port: 4000
      #   initialDelaySeconds: 2
      #   periodSeconds: 20
      resources:
        limits:
          cpu: 1000m
          memory: 512Mi
        requests:
          cpu: 10m
          memory: 75Mi
% if node.name == "inazuma--TODO":
    - name: tsauth
      image: docker.io/library/busybox:stable-uclibc
      command:
        - /tsauth
      volumeMounts:
        - name: tsauthbin
          mountPath: /tsauth
          readOnly: true
        - mountPath: /var/run/tailscale/tailscaled.sock:z
          name: tailscaledsock
% endif
  volumes:
  - name: traefik-data
    hostPath:
      path: /var/lib/traefik
      type: DirectoryOrCreate
  - name: traefik-file-provider
    hostPath:
      path: /etc/traefik
      type: DirectoryOrCreate
  - name: podmansock
    hostPath:
      path: /run/podman/podman.sock
      type: File
  - name: tailscaledsock
    hostPath:
      path: /run/tailscale/tailscaled.sock
      type: File
% if node.name == "inazuma--TODO":
  - name: tsauthbin
    hostPath:
      path: /home/robert/tsauth
      type: File
% endif