blob: 11b6d927082c9c1eb09659cbc13a8057b4a3f693 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
|
# TODO: how to handle services going away (e.g. during update/backup)
apiVersion: v1
kind: Pod
metadata:
name: traefik
labels:
spec:
restartPolicy: Never
dnsPolicy: Default
containers:
- name: traefik
image: index.docker.io/library/traefik:v${version}
args:
- --log.level=info
- --accesslog=true
- --accesslog.format=json
- --accesslog.filepath=/data/access.log
- --accesslog.bufferingsize=0
- --accesslog.fields.headers.defaultmode=drop
- --accesslog.fields.headers.names.User-Agent=keep
- --api.dashboard=true
- --api.insecure=true
- --metrics.prometheus=true
- --metrics.prometheus.manualrouting=true
# healthcheck
- --ping=true
- --ping.entrypoint=traefik
- --ping.terminatingstatuscode=204
# providers
- --providers.file.directory=/etc/traefik
- --providers.file.watch=true
- --providers.docker=true
- --providers.docker.exposedByDefault=false
# entrypoints
- --entrypoints.metrics.address=:9010
- --entrypoints.traefik.address=:4000
- --entrypoints.http.address=:80
- --entrypoints.https.address=:443
# entrypoints (web) should handle large blobs
- --entrypoints.http.transport.respondingTimeouts.readTimeout=0s
- --entrypoints.https.transport.respondingTimeouts.readTimeout=0s
# certs
- --certificatesresolvers.le.acme.email=r+acme@gnzler.io
- --certificatesresolvers.le.acme.storage=/data/acme.json
# - --certificatesresolvers.le.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
# http challenge doesn't work for tailscale endpoints
# - --certificatesresolvers.le.acme.httpchallenge.entrypoint=http
- --certificatesresolvers.le.acme.dnschallenge.provider=porkbun
- --certificatesresolvers.ts.tailscale=true
envFrom:
- secretRef:
name: traefik
volumeMounts:
- name: traefik-data
mountPath: /data
- name: traefik-file-provider
mountPath: /etc/traefik
readOnly: true
- mountPath: /var/run/docker.sock:z
name: podmansock
readOnly: true
- mountPath: /var/run/tailscale/tailscaled.sock:z
name: tailscaledsock
ports:
- containerPort: 80
hostPort: 80
protocol: TCP
- containerPort: 443
hostPort: 443
protocol: TCP
- containerPort: 4000
hostPort: 4000
protocol: TCP
- containerPort: 9010
hostPort: 9010
protocol: TCP
livenessProbe:
exec:
command: ["wget", "-qO-", "http://localhost:4000/ping"]
resources:
limits:
cpu: 1000m
memory: 512Mi
requests:
cpu: 10m
memory: 75Mi
% if node.name == "inazuma--TODO":
- name: tsauth
image: docker.io/library/busybox:stable-uclibc
command:
- /tsauth
volumeMounts:
- name: tsauthbin
mountPath: /tsauth
readOnly: true
- mountPath: /var/run/tailscale/tailscaled.sock:z
name: tailscaledsock
% endif
volumes:
- name: traefik-data
hostPath:
path: /var/lib/traefik
type: DirectoryOrCreate
- name: traefik-file-provider
hostPath:
path: /etc/traefik
type: DirectoryOrCreate
- name: podmansock
hostPath:
path: /run/podman/podman.sock
type: File
- name: tailscaledsock
hostPath:
path: /run/tailscale/tailscaled.sock
type: File
% if node.name == "inazuma--TODO":
- name: tsauthbin
hostPath:
path: /home/robert/tsauth
type: File
% endif
|
