diff --git a/website/src/content/docs/guides/ingress/nginx.md b/website/src/content/docs/guides/ingress/nginx.md index ce4271a6957..9ee8f10e445 100644 --- a/website/src/content/docs/guides/ingress/nginx.md +++ b/website/src/content/docs/guides/ingress/nginx.md @@ -15,7 +15,7 @@ Please note the IP variables that need to be set to your specific configuration #### Internal -``` +```yaml controller: replicaCount: 2 service: @@ -66,7 +66,7 @@ Please note the IP variables that need to be set to your specific configuration #### External -``` +```yaml values: controller: @@ -124,33 +124,39 @@ You can set charts to use either of them by specifying either: or `ingressClassName: external` - ## Annotations Examples Here we will showcase some annotations you can use to customise your NGINX ingress behavior +### Redirect to Https + +```yaml +annotations: + nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" +``` + ### Auth For Authelia, Authentik and more -``` +```yaml annotations: nginx.ingress.kubernetes.io/auth-method: 'GET' - nginx.ingress.kubernetes.io/auth-url: 'http://authelia.default.svc.cluster.local/api/authz/auth-request' - nginx.ingress.kubernetes.io/auth-signin: 'https://auth.example.com?rm=$request_method' + nginx.ingress.kubernetes.io/auth-url: 'http://authelia.authelia.svc.cluster.local:9091/api/verify' + nginx.ingress.kubernetes.io/auth-signin: 'https://auth.${DOMAIN_1}?rm=$request_method' nginx.ingress.kubernetes.io/auth-response-headers: 'Remote-User,Remote-Name,Remote-Groups,Remote-Email' ``` -### IP Whitelist: +### IP Whitelist -``` +```yaml annotations: nginx.ingress.kubernetes.io/whitelist-source-range: 49.36.X.X/32 ``` ### Themepark -``` +```yaml annotations: nginx.ingress.kubernetes.io/configuration-snippet: | proxy_set_header Accept-Encoding ""; @@ -160,3 +166,11 @@ annotations: '; sub_filter_once on; ``` + +### Redirect-Regex + +```yaml +annotations: + nginx.ingress.kubernetes.io/configuration-snippet: | + rewrite ^/$ /admin permanent; +``` diff --git a/website/src/content/docs/guides/ingress/traefik.md b/website/src/content/docs/guides/ingress/traefik.md index 2cc2f28b2bf..2b2986f8775 100644 --- a/website/src/content/docs/guides/ingress/traefik.md +++ b/website/src/content/docs/guides/ingress/traefik.md @@ -4,8 +4,60 @@ title: Traefik ## Setup -### Example setup +For Traefik you will need to install the upstream traefik chart. +Our advised solution for Traefik is to not differentiate between internal and external. Instead we advice using an IP-Whitelist or use tunneling to limit +access for some domains to local. +### Example values + +```yaml +# https://artifacthub.io/packages/helm/traefik/traefik?modal=values +deployment: + enabled: true + replicas: 2 +service: + enabled: true + type: LoadBalancer + annotations: + metallb.io/ip-allocated-from-pool: main + metallb.io/loadBalancerIPs: ${TRAEFIK_IP} + metallb.universe.tf/ip-allocated-from-pool: main + spec: + externalTrafficPolicy: Local +logs: + general: + level: INFO + access: + enabled: true +ingressClass: + enabled: true + isDefaultClass: true +tlsOptions: + default: + minVersion: VersionTLS12 + maxVersion: VersionTLS13 + sniStrict: true +providers: + kubernetesCRD: + enabled: true + allowCrossNamespace: true + allowExternalNameServices: true +tlsStore: + default: + defaultCertificate: + secretName: "${SECRET_PUBLIC_DOMAIN/./-}-tls" +ports: + traefik: + expose: + default: true + web: + redirections: + port: websecure + websecure: + tls: + enabled: true + options: "default" +``` ## Middleware Examples @@ -14,14 +66,104 @@ For more information and all available options, please checkout common ingress d ### General -To setup a TrueCharts chart to create and use a middleware, do this: +To setup a middleware you can specify it in the values of the chart you want to use it in: -TBD +```yaml +ingressMiddlewares: + traefik: + middleware-name: + enabled: true + data: + address: some-address +``` -### Auth +Additionally you have to add them to your ingress like this: -TBD +```yaml +ingress: + main: + enabled: true + integrations: + traefik: + enabled: true + entrypoints: + - websecure + middlewares: + - name: traefik-regex + namespace: traefik + - name: auth + namespace: traefik +``` + +### Authelia Example + +```yaml +ingressMiddlewares: + traefik: + middleware-name: + enabled: true + type: forward-auth + data: + address: http://authelia.authelia.svc.cluster.local:9091/api/verify + authResponseHeadersRegex: '' + trustForwardHeader: true + authResponseHeaders: + - Remote-User + - Remote-Groups + - Remote-Name + - Remote-Email + authRequestHeaders: [] + tls: + insecureSkipVerify: true +``` + +### IP Whitelist + +```yaml +ingressMiddlewares: + traefik: + middleware-name: + enabled: true + type: ip-allow-list + data: + sourceRange: + - 192.168.178.0/24 + ipStrategy: + depth: 1 + excludedIPs: + - some-excluded-ip +``` ### Themepart -TBD +```yaml +ingressMiddlewares: + traefik: + middleware-name: + enabled: true + type: plugin-theme-park + data: + pluginName: my-plugin-name + app: sonarr + theme: dark + baseUrl: https://theme-park.dev + addons: + - some-addon + - some-other-addon +``` + +### Redirect Regex + +```yaml +ingressMiddlewares: + traefik: + middleware-name: + enabled: true + type: redirect-regex + data: + regex: some-regex + replacement: some-replacement + permanent: true +``` + +More Examples can be found in the common docs [here](/common/middlewares/traefik/). diff --git a/website/src/content/docs/guides/talos/staff.md b/website/src/content/docs/guides/staff.md similarity index 100% rename from website/src/content/docs/guides/talos/staff.md rename to website/src/content/docs/guides/staff.md