fix nas ingress

nas/ingress.yaml

@@ -3,61 +3,83 @@ kind: Namespace
 metadata:
   name: nas-proxy
 ---
-apiVersion: v1
+# cert-manager Certificate for nas.rogi.casa.
-kind: Service
+# Standalone (not owned by an Ingress) so it survives independent of routing.
+apiVersion: cert-manager.io/v1
+kind: Certificate
 metadata:
-  name: synology-nas
+  name: nas-tls
   namespace: nas-proxy
 spec:
-  # Selector-less Service backed by the manual Endpoints below.
+  secretName: nas-tls
-  # (Traefik rejects ExternalName services by default, so we point a
+  dnsNames:
-  # normal ClusterIP Service at the NAS IP via an Endpoints object.)
+    - nas.rogi.casa
-  type: ClusterIP
+  issuerRef:
-  clusterIP: None
+    group: cert-manager.io
-  ports:
+    kind: ClusterIssuer
-  - port: 5001
+    name: letsencrypt-prod
-    targetPort: 5001
+  usages:
-    protocol: TCP
+    - digital signature
+    - key encipherment
 ---
-apiVersion: v1
+# Traefik IngressRoute that dials the NAS directly via kind: Servers.
-kind: Endpoints
+# This avoids:
-metadata:
+#   - Traefik rejecting an ExternalName Service (allowexternalnameservices=false), and
-  name: synology-nas
+#   - ArgoCD excluding an Endpoints object (resource.exclusions strips Endpoints).
-  namespace: nas-proxy
+apiVersion: traefik.io/v1alpha1
-subsets:
+kind: IngressRoute
-- addresses:
-  - ip: 10.88.30.10
-  ports:
-  - port: 5001
-    protocol: TCP
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
 metadata:
   name: nas
   namespace: nas-proxy
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-prod
-    # Tell Traefik the backend is HTTPS (DSM uses HTTPS on 5001)
-    traefik.ingress.kubernetes.io/router.tls: "true"
-    # Skip backend TLS verification since DSM uses a self-signed cert
-    traefik.ingress.kubernetes.io/service.serversscheme: https
-    traefik.ingress.kubernetes.io/service.serverstransport: skip-verify@file
-    traefik.ingress.kubernetes.io/max-request-body-bytes: "5368709120"
 spec:
-  ingressClassName: traefik
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`nas.rogi.casa`)
+      kind: Rule
+      priority: 1
+      services:
+        - kind: Servers
+          scheme: https
+          serversTransport: skip-verify
+          servers:
+            - url: https://10.88.30.10:5001
+          passHostHeader: true
+          responseForwarding:
+            flushInterval: 100ms
   tls:
-  - hosts:
-    - nas.rogi.casa
     secretName: nas-tls
-  rules:
+---
-  - host: nas.rogi.casa
+# HTTP -> HTTPS redirect for nas.rogi.casa
-    http:
+apiVersion: traefik.io/v1alpha1
-      paths:
+kind: IngressRoute
-      - path: /
+metadata:
-        pathType: Prefix
+  name: nas-http-redirect
-        backend:
+  namespace: nas-proxy
-          service:
+spec:
-            name: synology-nas
+  entryPoints:
-            port:
+    - web
-              number: 5001
+  routes:
+    - match: Host(`nas.rogi.casa`)
+      kind: Rule
+      priority: 1
+      middlewares:
+        - name: redirect-to-https
+          namespace: nas-proxy
+      services:
+        # Syntactically required backend; never reached because the redirect
+        # middleware short-circuits the request.
+        - kind: Servers
+          scheme: https
+          servers:
+            - url: https://10.88.30.10:5001
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: redirect-to-https
+  namespace: nas-proxy
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true