add kube-sphere

2024-09-22 04:35:03 +01:00
parent 14aee78f76
commit 2e1b3db0ef
70 changed files with 532 additions and 1 deletions
--- a/infrastructure/cert-manager/cert-manager.yaml
+++ b/infrastructure/cert-manager/cert-manager.yaml
@ -0,0 +1,28 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  interval: 12h
+  url: https://charts.jetstack.io
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: cert-manager
+      version: "1.15.3"
+      sourceRef:
+        kind: HelmRepository
+        name: cert-manager
+        namespace: cert-manager
+      interval: 12h
+  values:
+    installCRDs: false
--- a/infrastructure/cert-manager/issuer.yaml
+++ b/infrastructure/cert-manager/issuer.yaml
@ -0,0 +1,22 @@
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-production
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: liam@fascinated.cc
+    privateKeySecretRef:
+      name: letsencrypt-production
+    solvers:
+      - dns01:
+          cloudflare:
+            email: liam@fascinated.cc
+            apiTokenSecretRef:
+              name: cloudflare-token-secret
+              key: cloudflare-token
+        selector:
+          dnsZones:
+            - "fascinated.cc"
+            - "mcutils.xyz"
--- a/infrastructure/cert-manager/kustomization.yaml
+++ b/infrastructure/cert-manager/kustomization.yaml
@ -0,0 +1,8 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: cert-manager
+resources:
+  - namespace.yaml
+  - cert-manager.yaml
+  - issuer.yaml
--- a/infrastructure/cert-manager/namespace.yaml
+++ b/infrastructure/cert-manager/namespace.yaml
@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cert-manager
--- a/infrastructure/kube-sphere/config.yaml
+++ b/infrastructure/kube-sphere/config.yaml
@ -0,0 +1,206 @@
+---
+apiVersion: installer.kubesphere.io/v1alpha1
+kind: ClusterConfiguration
+metadata:
+  name: ks-installer
+  namespace: kubesphere-system
+  labels:
+    version: v3.4.0
+spec:
+  persistence:
+    storageClass: "" # If there is no default StorageClass in your cluster, you need to specify an existing StorageClass here.
+  authentication:
+    # adminPassword: ""     # Custom password of the admin user. If the parameter exists but the value is empty, a random password is generated. If the parameter does not exist, P@88w0rd is used.
+    jwtSecret: "" # Keep the jwtSecret consistent with the Host Cluster. Retrieve the jwtSecret by executing "kubectl -n kubesphere-system get cm kubesphere-config -o yaml | grep -v "apiVersion" | grep jwtSecret" on the Host Cluster.
+  local_registry: "" # Add your private registry address if it is needed.
+  #  dev_tag: ""               # Add your kubesphere image tag you want to install, by default it's same as ks-installer release version.
+  etcd:
+    monitoring: false # Enable or disable etcd monitoring dashboard installation. You have to create a Secret for etcd before you enable it.
+    endpointIps: localhost # etcd cluster EndpointIps. It can be a bunch of IPs here.
+    port: 2379 # etcd port.
+    tlsEnable: true
+  common:
+    core:
+      console:
+        enableMultiLogin: true # Enable or disable simultaneous logins. It allows different users to log in with the same account at the same time.
+        port: 30880
+        type: NodePort
+
+    # apiserver:            # Enlarge the apiserver and controller manager's resource requests and limits for the large cluster
+    #  resources: {}
+    # controllerManager:
+    #  resources: {}
+    redis:
+      enabled: false
+      enableHA: false
+      volumeSize: 2Gi # Redis PVC size.
+    openldap:
+      enabled: false
+      volumeSize: 2Gi # openldap PVC size.
+    minio:
+      volumeSize: 20Gi # Minio PVC size.
+    monitoring:
+      # type: external   # Whether to specify the external prometheus stack, and need to modify the endpoint at the next line.
+      endpoint: http://prometheus-operated.kubesphere-monitoring-system.svc:9090 # Prometheus endpoint to get metrics data.
+      GPUMonitoring: # Enable or disable the GPU-related metrics. If you enable this switch but have no GPU resources, Kubesphere will set it to zero.
+        enabled: false
+    gpu: # Install GPUKinds. The default GPU kind is nvidia.com/gpu. Other GPU kinds can be added here according to your needs.
+      kinds:
+        - resourceName: "nvidia.com/gpu"
+          resourceType: "GPU"
+          default: true
+    es: # Storage backend for logging, events and auditing.
+      # master:
+      #   volumeSize: 4Gi  # The volume size of Elasticsearch master nodes.
+      #   replicas: 1      # The total number of master nodes. Even numbers are not allowed.
+      #   resources: {}
+      # data:
+      #   volumeSize: 20Gi  # The volume size of Elasticsearch data nodes.
+      #   replicas: 1       # The total number of data nodes.
+      #   resources: {}
+      enabled: false
+      logMaxAge: 7 # Log retention time in built-in Elasticsearch. It is 7 days by default.
+      elkPrefix: logstash # The string making up index names. The index name will be formatted as ks-<elk_prefix>-log.
+      basicAuth:
+        enabled: false
+        username: ""
+        password: ""
+      externalElasticsearchHost: ""
+      externalElasticsearchPort: ""
+    opensearch: # Storage backend for logging, events and auditing.
+      # master:
+      #   volumeSize: 4Gi  # The volume size of Opensearch master nodes.
+      #   replicas: 1      # The total number of master nodes. Even numbers are not allowed.
+      #   resources: {}
+      # data:
+      #   volumeSize: 20Gi  # The volume size of Opensearch data nodes.
+      #   replicas: 1       # The total number of data nodes.
+      #   resources: {}
+      enabled: true
+      logMaxAge: 7 # Log retention time in built-in Opensearch. It is 7 days by default.
+      opensearchPrefix: whizard # The string making up index names. The index name will be formatted as ks-<opensearchPrefix>-logging.
+      basicAuth:
+        enabled: true
+        username: "admin"
+        password: "admin"
+      externalOpensearchHost: ""
+      externalOpensearchPort: ""
+      dashboard:
+        enabled: false
+  alerting: # (CPU: 0.1 Core, Memory: 100 MiB) It enables users to customize alerting policies to send messages to receivers in time with different time intervals and alerting levels to choose from.
+    enabled: false # Enable or disable the KubeSphere Alerting System.
+    # thanosruler:
+    #   replicas: 1
+    #   resources: {}
+  auditing: # Provide a security-relevant chronological set of records，recording the sequence of activities happening on the platform, initiated by different tenants.
+    enabled: false # Enable or disable the KubeSphere Auditing Log System.
+    # operator:
+    #   resources: {}
+    # webhook:
+    #   resources: {}
+  devops: # (CPU: 0.47 Core, Memory: 8.6 G) Provide an out-of-the-box CI/CD system based on Jenkins, and automated workflow tools including Source-to-Image & Binary-to-Image.
+    enabled: false # Enable or disable the KubeSphere DevOps System.
+    jenkinsCpuReq: 0.5
+    jenkinsCpuLim: 1
+    jenkinsMemoryReq: 4Gi
+    jenkinsMemoryLim: 4Gi # Recommend keep same as requests.memory.
+    jenkinsVolumeSize: 16Gi
+  events: # Provide a graphical web console for Kubernetes Events exporting, filtering and alerting in multi-tenant Kubernetes clusters.
+    enabled: false # Enable or disable the KubeSphere Events System.
+    # operator:
+    #   resources: {}
+    # exporter:
+    #   resources: {}
+    ruler:
+      enabled: true
+      replicas: 2
+    #   resources: {}
+  logging: # (CPU: 57 m, Memory: 2.76 G) Flexible logging functions are provided for log query, collection and management in a unified console. Additional log collectors can be added, such as Elasticsearch, Kafka and Fluentd.
+    enabled: false # Enable or disable the KubeSphere Logging System.
+    logsidecar:
+      enabled: true
+      replicas: 2
+      # resources: {}
+  metrics_server: # (CPU: 56 m, Memory: 44.35 MiB) It enables HPA (Horizontal Pod Autoscaler).
+    enabled: false # Enable or disable metrics-server.
+  monitoring:
+    storageClass: "" # If there is an independent StorageClass you need for Prometheus, you can specify it here. The default StorageClass is used by default.
+    node_exporter:
+      port: 9100
+      # resources: {}
+    # kube_rbac_proxy:
+    #   resources: {}
+    # kube_state_metrics:
+    #   resources: {}
+    # prometheus:
+    #   replicas: 1  # Prometheus replicas are responsible for monitoring different segments of data source and providing high availability.
+    #   volumeSize: 20Gi  # Prometheus PVC size.
+    #   resources: {}
+    #   operator:
+    #     resources: {}
+    # alertmanager:
+    #   replicas: 1          # AlertManager Replicas.
+    #   resources: {}
+    # notification_manager:
+    #   resources: {}
+    #   operator:
+    #     resources: {}
+    #   proxy:
+    #     resources: {}
+    gpu: # GPU monitoring-related plug-in installation.
+      nvidia_dcgm_exporter: # Ensure that gpu resources on your hosts can be used normally, otherwise this plug-in will not work properly.
+        enabled: false # Check whether the labels on the GPU hosts contain "nvidia.com/gpu.present=true" to ensure that the DCGM pod is scheduled to these nodes.
+        # resources: {}
+  multicluster:
+    clusterRole: none # host | member | none  # You can install a solo cluster, or specify it as the Host or Member Cluster.
+  network:
+    networkpolicy: # Network policies allow network isolation within the same cluster, which means firewalls can be set up between certain instances (Pods).
+      # Make sure that the CNI network plugin used by the cluster supports NetworkPolicy. There are a number of CNI network plugins that support NetworkPolicy, including Calico, Cilium, Kube-router, Romana and Weave Net.
+      enabled: false # Enable or disable network policies.
+    ippool: # Use Pod IP Pools to manage the Pod network address space. Pods to be created can be assigned IP addresses from a Pod IP Pool.
+      type: none # Specify "calico" for this field if Calico is used as your CNI plugin. "none" means that Pod IP Pools are disabled.
+    topology: # Use Service Topology to view Service-to-Service communication based on Weave Scope.
+      type: none # Specify "weave-scope" for this field to enable Service Topology. "none" means that Service Topology is disabled.
+  openpitrix: # An App Store that is accessible to all platform tenants. You can use it to manage apps across their entire lifecycle.
+    store:
+      enabled: false # Enable or disable the KubeSphere App Store.
+  servicemesh: # (0.3 Core, 300 MiB) Provide fine-grained traffic management, observability and tracing, and visualized traffic topology.
+    enabled: false # Base component (pilot). Enable or disable KubeSphere Service Mesh (Istio-based).
+    istio: # Customizing the istio installation configuration, refer to https://istio.io/latest/docs/setup/additional-setup/customize-installation/
+      components:
+        ingressGateways:
+          - name: istio-ingressgateway
+            enabled: false
+        cni:
+          enabled: false
+  edgeruntime: # Add edge nodes to your cluster and deploy workloads on edge nodes.
+    enabled: false
+    kubeedge: # kubeedge configurations
+      enabled: false
+      cloudCore:
+        cloudHub:
+          advertiseAddress: # At least a public IP address or an IP address which can be accessed by edge nodes must be provided.
+            - "" # Note that once KubeEdge is enabled, CloudCore will malfunction if the address is not provided.
+        service:
+          cloudhubNodePort: "30000"
+          cloudhubQuicNodePort: "30001"
+          cloudhubHttpsNodePort: "30002"
+          cloudstreamNodePort: "30003"
+          tunnelNodePort: "30004"
+        # resources: {}
+        # hostNetWork: false
+      iptables-manager:
+        enabled: true
+        mode: "external"
+        # resources: {}
+      # edgeService:
+      #   resources: {}
+  gatekeeper: # Provide admission policy and rule management, A validating (mutating TBA) webhook that enforces CRD-based policies executed by Open Policy Agent.
+    enabled: false # Enable or disable Gatekeeper.
+    # controller_manager:
+    #   resources: {}
+    # audit:
+    #   resources: {}
+  terminal:
+    # image: 'alpine:3.15' # There must be an nsenter program in the image
+    timeout: 600 # Container timeout, if set to 0, no timeout will be used. The unit is seconds
--- a/infrastructure/kube-sphere/installer.yaml
+++ b/infrastructure/kube-sphere/installer.yaml
@ -0,0 +1,312 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: clusterconfigurations.installer.kubesphere.io
+spec:
+  group: installer.kubesphere.io
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          properties:
+            spec:
+              type: object
+              x-kubernetes-preserve-unknown-fields: true
+            status:
+              type: object
+              x-kubernetes-preserve-unknown-fields: true
+  scope: Namespaced
+  names:
+    plural: clusterconfigurations
+    singular: clusterconfiguration
+    kind: ClusterConfiguration
+    shortNames:
+      - cc
+
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kubesphere-system
+
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ks-installer
+  namespace: kubesphere-system
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: ks-installer
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - apps
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - extensions
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - batch
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - rbac.authorization.k8s.io
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - apiregistration.k8s.io
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - tenant.kubesphere.io
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - certificates.k8s.io
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - devops.kubesphere.io
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - monitoring.coreos.com
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - logging.kubesphere.io
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - jaegertracing.io
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - storage.k8s.io
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - admissionregistration.k8s.io
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - policy
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - autoscaling
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - networking.istio.io
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - config.istio.io
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - iam.kubesphere.io
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - notification.kubesphere.io
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - auditing.kubesphere.io
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - events.kubesphere.io
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - core.kubefed.io
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - installer.kubesphere.io
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - storage.kubesphere.io
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - security.istio.io
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - monitoring.kiali.io
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - kiali.io
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - edgeruntime.kubesphere.io
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - types.kubefed.io
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - monitoring.kubesphere.io
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - application.kubesphere.io
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - alerting.kubesphere.io
+    resources:
+      - "*"
+    verbs:
+      - "*"
+
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: ks-installer
+subjects:
+  - kind: ServiceAccount
+    name: ks-installer
+    namespace: kubesphere-system
+roleRef:
+  kind: ClusterRole
+  name: ks-installer
+  apiGroup: rbac.authorization.k8s.io
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ks-installer
+  namespace: kubesphere-system
+  labels:
+    app: ks-installer
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: ks-installer
+  template:
+    metadata:
+      labels:
+        app: ks-installer
+    spec:
+      serviceAccountName: ks-installer
+      containers:
+        - name: installer
+          image: kubesphere/ks-installer:v3.4.0
+          imagePullPolicy: "Always"
+          resources:
+            limits:
+              cpu: "1"
+              memory: 1Gi
+            requests:
+              cpu: 20m
+              memory: 100Mi
+          volumeMounts:
+            - mountPath: /etc/localtime
+              name: host-time
+              readOnly: true
+      volumes:
+        - hostPath:
+            path: /etc/localtime
+            type: ""
+          name: host-time
--- a/infrastructure/kube-sphere/kustomization.yaml
+++ b/infrastructure/kube-sphere/kustomization.yaml
@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: kubesphere-system
+resources:
+  - config.yaml
+  - installer.yaml
--- a/infrastructure/kustomization.yaml
+++ b/infrastructure/kustomization.yaml
@ -2,6 +2,11 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - cert-manager
  - crds
+  - metallb
  - nfs
+  - traefik
+  - kube-sphere
+  - monitoring
  - alerting/flux
--- a/infrastructure/metallb/ipaddresspool.yaml
+++ b/infrastructure/metallb/ipaddresspool.yaml
@ -0,0 +1,9 @@
+---
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: default
+  namespace: metallb-system
+spec:
+  addresses:
+    - 10.0.69.200-10.0.69.254
--- a/infrastructure/metallb/kustomization.yaml
+++ b/infrastructure/metallb/kustomization.yaml
@ -0,0 +1,8 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: metallb-system
+resources:
+  - metallb.yaml
+  - ipaddresspool.yaml
+  - l2advertisement.yaml
--- a/infrastructure/metallb/l2advertisement.yaml
+++ b/infrastructure/metallb/l2advertisement.yaml
@ -0,0 +1,5 @@
+apiVersion: metallb.io/v1beta1
+kind: L2Advertisement
+metadata:
+  name: default
+  namespace: metallb-system
--- a/infrastructure/metallb/metallb.yaml
+++ b/infrastructure/metallb/metallb.yaml
--- a/infrastructure/monitoring/ingress.yml
+++ b/infrastructure/monitoring/ingress.yml
@ -0,0 +1,21 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: kubernetes-grafana-external-ingress
+  namespace: monitoring
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`kubernetes-grafana.local.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: kube-prometheus-stack-grafana
+          port: 80
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/monitoring/kube-prometheus-stack.yaml
+++ b/infrastructure/monitoring/kube-prometheus-stack.yaml
@ -0,0 +1,26 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: monitoring
+  namespace: monitoring
+spec:
+  interval: 12h
+  url: https://prometheus-community.github.io/helm-charts
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: kube-prometheus-stack
+  namespace: monitoring
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: kube-prometheus-stack
+      version: "62.7.0"
+      sourceRef:
+        kind: HelmRepository
+        name: monitoring
+        namespace: monitoring
+      interval: 12h
--- a/infrastructure/monitoring/kustomization.yaml
+++ b/infrastructure/monitoring/kustomization.yaml
@ -0,0 +1,8 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: monitoring
+resources:
+  - namespace.yaml
+  - kube-prometheus-stack.yaml
+  - ingress.yml
--- a/infrastructure/monitoring/namespace.yaml
+++ b/infrastructure/monitoring/namespace.yaml
@ -0,0 +1,8 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: monitoring
+  labels:
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/enforce-version: latest
--- a/infrastructure/traefik/certificates/fascinated-cc.yaml
+++ b/infrastructure/traefik/certificates/fascinated-cc.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: fascinated-cc
+  namespace: traefik
+spec:
+  secretName: fascinated-cc
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: "*.fascinated.cc"
+  dnsNames:
+    - "fascinated.cc"
+    - "*.fascinated.cc"
--- a/infrastructure/traefik/certificates/local-fascinated-cc.yaml
+++ b/infrastructure/traefik/certificates/local-fascinated-cc.yaml
@ -0,0 +1,14 @@
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: local-fascinated-cc
+  namespace: traefik
+spec:
+  secretName: local-fascinated-cc
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: "*.local.fascinated.cc"
+  dnsNames:
+    - "*.local.fascinated.cc"
--- a/infrastructure/traefik/certificates/mcutils-xyz.yaml
+++ b/infrastructure/traefik/certificates/mcutils-xyz.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: mcutils-xyz
+  namespace: traefik
+spec:
+  secretName: mcutils-xyz
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: "*.mcutils.xyz"
+  dnsNames:
+    - "mcutils.xyz"
+    - "*.mcutils.xyz"
--- a/infrastructure/traefik/external-services/aetheria-grafana.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/aetheria-grafana.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: aetheria-grafana-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.225
+  ports:
+    - name: http
+      port: 3000
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: aetheria-grafana-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`aetheria-grafana.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: aetheria-grafana-external
+          port: 3000
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/traefik/external-services/aetheria-influx.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/aetheria-influx.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: aetheria-influx-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.225
+  ports:
+    - name: http
+      port: 8086
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: aetheria-influx-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`aetheria-influx.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: aetheria-influx-external
+          port: 8086
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/traefik/external-services/analytics.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/analytics.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: analytics-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.120
+  ports:
+    - name: http
+      port: 8000
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: analytics-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`analytics.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: analytics-external
+          port: 8000
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/traefik/external-services/api.mcutils.xyz.yml
+++ b/infrastructure/traefik/external-services/api.mcutils.xyz.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: mc-utils-api-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.137
+  ports:
+    - name: http
+      port: 80
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: mc-utils-api-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`api.mcutils.xyz`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: mc-utils-api-external
+          port: 80
+  tls:
+    secretName: mcutils-xyz
--- a/infrastructure/traefik/external-services/azure-metrics.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/azure-metrics.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: azure-metrics-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.204
+  ports:
+    - name: http
+      port: 3000
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: azure-metrics-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`azure-metrics.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: azure-metrics-external
+          port: 3000
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/traefik/external-services/azure-phpma.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/azure-phpma.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: azure-phpma-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.204
+  ports:
+    - name: http
+      port: 8080
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: azure-phpma-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`azure-phpma.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: azure-phpma-external
+          port: 8080
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/traefik/external-services/bitmagnet.local.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/bitmagnet.local.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: bitmagnet-local-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.142
+  ports:
+    - name: http
+      port: 3333
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: bitmagnet-local-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`bitmagnet.local.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: bitmagnet-local-external
+          port: 3333
+  tls:
+    secretName: local-fascinated-cc
--- a/infrastructure/traefik/external-services/cdn.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/cdn.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: cdn-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.0.136
+  ports:
+    - name: http
+      port: 8087
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: cdn-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`cdn.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: cdn-external
+          port: 8087
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/traefik/external-services/cloud.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/cloud.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: nextcloud-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.160
+  ports:
+    - name: http
+      port: 80
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: nextcloud-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`cloud.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: nextcloud-external
+          port: 80
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/traefik/external-services/docs.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/docs.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: docs-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.254
+  ports:
+    - name: http
+      port: 80
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: docs-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`docs.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: docs-external
+          port: 80
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/traefik/external-services/fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: main-site-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.209
+  ports:
+    - name: http
+      port: 3000
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: main-site-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: main-site-external
+          port: 3000
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/traefik/external-services/git.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/git.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: git-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.235
+  ports:
+    - name: http
+      port: 3003
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: git-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`git.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: git-external
+          port: 3003
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/traefik/external-services/glitchtip.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/glitchtip.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: sentry-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.36
+  ports:
+    - name: http
+      port: 8000
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: sentry-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`glitchtip.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: sentry-external
+          port: 8000
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/traefik/external-services/grafana.mcutils.xyz.yml
+++ b/infrastructure/traefik/external-services/grafana.mcutils.xyz.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: mc-utils-grafana-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.137
+  ports:
+    - name: http
+      port: 3000
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: mc-utils-grafana-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`grafana.mcutils.xyz`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: mc-utils-grafana-external
+          port: 3000
+  tls:
+    secretName: mcutils-xyz
--- a/infrastructure/traefik/external-services/img.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/img.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: img-proxy-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.185
+  ports:
+    - name: http
+      port: 8080
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: img-proxy-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`img.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: img-proxy-external
+          port: 8080
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/traefik/external-services/influx.mcutils.xyz.yml
+++ b/infrastructure/traefik/external-services/influx.mcutils.xyz.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: mc-utils-influx-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.137
+  ports:
+    - name: http
+      port: 8086
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: mc-utils-influx-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`influx.mcutils.xyz`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: mc-utils-influx-external
+          port: 8086
+  tls:
+    secretName: mcutils-xyz
--- a/infrastructure/traefik/external-services/mastodon.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/mastodon.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: mastodon-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.0.136
+  ports:
+    - name: http
+      port: 3000
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: mastodon-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`mastodon.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: mastodon-external
+          port: 3000
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/traefik/external-services/mc-tracker.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/mc-tracker.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: mc-tracker-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.3.76
+  ports:
+    - name: http
+      port: 3000
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: mc-tracker-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`mc-tracker.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: mc-tracker-external
+          port: 3000
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/traefik/external-services/mcutils.xyz.yml
+++ b/infrastructure/traefik/external-services/mcutils.xyz.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: mc-utils-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.137
+  ports:
+    - name: http
+      port: 80
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: mc-utils-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`mcutils.xyz`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: mc-utils-external
+          port: 80
+  tls:
+    secretName: mcutils-xyz
--- a/infrastructure/traefik/external-services/node-hl-01.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/node-hl-01.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: node-hl-01-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.222
+  ports:
+    - name: http
+      port: 443
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: node-hl-01-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`node-hl-01.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: node-hl-01-external
+          port: 443
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/traefik/external-services/obsidian-sync.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/obsidian-sync.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: obsidian-sync-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.184
+  ports:
+    - name: http
+      port: 5984
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: obsidian-sync-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`obsidian-sync.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: obsidian-sync-external
+          port: 5984
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/traefik/external-services/overseerr.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/overseerr.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: overseerr-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.0.136
+  ports:
+    - name: http
+      port: 5055
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: overseerr-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`overseerr.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: overseerr-external
+          port: 5055
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/traefik/external-services/owntracks-web.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/owntracks-web.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: owntracks-web-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.43
+  ports:
+    - name: http
+      port: 6969
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: owntracks-web-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`owntracks-web.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: owntracks-web-external
+          port: 6969
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/traefik/external-services/owntracks.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/owntracks.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: owntracks-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.43
+  ports:
+    - name: http
+      port: 8083
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: owntracks-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`owntracks.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: owntracks-external
+          port: 8083
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/traefik/external-services/panel.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/panel.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: panel-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.244
+  ports:
+    - name: http
+      port: 80
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: panel-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`panel.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: panel-external
+          port: 80
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/traefik/external-services/paste-grafana.local.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/paste-grafana.local.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: paste-grafana-local-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.118
+  ports:
+    - name: http
+      port: 3035
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: paste-grafana-local-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`paste-grafana.local.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: paste-grafana-local-external
+          port: 3035
+  tls:
+    secretName: local-fascinated-cc
--- a/infrastructure/traefik/external-services/plex.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/plex.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: plex-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.0.235
+  ports:
+    - name: http
+      port: 32400
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: plex-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`plex.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: plex-external
+          port: 32400
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/traefik/external-services/proxmox.local.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/proxmox.local.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: proxmox-luna-local-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.2
+  ports:
+    - name: https
+      port: 8006
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: proxmox-luna-local-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`proxmox.local.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: proxmox-luna-local-external
+          port: 8006
+  tls:
+    secretName: local-fascinated-cc
--- a/infrastructure/traefik/external-services/repo.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/repo.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: repo-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.164
+  ports:
+    - name: http
+      port: 8080
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: repo-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`repo.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: repo-external
+          port: 8080
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/traefik/external-services/restic.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/restic.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: restic-backups-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.0.136
+  ports:
+    - name: http
+      port: 8000
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: restic-backups-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`restic.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: restic-backups-external
+          port: 8000
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/traefik/external-services/s.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/s.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: slash-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.133
+  ports:
+    - name: http
+      port: 5231
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: slash-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`s.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: slash-external
+          port: 5231
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/traefik/external-services/sonarr-anime.local.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/sonarr-anime.local.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: sonarr-anime-local-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.0.136
+  ports:
+    - name: http
+      port: 8988
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: sonarr-anime-local-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`sonarr-anime.local.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: sonarr-anime-local-external
+          port: 8988
+  tls:
+    secretName: local-fascinated-cc
--- a/infrastructure/traefik/external-services/sonarr.local.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/sonarr.local.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: sonarr-local-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.0.136
+  ports:
+    - name: http
+      port: 8989
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: sonarr-local-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`sonarr.local.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: sonarr-local-external
+          port: 8989
+  tls:
+    secretName: local-fascinated-cc
--- a/infrastructure/traefik/external-services/ssr-staging.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/ssr-staging.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: ssr-staging-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.65
+  ports:
+    - name: http
+      port: 80
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: ssr-staging-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`ssr-staging.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: ssr-staging-external
+          port: 80
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/traefik/external-services/status.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/status.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: status-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.8
+  ports:
+    - name: http
+      port: 3001
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: status-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`status.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: status-external
+          port: 3001
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/traefik/external-services/subscriptions.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/subscriptions.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: subscriptions-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.35
+  ports:
+    - name: http
+      port: 8282
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: subscriptions-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`subscriptions.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: subscriptions-external
+          port: 8282
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/traefik/external-services/tautulli.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/tautulli.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: tautulli-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.183
+  ports:
+    - name: http
+      port: 8181
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: tautulli-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`tautulli.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: tautulli-external
+          port: 8181
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/traefik/external-services/tdarr.local.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/tdarr.local.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: tdarr-local-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.0.136
+  ports:
+    - name: http
+      port: 8265
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: tdarr-local-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`tdarr.local.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: tdarr-local-external
+          port: 8265
+  tls:
+    secretName: local-fascinated-cc
--- a/infrastructure/traefik/external-services/teleport.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/teleport.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: teleport-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.182
+  ports:
+    - name: https
+      port: 3080
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: teleport-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`teleport.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: teleport-external
+          port: 3080
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/traefik/external-services/torrent.local.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/torrent.local.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: torrent-local-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.0.136
+  ports:
+    - name: http
+      port: 8080
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: torrent-local-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`torrent.local.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: torrent-local-external
+          port: 8080
+  tls:
+    secretName: local-fascinated-cc
--- a/infrastructure/traefik/external-services/translate.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/translate.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: translate-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.116
+  ports:
+    - name: http
+      port: 5000
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: translate-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`translate.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: translate-external
+          port: 5000
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/traefik/external-services/tube.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/tube.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: tube-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.0.136
+  ports:
+    - name: http
+      port: 8209
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: tube-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`tube.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: tube-external
+          port: 8209
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/traefik/external-services/vaultwarden.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/vaultwarden.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: vaultwarden-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.224
+  ports:
+    - name: http
+      port: 4743
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: vaultwarden-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`vaultwarden.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: vaultwarden-external
+          port: 4743
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/traefik/external-services/vencloud.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/vencloud.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: vencloud-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.202
+  ports:
+    - name: http
+      port: 8080
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: vencloud-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`vencloud.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: vencloud-external
+          port: 8080
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/traefik/external-services/wakatime.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/wakatime.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: wakatime-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.251
+  ports:
+    - name: http
+      port: 3355
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: wakatime-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`wakatime.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: wakatime-external
+          port: 3355
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/traefik/external-services/wazuh.local.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/wazuh.local.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: wazuh-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.212
+  ports:
+    - name: https
+      port: 443
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: wazuh-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`wazuh.local.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: wazuh-external
+          port: 443
+  tls:
+    secretName: local-fascinated-cc
--- a/infrastructure/traefik/external-services/wiki.fascinated.cc.yml
+++ b/infrastructure/traefik/external-services/wiki.fascinated.cc.yml
@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: wiki-external
+  namespace: traefik
+spec:
+  type: ExternalName
+  externalName: 10.0.50.254
+  ports:
+    - name: http
+      port: 80
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: wiki-external-ingress
+  namespace: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`wiki.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: wiki-external
+          port: 80
+  tls:
+    secretName: fascinated-cc
--- a/infrastructure/traefik/kustomization.yaml
+++ b/infrastructure/traefik/kustomization.yaml
@ -0,0 +1,13 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: traefik
+resources:
+  - namespace.yaml
+  - traefik.yaml
+  - ./certificates/fascinated-cc.yaml
+  - ./certificates/local-fascinated-cc.yaml
+  - ./certificates/mcutils-xyz.yaml
+  - ./middlewares/default-headers.yaml
+  #- ./external-services
+  # for some stupid fucking reason kustomize doesn't support wildcards or globs?!?!?!??!?
--- a/infrastructure/traefik/middlewares/default-headers.yaml
+++ b/infrastructure/traefik/middlewares/default-headers.yaml
@ -0,0 +1,18 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: default-headers
+  namespace: traefik
+spec:
+  headers:
+    browserXssFilter: true
+    contentTypeNosniff: true
+    forceSTSHeader: true
+    stsIncludeSubdomains: true
+    stsPreload: true
+    stsSeconds: 15552000
+    referrerPolicy: no-referrer
+    contentSecurityPolicy: "default-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' https: data:; connect-src 'self' https:; frame-src 'self' https:; media-src 'self' https:; object-src 'none'; frame-ancestors 'self'; base-uri 'self'; form-action 'self';"
+    customFrameOptionsValue: SAMEORIGIN
+    customRequestHeaders:
+      X-Forwarded-Proto: https
--- a/infrastructure/traefik/namespace.yaml
+++ b/infrastructure/traefik/namespace.yaml
@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: traefik
--- a/infrastructure/traefik/traefik.yaml
+++ b/infrastructure/traefik/traefik.yaml
@ -0,0 +1,83 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: traefik
+  namespace: traefik
+spec:
+  interval: 12h
+  url: https://helm.traefik.io/traefik
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: traefik
+  namespace: traefik
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: traefik
+      version: "31.1.1"
+      sourceRef:
+        kind: HelmRepository
+        name: traefik
+        namespace: traefik
+      interval: 12h
+  values:
+    globalArguments:
+      - "--global.sendanonymoususage=false"
+      - "--global.checknewversion=false"
+
+    additionalArguments:
+      - "--serversTransport.insecureSkipVerify=true"
+      - "--log.level=INFO"
+      - "--providers.kubernetescrd.allowCrossNamespace=true"
+      - "--accesslog=true"
+
+    deployment:
+      enabled: true
+      replicas: 1
+      annotations: {}
+      podAnnotations: {}
+      additionalContainers: []
+      initContainers: []
+
+    ports:
+      web:
+        redirectTo:
+          port: websecure
+          priority: 10
+      websecure:
+        tls:
+          enabled: true
+
+    ingressRoute:
+      dashboard:
+        enabled: false
+
+    providers:
+      kubernetesCRD:
+        enabled: true
+        ingressClass: traefik-external
+        allowExternalNameServices: true
+        allowCrossNamespace: true
+      kubernetesIngress:
+        enabled: true
+        allowExternalNameServices: true
+        allowCrossNamespace: true
+        publishedService:
+          enabled: false
+
+    rbac:
+      enabled: true
+
+    service:
+      enabled: true
+      type: LoadBalancer
+      annotations: {}
+      labels: {}
+      spec:
+        loadBalancerIP: 10.0.69.250
+      loadBalancerSourceRanges: []
+      externalIPs: []