dev.aggtaa.com, /, /api, /m to 10.0.64.157

clusters/base/apps/dev/ingress.yaml

@@ -0,0 +1,61 @@
+# Two Ingresses on one host because the auth middleware is per-Ingress:
+# "/" goes through Authelia, "/api" and "/m" are public. Traefik picks the
+# longer path prefix first, so /api and /m never hit the auth router.
+# Both need the tls section (otherwise the router is http-only), but only
+# the first carries the cert-manager annotation so a single Certificate
+# owns the dev-tls secret.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: dev
+  namespace: dev
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.middlewares: auth-authelia@kubernetescrd
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: dev.aggtaa.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: dev
+                port:
+                  name: ui
+  tls:
+    - secretName: dev-tls
+      hosts:
+        - dev.aggtaa.com
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: dev-public
+  namespace: dev
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: dev.aggtaa.com
+      http:
+        paths:
+          - path: /api
+            pathType: Prefix
+            backend:
+              service:
+                name: dev
+                port:
+                  name: api
+          - path: /m
+            pathType: Prefix
+            backend:
+              service:
+                name: dev
+                port:
+                  name: m
+  tls:
+    - secretName: dev-tls
+      hosts:
+        - dev.aggtaa.com

clusters/base/apps/dev/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - service.yaml
+  - ingress.yaml

clusters/base/apps/dev/service.yaml

@@ -0,0 +1,40 @@
+# dev.aggtaa.com backends live outside the cluster on 10.0.64.157:
+# selector-less Service + hand-written EndpointSlice point at them.
+apiVersion: v1
+kind: Service
+metadata:
+  name: dev
+  namespace: dev
+spec:
+  ports:
+    - name: ui
+      port: 10001
+    - name: api
+      port: 10002
+    - name: m
+      port: 10003
+---
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: dev-external
+  namespace: dev
+  labels:
+    kubernetes.io/service-name: dev
+    endpointslice.kubernetes.io/managed-by: flux
+addressType: IPv4
+ports:
+  - name: ui
+    port: 10001
+    protocol: TCP
+  - name: api
+    port: 10002
+    protocol: TCP
+  - name: m
+    port: 10003
+    protocol: TCP
+endpoints:
+  - addresses:
+      - 10.0.64.157
+    conditions:
+      ready: true

clusters/base/namespaces/dev.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: dev

clusters/home/apps/dev.yaml

@@ -0,0 +1,18 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: dev
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./clusters/base/apps/dev
+  prune: true
+  wait: true
+  dependsOn:
+    - name: namespaces
+    - name: infra
+    - name: auth
+  retryInterval: 5s

clusters/home/apps/kustomization.yaml

@@ -15,4 +15,5 @@ resources:
   - syncthing.yaml
   - immich.yaml
   - joplin.yaml
-  - gitea.yaml
+  - gitea.yaml
+  - dev.yaml

clusters/home/namespaces/kustomization.yaml

@@ -17,3 +17,4 @@ resources:
   - ../../base/namespaces/syncthing.yaml
   - ../../base/namespaces/photo.yaml
   - ../../base/namespaces/git.yaml
+  - ../../base/namespaces/dev.yaml