From 954a0b4000cf0b6e016ef20f65b94e97fedb61ae Mon Sep 17 00:00:00 2001
From: "azykov@mail.ru" <azykov@mail.ru>
Date: Tue, 29 Sep 2026 12:50:05 +0300
Subject: [PATCH] dev.aggtaa.com, /, /api, /m to 10.0.64.157

---
 clusters/base/apps/dev/ingress.yaml         | 61 +++++++++++++++++++++
 clusters/base/apps/dev/kustomization.yaml   |  5 ++
 clusters/base/apps/dev/service.yaml         | 40 ++++++++++++++
 clusters/base/namespaces/dev.yaml           |  4 ++
 clusters/home/apps/dev.yaml                 | 18 ++++++
 clusters/home/apps/kustomization.yaml       |  3 +-
 clusters/home/namespaces/kustomization.yaml |  1 +
 7 files changed, 131 insertions(+), 1 deletion(-)
 create mode 100644 clusters/base/apps/dev/ingress.yaml
 create mode 100644 clusters/base/apps/dev/kustomization.yaml
 create mode 100644 clusters/base/apps/dev/service.yaml
 create mode 100644 clusters/base/namespaces/dev.yaml
 create mode 100644 clusters/home/apps/dev.yaml

diff --git a/clusters/base/apps/dev/ingress.yaml b/clusters/base/apps/dev/ingress.yaml
new file mode 100644
index 0000000..815878d
--- /dev/null
+++ b/clusters/base/apps/dev/ingress.yaml
@@ -0,0 +1,61 @@
+# Two Ingresses on one host because the auth middleware is per-Ingress:
+# "/" goes through Authelia, "/api" and "/m" are public. Traefik picks the
+# longer path prefix first, so /api and /m never hit the auth router.
+# Both need the tls section (otherwise the router is http-only), but only
+# the first carries the cert-manager annotation so a single Certificate
+# owns the dev-tls secret.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: dev
+  namespace: dev
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.middlewares: auth-authelia@kubernetescrd
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: dev.aggtaa.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: dev
+                port:
+                  name: ui
+  tls:
+    - secretName: dev-tls
+      hosts:
+        - dev.aggtaa.com
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: dev-public
+  namespace: dev
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: dev.aggtaa.com
+      http:
+        paths:
+          - path: /api
+            pathType: Prefix
+            backend:
+              service:
+                name: dev
+                port:
+                  name: api
+          - path: /m
+            pathType: Prefix
+            backend:
+              service:
+                name: dev
+                port:
+                  name: m
+  tls:
+    - secretName: dev-tls
+      hosts:
+        - dev.aggtaa.com
diff --git a/clusters/base/apps/dev/kustomization.yaml b/clusters/base/apps/dev/kustomization.yaml
new file mode 100644
index 0000000..ab2ea8d
--- /dev/null
+++ b/clusters/base/apps/dev/kustomization.yaml
@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - service.yaml
+  - ingress.yaml
diff --git a/clusters/base/apps/dev/service.yaml b/clusters/base/apps/dev/service.yaml
new file mode 100644
index 0000000..879a59c
--- /dev/null
+++ b/clusters/base/apps/dev/service.yaml
@@ -0,0 +1,40 @@
+# dev.aggtaa.com backends live outside the cluster on 10.0.64.157:
+# selector-less Service + hand-written EndpointSlice point at them.
+apiVersion: v1
+kind: Service
+metadata:
+  name: dev
+  namespace: dev
+spec:
+  ports:
+    - name: ui
+      port: 10001
+    - name: api
+      port: 10002
+    - name: m
+      port: 10003
+---
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: dev-external
+  namespace: dev
+  labels:
+    kubernetes.io/service-name: dev
+    endpointslice.kubernetes.io/managed-by: flux
+addressType: IPv4
+ports:
+  - name: ui
+    port: 10001
+    protocol: TCP
+  - name: api
+    port: 10002
+    protocol: TCP
+  - name: m
+    port: 10003
+    protocol: TCP
+endpoints:
+  - addresses:
+      - 10.0.64.157
+    conditions:
+      ready: true
diff --git a/clusters/base/namespaces/dev.yaml b/clusters/base/namespaces/dev.yaml
new file mode 100644
index 0000000..8cab297
--- /dev/null
+++ b/clusters/base/namespaces/dev.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: dev
diff --git a/clusters/home/apps/dev.yaml b/clusters/home/apps/dev.yaml
new file mode 100644
index 0000000..aa9b31c
--- /dev/null
+++ b/clusters/home/apps/dev.yaml
@@ -0,0 +1,18 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: dev
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./clusters/base/apps/dev
+  prune: true
+  wait: true
+  dependsOn:
+    - name: namespaces
+    - name: infra
+    - name: auth
+  retryInterval: 5s
diff --git a/clusters/home/apps/kustomization.yaml b/clusters/home/apps/kustomization.yaml
index 2cb8e53..0aa87ae 100644
--- a/clusters/home/apps/kustomization.yaml
+++ b/clusters/home/apps/kustomization.yaml
@@ -15,4 +15,5 @@ resources:
   - syncthing.yaml
   - immich.yaml
   - joplin.yaml
-  - gitea.yaml
\ No newline at end of file
+  - gitea.yaml
+  - dev.yaml
\ No newline at end of file
diff --git a/clusters/home/namespaces/kustomization.yaml b/clusters/home/namespaces/kustomization.yaml
index 159f7b5..92693a7 100644
--- a/clusters/home/namespaces/kustomization.yaml
+++ b/clusters/home/namespaces/kustomization.yaml
@@ -17,3 +17,4 @@ resources:
   - ../../base/namespaces/syncthing.yaml
   - ../../base/namespaces/photo.yaml
   - ../../base/namespaces/git.yaml
+  - ../../base/namespaces/dev.yaml