62 lines
1.5 KiB
YAML
62 lines
1.5 KiB
YAML
# Two Ingresses on one host because the auth middleware is per-Ingress:
|
|
# "/" goes through Authelia, "/api" and "/m" are public. Traefik picks the
|
|
# longer path prefix first, so /api and /m never hit the auth router.
|
|
# Both need the tls section (otherwise the router is http-only), but only
|
|
# the first carries the cert-manager annotation so a single Certificate
|
|
# owns the dev-tls secret.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: dev
|
|
namespace: dev
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
traefik.ingress.kubernetes.io/router.middlewares: auth-authelia@kubernetescrd
|
|
spec:
|
|
ingressClassName: traefik
|
|
rules:
|
|
- host: dev.aggtaa.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: dev
|
|
port:
|
|
name: ui
|
|
tls:
|
|
- secretName: dev-tls
|
|
hosts:
|
|
- dev.aggtaa.com
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: dev-public
|
|
namespace: dev
|
|
spec:
|
|
ingressClassName: traefik
|
|
rules:
|
|
- host: dev.aggtaa.com
|
|
http:
|
|
paths:
|
|
- path: /api
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: dev
|
|
port:
|
|
name: api
|
|
- path: /m
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: dev
|
|
port:
|
|
name: m
|
|
tls:
|
|
- secretName: dev-tls
|
|
hosts:
|
|
- dev.aggtaa.com
|