gateway_settings.yaml (21390B)
1 apiVersion: gateway.envoyproxy.io/v1alpha1 2 kind: EnvoyProxy 3 metadata: 4 name: custom-proxy-config 5 namespace: envoy-gateway 6 spec: 7 provider: 8 type: Kubernetes 9 kubernetes: 10 envoyDaemonSet: {} 11 logging: 12 level: 13 default: info 14 --- 15 apiVersion: gateway.networking.k8s.io/v1beta1 16 kind: GatewayClass 17 metadata: 18 name: envoy-gateway-class 19 namespace: envoy-gateway 20 spec: 21 controllerName: gateway.envoyproxy.io/gatewayclass-controller 22 parametersRef: 23 group: gateway.envoyproxy.io 24 kind: EnvoyProxy 25 name: custom-proxy-config 26 namespace: envoy-gateway 27 --- 28 apiVersion: gateway.networking.k8s.io/v1beta1 29 kind: GatewayClass 30 metadata: 31 name: email-direct-class 32 spec: 33 controllerName: gateway.envoyproxy.io/gatewayclass-controller 34 parametersRef: 35 group: gateway.envoyproxy.io 36 kind: EnvoyProxy 37 name: email-direct-proxy 38 namespace: envoy-gateway 39 --- 40 apiVersion: gateway.networking.k8s.io/v1 41 kind: Gateway 42 metadata: 43 name: email-gateway 44 namespace: envoy-gateway 45 annotations: 46 cert-manager.io/cluster-issuer: letsencrypt-dns 47 external-dns.alpha.kubernetes.io/target: "65.21.7.19,157.180.84.123,138.199.144.31,46.225.148.120,116.203.40.165,46.225.115.168,2a01:4f9:c010:88a1::1,2a01:4f9:c012:96a5::1,2a01:4f8:c014:1a0e::1,2a01:4f8:c014:3000::1,2a01:4f8:1c0c:66d3::1,2a01:4f8:1c18:222e::1" 48 spec: 49 gatewayClassName: email-direct-class 50 # no wildcards due to Envoy bug: https://github.com/envoyproxy/gateway/issues/2675#issuecomment-1960449002 51 listeners: 52 - name: smtp 53 protocol: TCP 54 port: 25 55 allowedRoutes: 56 kinds: 57 - kind: TCPRoute 58 namespaces: 59 from: All 60 - name: submissions 61 protocol: TCP 62 port: 465 63 allowedRoutes: 64 kinds: 65 - kind: TCPRoute 66 namespaces: 67 from: All 68 - name: submission 69 protocol: TCP 70 port: 587 71 allowedRoutes: 72 kinds: 73 - kind: TCPRoute 74 namespaces: 75 from: All 76 - name: imap 77 protocol: TCP 78 port: 143 79 allowedRoutes: 80 kinds: 81 - kind: TCPRoute 82 namespaces: 83 from: All 84 - name: imaps 85 protocol: TCP 86 port: 993 87 allowedRoutes: 88 kinds: 89 - kind: TCPRoute 90 namespaces: 91 from: All 92 - name: https-stalwart-nordgedanken 93 protocol: HTTPS 94 hostname: "stalwart.nordgedanken.dev" 95 port: 443 96 allowedRoutes: 97 namespaces: 98 from: "All" 99 tls: 100 mode: Terminate 101 certificateRefs: 102 - kind: Secret 103 name: stalwart.nordgedanken.dev-tls 104 - name: https-webmail-midnightthoughts 105 protocol: HTTPS 106 hostname: "webmail.midnightthoughts.space" 107 port: 443 108 allowedRoutes: 109 namespaces: 110 from: "All" 111 tls: 112 mode: Terminate 113 certificateRefs: 114 - kind: Secret 115 name: webmail.midnightthoughts.space-tls 116 - name: https-midnightthoughts-mta-sts 117 protocol: HTTPS 118 hostname: "mta-sts.midnightthoughts.space" 119 port: 443 120 allowedRoutes: 121 namespaces: 122 from: "All" 123 tls: 124 mode: Terminate 125 certificateRefs: 126 - kind: Secret 127 name: mta-sts.midnightthoughts.space 128 - name: https-autoconfig-midnightthoughts 129 protocol: HTTPS 130 hostname: "autoconfig.midnightthoughts.space" 131 port: 443 132 allowedRoutes: 133 namespaces: 134 from: "All" 135 tls: 136 mode: Terminate 137 certificateRefs: 138 - kind: Secret 139 name: autoconfig.midnightthoughts.space-tls 140 - name: https-autodiscover-midnightthoughts 141 protocol: HTTPS 142 hostname: "autodiscover.midnightthoughts.space" 143 port: 443 144 allowedRoutes: 145 namespaces: 146 from: "All" 147 tls: 148 mode: Terminate 149 certificateRefs: 150 - kind: Secret 151 name: autodiscover.midnightthoughts.space-tls 152 - name: https-autoconfig-lists-midnightthoughts 153 protocol: HTTPS 154 hostname: "autoconfig.lists.midnightthoughts.space" 155 port: 443 156 allowedRoutes: 157 namespaces: 158 from: "All" 159 tls: 160 mode: Terminate 161 certificateRefs: 162 - kind: Secret 163 name: autoconfig.lists.midnightthoughts.space-tls 164 - name: https-autodiscover-lists-midnightthoughts 165 protocol: HTTPS 166 hostname: "autodiscover.lists.midnightthoughts.space" 167 port: 443 168 allowedRoutes: 169 namespaces: 170 from: "All" 171 tls: 172 mode: Terminate 173 certificateRefs: 174 - kind: Secret 175 name: autodiscover.lists.midnightthoughts.space-tls 176 - name: https-mta-sts-lists-midnightthoughts 177 protocol: HTTPS 178 hostname: "mta-sts.lists.midnightthoughts.space" 179 port: 443 180 allowedRoutes: 181 namespaces: 182 from: "All" 183 tls: 184 mode: Terminate 185 certificateRefs: 186 - kind: Secret 187 name: mta-sts.lists.midnightthoughts.space-tls 188 - name: https-autoconfig-phorge 189 protocol: HTTPS 190 hostname: "autoconfig.phorge.mtrnord.blog" 191 port: 443 192 allowedRoutes: 193 namespaces: 194 from: "All" 195 tls: 196 mode: Terminate 197 certificateRefs: 198 - kind: Secret 199 name: wildcard.phorge.mtrnord.blog-tls 200 - name: https-autodiscover-phorge 201 protocol: HTTPS 202 hostname: "autodiscover.phorge.mtrnord.blog" 203 port: 443 204 allowedRoutes: 205 namespaces: 206 from: "All" 207 tls: 208 mode: Terminate 209 certificateRefs: 210 - kind: Secret 211 name: wildcard.phorge.mtrnord.blog-tls 212 - name: https-mta-sts-phorge 213 protocol: HTTPS 214 hostname: "mta-sts.phorge.mtrnord.blog" 215 port: 443 216 allowedRoutes: 217 namespaces: 218 from: "All" 219 tls: 220 mode: Terminate 221 certificateRefs: 222 - kind: Secret 223 name: wildcard.phorge.mtrnord.blog-tls 224 --- 225 apiVersion: gateway.networking.k8s.io/v1 226 kind: Gateway 227 metadata: 228 name: envoy-gateway 229 namespace: envoy-gateway 230 annotations: 231 cert-manager.io/cluster-issuer: letsencrypt-dns 232 spec: 233 gatewayClassName: envoy-gateway-class 234 infrastructure: 235 annotations: 236 external-dns.alpha.kubernetes.io/access: public 237 load-balancer.hetzner.cloud/location: hel1 238 load-balancer.hetzner.cloud/name: envoy 239 load-balancer.hetzner.cloud/use-private-ip: "true" 240 load-balancer.hetzner.cloud/uses-proxyprotocol: "true" 241 # no wildcards due to Envoy bug: https://github.com/envoyproxy/gateway/issues/2675#issuecomment-1960449002 242 listeners: 243 - name: ssh 244 protocol: TCP 245 port: 22 246 allowedRoutes: 247 kinds: 248 - kind: TCPRoute 249 namespaces: 250 from: Selector 251 selector: 252 matchLabels: 253 app: cgit 254 - name: https-talos-midnightthoughts 255 protocol: HTTPS 256 hostname: "talos.midnightthoughts.space" 257 port: 443 258 allowedRoutes: 259 namespaces: 260 from: "All" 261 tls: 262 mode: Terminate 263 certificateRefs: 264 - kind: Secret 265 name: talos.midnightthoughts.space-tls 266 - name: https-alertmanager-midnightthoughts 267 protocol: HTTPS 268 hostname: "alertmanager.midnightthoughts.space" 269 port: 443 270 allowedRoutes: 271 namespaces: 272 from: "All" 273 tls: 274 mode: Terminate 275 certificateRefs: 276 - kind: Secret 277 name: alertmanager.midnightthoughts.space-tls 278 - name: https-prometheus-midnightthoughts 279 protocol: HTTPS 280 hostname: "prometheus.midnightthoughts.space" 281 port: 443 282 allowedRoutes: 283 namespaces: 284 from: "All" 285 tls: 286 mode: Terminate 287 certificateRefs: 288 - kind: Secret 289 name: prometheus.midnightthoughts.space-tls 290 - name: https-nordgedanken.dev 291 protocol: HTTPS 292 hostname: "nordgedanken.dev" 293 port: 443 294 allowedRoutes: 295 namespaces: 296 from: "All" 297 tls: 298 mode: Terminate 299 certificateRefs: 300 - kind: Secret 301 name: nordgedanken.dev-tls 302 - name: https-openpgpkey.nordgedanken.dev 303 protocol: HTTPS 304 hostname: "openpgpkey.nordgedanken.dev" 305 port: 443 306 allowedRoutes: 307 namespaces: 308 from: "All" 309 tls: 310 mode: Terminate 311 certificateRefs: 312 - kind: Secret 313 name: openpgpkey.nordgedanken.dev-tls 314 - name: https-midnightthoughts-auth 315 protocol: HTTPS 316 hostname: "auth.midnightthoughts.space" 317 port: 443 318 allowedRoutes: 319 namespaces: 320 from: "All" 321 tls: 322 mode: Terminate 323 certificateRefs: 324 - kind: Secret 325 name: auth.midnightthoughts.space-tls 326 - name: https-midnightthoughts-clickstack 327 protocol: HTTPS 328 hostname: "clickstack.midnightthoughts.space" 329 port: 443 330 allowedRoutes: 331 namespaces: 332 from: "All" 333 tls: 334 mode: Terminate 335 certificateRefs: 336 - kind: Secret 337 name: clickstack.midnightthoughts.space-tls 338 - name: https-midnightthoughts-grafana 339 protocol: HTTPS 340 hostname: "grafana.midnightthoughts.space" 341 port: 443 342 allowedRoutes: 343 namespaces: 344 from: "All" 345 tls: 346 mode: Terminate 347 certificateRefs: 348 - kind: Secret 349 name: grafana.midnightthoughts.space-tls 350 - name: https-draupnir-midnightthoughts 351 protocol: HTTPS 352 hostname: "draupnir.midnightthoughts.space" 353 port: 443 354 allowedRoutes: 355 namespaces: 356 from: "All" 357 tls: 358 mode: Terminate 359 certificateRefs: 360 - kind: Secret 361 name: draupnir.midnightthoughts.space-tls 362 - name: https-matrix-draupnir-midnightthoughts 363 protocol: HTTPS 364 hostname: "matrix.draupnir.midnightthoughts.space" 365 port: 443 366 allowedRoutes: 367 namespaces: 368 from: "All" 369 tls: 370 mode: Terminate 371 certificateRefs: 372 - kind: Secret 373 name: matrix.draupnir.midnightthoughts.space-tls 374 - name: https-midnightthoughts-vault 375 protocol: HTTPS 376 hostname: "vault.midnightthoughts.space" 377 port: 443 378 allowedRoutes: 379 namespaces: 380 from: "All" 381 tls: 382 mode: Terminate 383 certificateRefs: 384 - kind: Secret 385 name: vault.midnightthoughts.space-tls 386 - name: https-midnightthoughts-budget 387 protocol: HTTPS 388 hostname: "budget.midnightthoughts.space" 389 port: 443 390 allowedRoutes: 391 namespaces: 392 from: "All" 393 tls: 394 mode: Terminate 395 certificateRefs: 396 - kind: Secret 397 name: budget.midnightthoughts.space-tls 398 - name: https-midnightthoughts-ldap 399 protocol: HTTPS 400 hostname: "ldap.midnightthoughts.space" 401 port: 443 402 allowedRoutes: 403 namespaces: 404 from: "All" 405 tls: 406 mode: Terminate 407 certificateRefs: 408 - kind: Secret 409 name: ldap.midnightthoughts.space-tls 410 - name: https-midnightthoughts-persephone 411 protocol: HTTPS 412 hostname: "persephone.midnightthoughts.space" 413 port: 443 414 allowedRoutes: 415 namespaces: 416 from: "All" 417 tls: 418 mode: Terminate 419 certificateRefs: 420 - kind: Secret 421 name: persephone.midnightthoughts.space-tls 422 - name: https-midnightthoughts-persephone-matrix 423 protocol: HTTPS 424 hostname: "matrix.persephone.midnightthoughts.space" 425 port: 443 426 allowedRoutes: 427 namespaces: 428 from: "All" 429 tls: 430 mode: Terminate 431 certificateRefs: 432 - kind: Secret 433 name: matrix.persephone.midnightthoughts.space-tls 434 - name: ldap 435 protocol: TCP 436 port: 389 437 allowedRoutes: 438 kinds: 439 - kind: TCPRoute 440 namespaces: 441 from: Selector 442 selector: 443 matchLabels: 444 app: authentik 445 - name: https-wildcard-mtrnord-blog 446 protocol: HTTPS 447 hostname: "*.mtrnord.blog" 448 port: 443 449 allowedRoutes: 450 namespaces: 451 from: "All" 452 tls: 453 mode: Terminate 454 certificateRefs: 455 - kind: Secret 456 name: wildcard.mtrnord.blog-tls 457 - name: https-wildcard-convex-mtrnord-blog 458 protocol: HTTPS 459 hostname: "*.convex.mtrnord.blog" 460 port: 443 461 allowedRoutes: 462 namespaces: 463 from: "All" 464 tls: 465 mode: Terminate 466 certificateRefs: 467 - kind: Secret 468 name: wildcard.convex.mtrnord.blog-tls 469 - name: https-midnightthoughts-collabora 470 protocol: HTTPS 471 hostname: "collabora.midnightthoughts.space" 472 port: 443 473 allowedRoutes: 474 namespaces: 475 from: "All" 476 tls: 477 mode: Terminate 478 certificateRefs: 479 - kind: Secret 480 name: collabora.midnightthoughts.space 481 - name: https-midnightthoughts-webhook-kubernetes 482 protocol: HTTPS 483 hostname: "webhook.kubernetes.midnightthoughts.space" 484 port: 443 485 allowedRoutes: 486 namespaces: 487 from: "All" 488 tls: 489 mode: Terminate 490 certificateRefs: 491 - kind: Secret 492 name: webhook.kubernetes.midnightthoughts.space-tls 493 - name: https-wildcard-connectivity-tester-mtrnord-blog 494 protocol: HTTPS 495 hostname: "*.connectivity-tester.mtrnord.blog" 496 port: 443 497 allowedRoutes: 498 namespaces: 499 from: "All" 500 tls: 501 mode: Terminate 502 certificateRefs: 503 - kind: Secret 504 name: wildcard.connectivity-tester.mtrnord.blog-tls 505 - name: https-wildcard-stage-connectivity-tester-mtrnord-blog 506 protocol: HTTPS 507 hostname: "*.stage.connectivity-tester.mtrnord.blog" 508 port: 443 509 allowedRoutes: 510 namespaces: 511 from: "All" 512 tls: 513 mode: Terminate 514 certificateRefs: 515 - kind: Secret 516 name: wildcard.stage.connectivity-tester.mtrnord.blog-tls 517 - name: https-mtrnord-blog-root 518 protocol: HTTPS 519 hostname: "mtrnord.blog" 520 port: 443 521 allowedRoutes: 522 namespaces: 523 from: "All" 524 tls: 525 mode: Terminate 526 certificateRefs: 527 - kind: Secret 528 name: mtrnord.blog-tls 529 - name: https-midnightthoughts-rspamd 530 protocol: HTTPS 531 hostname: "rspamd.midnightthoughts.space" 532 port: 443 533 allowedRoutes: 534 namespaces: 535 from: "All" 536 tls: 537 mode: Terminate 538 certificateRefs: 539 - kind: Secret 540 name: rspamd.midnightthoughts.space-tls 541 - name: https-midnightthoughts-plane 542 protocol: HTTPS 543 hostname: "plane.midnightthoughts.space" 544 port: 443 545 allowedRoutes: 546 namespaces: 547 from: "All" 548 tls: 549 mode: Terminate 550 certificateRefs: 551 - kind: Secret 552 name: plane.midnightthoughts.space 553 - name: https-midnightthoughts-kimai 554 protocol: HTTPS 555 hostname: "kimai.midnightthoughts.space" 556 port: 443 557 allowedRoutes: 558 namespaces: 559 from: "All" 560 tls: 561 mode: Terminate 562 certificateRefs: 563 - kind: Secret 564 name: kimai.midnightthoughts.space 565 - name: https-midnightthoughts-morg-statistics 566 protocol: HTTPS 567 hostname: "morg-statistics.midnightthoughts.space" 568 port: 443 569 allowedRoutes: 570 namespaces: 571 from: "All" 572 tls: 573 mode: Terminate 574 certificateRefs: 575 - kind: Secret 576 name: morg-statistics.midnightthoughts.space 577 - name: https-midnightthoughts-lists 578 protocol: HTTPS 579 hostname: "lists.midnightthoughts.space" 580 port: 443 581 allowedRoutes: 582 namespaces: 583 from: "All" 584 tls: 585 mode: Terminate 586 certificateRefs: 587 - kind: Secret 588 name: lists.midnightthoughts.space 589 - name: https-midnightthoughts-git 590 protocol: HTTPS 591 hostname: "git.midnightthoughts.space" 592 port: 443 593 allowedRoutes: 594 namespaces: 595 from: "All" 596 tls: 597 mode: Terminate 598 certificateRefs: 599 - kind: Secret 600 name: git.midnightthoughts.space 601 - name: https-midnightthoughts-git-ci 602 protocol: HTTPS 603 hostname: "ci.git.midnightthoughts.space" 604 port: 443 605 allowedRoutes: 606 namespaces: 607 from: "All" 608 tls: 609 mode: Terminate 610 certificateRefs: 611 - kind: Secret 612 name: ci.git.midnightthoughts.space 613 - name: https-midnightthoughts-plausible 614 protocol: HTTPS 615 hostname: "plausible.midnightthoughts.space" 616 port: 443 617 allowedRoutes: 618 namespaces: 619 from: "All" 620 tls: 621 mode: Terminate 622 certificateRefs: 623 - kind: Secret 624 name: plausible.midnightthoughts.space 625 - name: https-midnightthoughts-miro 626 protocol: HTTPS 627 hostname: "miro-export.neoboard.midnightthoughts.space" 628 port: 443 629 allowedRoutes: 630 namespaces: 631 from: "All" 632 tls: 633 mode: Terminate 634 certificateRefs: 635 - kind: Secret 636 name: miro-export.neoboard.midnightthoughts.space 637 - name: https-midnightthoughts-miro-exporter 638 protocol: HTTPS 639 hostname: "miro-exporter.neoboard.midnightthoughts.space" 640 port: 443 641 allowedRoutes: 642 namespaces: 643 from: "All" 644 tls: 645 mode: Terminate 646 certificateRefs: 647 - kind: Secret 648 name: miro-exporter.neoboard.midnightthoughts.space 649 - name: https-midnightthoughts-miro-neoboard-exporter 650 protocol: HTTPS 651 hostname: "miro-neoboard-exporter.midnightthoughts.space" 652 port: 443 653 allowedRoutes: 654 namespaces: 655 from: "All" 656 tls: 657 mode: Terminate 658 certificateRefs: 659 - kind: Secret 660 name: miro-neoboard-exporter.midnightthoughts.space 661 - name: https-opencost-k8s-midnightthoughts-space 662 protocol: HTTPS 663 hostname: "opencost.k8s.midnightthoughts.space" 664 port: 443 665 allowedRoutes: 666 namespaces: 667 from: "All" 668 tls: 669 mode: Terminate 670 certificateRefs: 671 - kind: Secret 672 name: opencost.k8s.midnightthoughts.space-tls 673 - name: https-registry-midnightthoughts 674 protocol: HTTPS 675 hostname: "registry.midnightthoughts.space" 676 port: 443 677 allowedRoutes: 678 namespaces: 679 from: "All" 680 tls: 681 mode: Terminate 682 certificateRefs: 683 - kind: Secret 684 name: registry.midnightthoughts.space-tls 685 - name: https-jenkins-midnightthoughts 686 protocol: HTTPS 687 hostname: jenkins.midnightthoughts.space 688 port: 443 689 allowedRoutes: 690 namespaces: 691 from: All 692 tls: 693 mode: Terminate 694 certificateRefs: 695 - kind: Secret 696 name: jenkins.midnightthoughts.space-tls 697 - name: http 698 protocol: HTTP 699 port: 80 700 allowedRoutes: 701 namespaces: 702 from: "Same" 703 --- 704 apiVersion: gateway.networking.k8s.io/v1 705 kind: HTTPRoute 706 metadata: 707 name: tls-redirect 708 namespace: envoy-gateway 709 spec: 710 parentRefs: 711 - name: envoy-gateway 712 sectionName: http 713 rules: 714 - filters: 715 - type: RequestRedirect 716 requestRedirect: 717 scheme: https 718 statusCode: 301 719 --- 720 apiVersion: gateway.envoyproxy.io/v1alpha1 721 kind: ClientTrafficPolicy 722 metadata: 723 name: enable-proxy-protocol-policy 724 namespace: envoy-gateway 725 spec: 726 targetRefs: 727 - group: gateway.networking.k8s.io 728 kind: Gateway 729 name: envoy-gateway 730 # WARNING: Cilium 1.17+ only supports the correct ipMode magic for this to work. Hence it currently fails 731 enableProxyProtocol: true 732 # Alternative to enableProxyProtocol: true 733 #clientIPDetection: 734 # xForwardedFor: 735 # trustedCIDRs: 736 # - 10.10.0.0/16 737 # - 100.96.0.0/16 738 tcpKeepalive: 739 idleTime: 1h 740 interval: 75s 741 probes: 9 742 path: 743 escapedSlashesAction: KeepUnchanged 744 --- 745 # Monitors the above gateway using a servicemonitor 746 # First we do a service matching on the labels "gateway.envoyproxy.io/owning-gateway-name: envoy-gateway" and "gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway" 747 kind: Service 748 apiVersion: v1 749 metadata: 750 name: envoy-gateway-monitor 751 namespace: envoy-gateway 752 labels: 753 proxy: envoy 754 spec: 755 selector: 756 gateway.envoyproxy.io/owning-gateway-name: envoy-gateway 757 gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway 758 ports: 759 - name: metrics 760 port: 19001 761 targetPort: 19001 762 --- 763 apiVersion: monitoring.coreos.com/v1 764 kind: ServiceMonitor 765 metadata: 766 name: envoy-gateway-monitor 767 namespace: envoy-gateway 768 spec: 769 selector: 770 matchLabels: 771 proxy: envoy 772 endpoints: 773 - port: metrics 774 path: /stats/prometheus 775 interval: 10s 776 --- 777 apiVersion: monitoring.coreos.com/v1 778 kind: ServiceMonitor 779 metadata: 780 name: envoy-gateway-controlplane-monitor 781 namespace: envoy-gateway 782 spec: 783 selector: 784 matchLabels: 785 control-plane: envoy-gateway 786 endpoints: 787 - port: metrics 788 interval: 10s