bast/talos-platform
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Forgejo + Longhorn mit Let's Encrypt, Traefik-Import
All checks were successful
Talos Platform Deploy / deploy (push) Successful in 15s
Details

Browse source
This commit is contained in:
root 2026-11-13 22:32:28 +01:00
parent c9cd360fd3
commit 49cd3e023e
2 changed files with 40 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
main.tf
View file

@ -50,6 +50,12 @@ variable "longhorn_host" {
default = "longhorn.boday.lan"
}
# Wer das Longhorn-Dashboard erreichen darf (Quell-IPs, wie sie bei Traefik ankommen)
variable "longhorn_allowed_cidrs" {
type = list(string)
default = ["172.25.64.0/24", "172.25.65.0/24"]
}
# BasicAuth für Longhorn als htpasswd-Zeile, z.B.: htpasswd -nbB admin 'geheim'
variable "longhorn_basic_auth" {
type = string
@ -167,6 +173,12 @@ resource "helm_release" "traefik" {
metadata = { name = "longhorn-auth", namespace = "longhorn-system" }
spec = { basicAuth = { secret = "longhorn-basic-auth" } }
},
{
apiVersion = "traefik.io/v1alpha1"
kind = "Middleware"
metadata = { name = "longhorn-allowlist", namespace = "longhorn-system" }
spec = { ipAllowList = { sourceRange = var.longhorn_allowed_cidrs } }
},
{
apiVersion = "networking.k8s.io/v1"
kind = "Ingress"
@ -174,11 +186,17 @@ resource "helm_release" "traefik" {
name = "longhorn"
namespace = "longhorn-system"
annotations = {
"traefik.ingress.kubernetes.io/router.middlewares" = "longhorn-system-longhorn-auth@kubernetescrd"
# Erst IP-Allowlist (nur LAN/DMZ), dann Login
"traefik.ingress.kubernetes.io/router.middlewares" = "longhorn-system-longhorn-allowlist@kubernetescrd,longhorn-system-longhorn-auth@kubernetescrd"
"cert-manager.io/cluster-issuer" = "letsencrypt-prod"
}
}
spec = {
ingressClassName = "traefik"
tls = [{
secretName = "longhorn-tls"
hosts = [var.longhorn_host]
}]
rules = [{
host = var.longhorn_host
http = {
@ -220,7 +238,8 @@ output "traefik_lb_ip" {
value = var.traefik_lb_ip
}
# Adopt Traefik into the state again (lost when Consul restarted)
# --- Traefik wieder in den State übernehmen (State ging beim Consul-Neustart verloren) ---
# Nach erfolgreichem Lauf dürfen die Blöcke bleiben oder entfernt werden.
import {
to = kubernetes_namespace.traefik
id = "traefik"

19
talos/coredns-hosts.md Normal file
View file

@ -0,0 +1,19 @@
# CoreDNS-Hosts-Eintrag (manuell gepflegt)
Pods im Cluster (u.a. die Selbstprüfung von cert-manager) sollen die eigenen öffentlichen Namen
direkt auf den Traefik-Ingress auflösen, statt über die öffentliche IP 46.4.148.66 (kein Hairpin-NAT).
`kubectl -n kube-system edit configmap coredns`, im Block `.:53 {` nach `errors`:
```
hosts {
172.25.64.200 boday-it.ch www.boday-it.ch forgejo.boday-it.ch longhorn.boday-it.ch
fallthrough
}
```
Danach: `kubectl -n kube-system rollout restart deployment coredns`
Achtung: `talosctl upgrade-k8s` kann die ConfigMap überschreiben. Nach jedem Kubernetes-Upgrade prüfen:
`kubectl run dnstest --rm -i --restart=Never --image=busybox -- nslookup boday-it.ch` → 172.25.64.200
Neue öffentliche Hostnamen auf Talos hier ergänzen.