From a6e68e6ec64a93ad56cf577f4c4c15f4ab82ab65 Mon Sep 17 00:00:00 2001
From: root <root@BITMT501.boday.biz>
Date: Fri, 13 Nov 2026 16:46:13 +0100
Subject: [PATCH] last

---
 charts/cluster-issuer/Chart.yaml              |  5 +++
 .../templates/clusterissuer.yaml              | 19 ++++++++
 charts/cluster-issuer/values.yaml             |  2 +
 main.tf                                       | 45 ++++++++++++++++++-
 terraform.tfvars                              |  2 +
 5 files changed, 72 insertions(+), 1 deletion(-)
 create mode 100644 charts/cluster-issuer/Chart.yaml
 create mode 100644 charts/cluster-issuer/templates/clusterissuer.yaml
 create mode 100644 charts/cluster-issuer/values.yaml

diff --git a/charts/cluster-issuer/Chart.yaml b/charts/cluster-issuer/Chart.yaml
new file mode 100644
index 0000000..deded21
--- /dev/null
+++ b/charts/cluster-issuer/Chart.yaml
@@ -0,0 +1,5 @@
+apiVersion: v2
+name: cluster-issuer
+description: Let's Encrypt ClusterIssuer (staging + prod) für cert-manager
+type: application
+version: 0.1.0
diff --git a/charts/cluster-issuer/templates/clusterissuer.yaml b/charts/cluster-issuer/templates/clusterissuer.yaml
new file mode 100644
index 0000000..d37fb93
--- /dev/null
+++ b/charts/cluster-issuer/templates/clusterissuer.yaml
@@ -0,0 +1,19 @@
+{{- range $name, $server := dict
+      "letsencrypt-staging" "https://acme-staging-v02.api.letsencrypt.org/directory"
+      "letsencrypt-prod"    "https://acme-v02.api.letsencrypt.org/directory" }}
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: {{ $name }}
+spec:
+  acme:
+    server: {{ $server }}
+    email: {{ required "email ist Pflicht" $.Values.email | quote }}
+    privateKeySecretRef:
+      name: {{ $name }}-account-key
+    solvers:
+      - http01:
+          ingress:
+            ingressClassName: {{ $.Values.ingressClass | quote }}
+{{- end }}
diff --git a/charts/cluster-issuer/values.yaml b/charts/cluster-issuer/values.yaml
new file mode 100644
index 0000000..477e1ec
--- /dev/null
+++ b/charts/cluster-issuer/values.yaml
@@ -0,0 +1,2 @@
+email: ""
+ingressClass: traefik
diff --git a/main.tf b/main.tf
index e1fc1b7..3cc583e 100644
--- a/main.tf
+++ b/main.tf
@@ -56,6 +56,47 @@ variable "longhorn_basic_auth" {
   sensitive = true
 }
 
+# --- TLS: cert-manager + Let's Encrypt -------------------------------------
+
+# Version des cert-manager-Helm-Charts (jetstack/cert-manager), bewusst gepinnt
+variable "cert_manager_chart_version" {
+  type = string
+}
+
+# Kontakt-E-Mail für Let's Encrypt (Ablauf-Warnungen)
+variable "acme_email" {
+  type = string
+}
+
+resource "helm_release" "cert_manager" {
+  name             = "cert-manager"
+  repository       = "https://charts.jetstack.io"
+  chart            = "cert-manager"
+  version          = var.cert_manager_chart_version
+  namespace        = "cert-manager"
+  create_namespace = true
+  timeout          = 600
+  atomic           = true
+
+  values = [yamlencode({
+    crds = { enabled = true }
+  })]
+}
+
+# Eigener kleiner Chart, damit Terraform beim Plan die cert-manager-CRDs noch nicht kennen muss
+resource "helm_release" "cluster_issuer" {
+  name      = "cluster-issuer"
+  chart     = "${path.module}/charts/cluster-issuer"
+  namespace = "cert-manager"
+
+  set {
+    name  = "email"
+    value = var.acme_email
+  }
+
+  depends_on = [helm_release.cert_manager]
+}
+
 # Kein hostPort mehr -> der Talos-Standard (PSA "baseline") reicht
 resource "kubernetes_namespace" "traefik" {
   metadata {
@@ -70,11 +111,13 @@ resource "helm_release" "traefik" {
   chart      = "traefik"
   version    = var.traefik_chart_version
   namespace  = kubernetes_namespace.traefik.metadata[0].name
+  timeout    = 600
+  atomic     = true
 
   values = [yamlencode({
     deployment = { replicas = 2 }
 
-    # Je ein Pod pro Node
+    # Möglichst je ein Pod pro Node (weich: bei nur einem Worker laufen beide dort)
     topologySpreadConstraints = [{
       maxSkew           = 1
       topologyKey       = "kubernetes.io/hostname"
diff --git a/terraform.tfvars b/terraform.tfvars
index 8963be8..8f908b2 100644
--- a/terraform.tfvars
+++ b/terraform.tfvars
@@ -3,3 +3,5 @@ traefik_chart_version = "42.3.0"
 traefik_lb_ip         = "172.25.64.200"      # gemeinsame Ingress-IP für alle Hostnamen
 longhorn_host         = "longhorn.boday-it.ch"
 # longhorn_basic_auth kommt als TF_VAR_longhorn_basic_auth aus dem Forgejo-Secret
+cert_manager_chart_version = "v1.21.0"
+acme_email                 = "info@boday-it.ch"