Add HTTPRoutes for the apps behind ingress-nginx

Each app gets an HTTPS listener on the Gateway with its existing certificate, an HTTPRoute, and a ReferenceGrant for that certificate. The routes drop Envoy's 15s request timeout, as nginx has no overall limit either. Argo CD and Longhorn follow separately; the Ingresses stay until the switch-over.

actual-budget/httproute.yaml

@@ -0,0 +1,34 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: actual-budget
+spec:
+  parentRefs:
+  - name: homelab
+    namespace: envoy-gateway-system
+    sectionName: https-ynab
+  hostnames:
+  - ynab.rubenhensen.nl
+  rules:
+  - backendRefs:
+    - name: helm-actual-budget-actualbudget
+      port: 5006
+    # No limit on the whole request, as with nginx. Envoy's default of 15s
+    # cuts off uploads and long-lived connections.
+    timeouts:
+      request: 0s
+---
+# Lets the Gateway serve the certificate cert-manager keeps in this namespace.
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: gateway-tls
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: envoy-gateway-system
+  to:
+  - group: ""
+    kind: Secret
+    name: actual-budget-tls

authentik/httproute.yaml

@@ -0,0 +1,34 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: authentik
+spec:
+  parentRefs:
+  - name: homelab
+    namespace: envoy-gateway-system
+    sectionName: https-authentik
+  hostnames:
+  - authentik.rubenhensen.nl
+  rules:
+  - backendRefs:
+    - name: authentik-server
+      port: 80
+    # No limit on the whole request, as with nginx. Envoy's default of 15s
+    # cuts off uploads and long-lived connections.
+    timeouts:
+      request: 0s
+---
+# Lets the Gateway serve the certificate cert-manager keeps in this namespace.
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: gateway-tls
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: envoy-gateway-system
+  to:
+  - group: ""
+    kind: Secret
+    name: authentik-tls

bolletjestrui/httproute.yaml

@@ -0,0 +1,34 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: bolletjestrui
+spec:
+  parentRefs:
+  - name: homelab
+    namespace: envoy-gateway-system
+    sectionName: https-vic
+  hostnames:
+  - vic.rubenhensen.nl
+  rules:
+  - backendRefs:
+    - name: bolletjestrui
+      port: 3000
+    # No limit on the whole request, as with nginx. Envoy's default of 15s
+    # cuts off uploads and long-lived connections.
+    timeouts:
+      request: 0s
+---
+# Lets the Gateway serve the certificate cert-manager keeps in this namespace.
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: gateway-tls
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: envoy-gateway-system
+  to:
+  - group: ""
+    kind: Secret
+    name: letsencrypt-prod

freshrss/httproute.yaml

@@ -0,0 +1,34 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: freshrss
+spec:
+  parentRefs:
+  - name: homelab
+    namespace: envoy-gateway-system
+    sectionName: https-rss
+  hostnames:
+  - rss.rubenhensen.nl
+  rules:
+  - backendRefs:
+    - name: freshrss
+      port: 8080
+    # No limit on the whole request, as with nginx. Envoy's default of 15s
+    # cuts off uploads and long-lived connections.
+    timeouts:
+      request: 0s
+---
+# Lets the Gateway serve the certificate cert-manager keeps in this namespace.
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: gateway-tls
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: envoy-gateway-system
+  to:
+  - group: ""
+    kind: Secret
+    name: letsencrypt-prod

gateway/gateway.yaml

@@ -30,3 +30,171 @@ spec:
         selector:
           matchLabels:
             kubernetes.io/metadata.name: gatus
+  - name: https-ynab
+    protocol: HTTPS
+    port: 443
+    hostname: ynab.rubenhensen.nl
+    tls:
+      certificateRefs:
+      - name: actual-budget-tls
+        namespace: actual-budget
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: actual-budget
+  - name: https-authentik
+    protocol: HTTPS
+    port: 443
+    hostname: authentik.rubenhensen.nl
+    tls:
+      certificateRefs:
+      - name: authentik-tls
+        namespace: authentik
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: authentik
+  - name: https-vic
+    protocol: HTTPS
+    port: 443
+    hostname: vic.rubenhensen.nl
+    tls:
+      certificateRefs:
+      - name: letsencrypt-prod
+        namespace: bolletjestrui
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: bolletjestrui
+  - name: https-rss
+    protocol: HTTPS
+    port: 443
+    hostname: rss.rubenhensen.nl
+    tls:
+      certificateRefs:
+      - name: letsencrypt-prod
+        namespace: freshrss
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: freshrss
+  - name: https-git
+    protocol: HTTPS
+    port: 443
+    hostname: git.rubenhensen.nl
+    tls:
+      certificateRefs:
+      - name: letsencrypt-prod
+        namespace: gitea
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: gitea
+  - name: https-ha
+    protocol: HTTPS
+    port: 443
+    hostname: ha.rubenhensen.nl
+    tls:
+      certificateRefs:
+      - name: letsencrypt-prod
+        namespace: home-assistant
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: home-assistant
+  - name: https-foto
+    protocol: HTTPS
+    port: 443
+    hostname: foto.scoutingmbg.nl
+    tls:
+      certificateRefs:
+      - name: letsencrypt-prod
+        namespace: immich
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: immich
+  - name: https-scoutingmbg
+    protocol: HTTPS
+    port: 443
+    hostname: scoutingmbg.nl
+    tls:
+      certificateRefs:
+      - name: scoutingmbg-nl-tls
+        namespace: mbgwp
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: mbgwp
+  - name: https-www-scoutingmbg
+    protocol: HTTPS
+    port: 443
+    hostname: www.scoutingmbg.nl
+    tls:
+      certificateRefs:
+      - name: scoutingmbg-nl-tls
+        namespace: mbgwp
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: mbgwp
+  - name: https-ntfy2
+    protocol: HTTPS
+    port: 443
+    hostname: ntfy2.rubenhensen.nl
+    tls:
+      certificateRefs:
+      - name: letsencrypt-prod
+        namespace: ntfy
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: ntfy
+  - name: https-serpbear
+    protocol: HTTPS
+    port: 443
+    hostname: serpbear.rubenhensen.nl
+    tls:
+      certificateRefs:
+      - name: letsencrypt-prod
+        namespace: serpbear
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: serpbear
+  - name: https-vault
+    protocol: HTTPS
+    port: 443
+    hostname: vault.rubenhensen.nl
+    tls:
+      certificateRefs:
+      - name: letsencrypt-prod
+        namespace: vault
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: vault

gitea/httproute.yaml

@@ -0,0 +1,34 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: gitea
+spec:
+  parentRefs:
+  - name: homelab
+    namespace: envoy-gateway-system
+    sectionName: https-git
+  hostnames:
+  - git.rubenhensen.nl
+  rules:
+  - backendRefs:
+    - name: gitea
+      port: 3000
+    # No limit on the whole request, as with nginx. Envoy's default of 15s
+    # cuts off uploads and long-lived connections.
+    timeouts:
+      request: 0s
+---
+# Lets the Gateway serve the certificate cert-manager keeps in this namespace.
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: gateway-tls
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: envoy-gateway-system
+  to:
+  - group: ""
+    kind: Secret
+    name: letsencrypt-prod

home-assistant/httproute.yaml

@@ -0,0 +1,34 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: home-assistant
+spec:
+  parentRefs:
+  - name: homelab
+    namespace: envoy-gateway-system
+    sectionName: https-ha
+  hostnames:
+  - ha.rubenhensen.nl
+  rules:
+  - backendRefs:
+    - name: home-assistant-external
+      port: 8123
+    # No limit on the whole request, as with nginx. Envoy's default of 15s
+    # cuts off uploads and long-lived connections.
+    timeouts:
+      request: 0s
+---
+# Lets the Gateway serve the certificate cert-manager keeps in this namespace.
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: gateway-tls
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: envoy-gateway-system
+  to:
+  - group: ""
+    kind: Secret
+    name: letsencrypt-prod

immich/httproute.yaml

@@ -0,0 +1,34 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: immich
+spec:
+  parentRefs:
+  - name: homelab
+    namespace: envoy-gateway-system
+    sectionName: https-foto
+  hostnames:
+  - foto.scoutingmbg.nl
+  rules:
+  - backendRefs:
+    - name: sol-auth-svc
+      port: 8002
+    # No limit on the whole request, as with nginx. Envoy's default of 15s
+    # cuts off uploads and long-lived connections.
+    timeouts:
+      request: 0s
+---
+# Lets the Gateway serve the certificate cert-manager keeps in this namespace.
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: gateway-tls
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: envoy-gateway-system
+  to:
+  - group: ""
+    kind: Secret
+    name: letsencrypt-prod

mbgwp/httproute.yaml

@@ -0,0 +1,38 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: wordpress
+spec:
+  parentRefs:
+  - name: homelab
+    namespace: envoy-gateway-system
+    sectionName: https-scoutingmbg
+  - name: homelab
+    namespace: envoy-gateway-system
+    sectionName: https-www-scoutingmbg
+  hostnames:
+  - scoutingmbg.nl
+  - www.scoutingmbg.nl
+  rules:
+  - backendRefs:
+    - name: mbgwp-official-helm-wordpress
+      port: 80
+    # No limit on the whole request, as with nginx. Envoy's default of 15s
+    # cuts off uploads and long-lived connections.
+    timeouts:
+      request: 0s
+---
+# Lets the Gateway serve the certificate cert-manager keeps in this namespace.
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: gateway-tls
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: envoy-gateway-system
+  to:
+  - group: ""
+    kind: Secret
+    name: scoutingmbg-nl-tls

ntfy/httproute.yaml

@@ -0,0 +1,34 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: ntfy
+spec:
+  parentRefs:
+  - name: homelab
+    namespace: envoy-gateway-system
+    sectionName: https-ntfy2
+  hostnames:
+  - ntfy2.rubenhensen.nl
+  rules:
+  - backendRefs:
+    - name: ntfy
+      port: 80
+    # No limit on the whole request, as with nginx. Envoy's default of 15s
+    # cuts off uploads and long-lived connections.
+    timeouts:
+      request: 0s
+---
+# Lets the Gateway serve the certificate cert-manager keeps in this namespace.
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: gateway-tls
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: envoy-gateway-system
+  to:
+  - group: ""
+    kind: Secret
+    name: letsencrypt-prod

ntfy/kustomization.yaml

@@ -9,3 +9,4 @@ resources:
   - ntfy-deployment.yaml
   - ntfy-service.yaml
   - ingress.yaml
+  - httproute.yaml

serpbear/httproute.yaml

@@ -0,0 +1,34 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: serpbear
+spec:
+  parentRefs:
+  - name: homelab
+    namespace: envoy-gateway-system
+    sectionName: https-serpbear
+  hostnames:
+  - serpbear.rubenhensen.nl
+  rules:
+  - backendRefs:
+    - name: serpbear
+      port: 3000
+    # No limit on the whole request, as with nginx. Envoy's default of 15s
+    # cuts off uploads and long-lived connections.
+    timeouts:
+      request: 0s
+---
+# Lets the Gateway serve the certificate cert-manager keeps in this namespace.
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: gateway-tls
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: envoy-gateway-system
+  to:
+  - group: ""
+    kind: Secret
+    name: letsencrypt-prod

vault/httproute.yaml

@@ -0,0 +1,34 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: vault
+spec:
+  parentRefs:
+  - name: homelab
+    namespace: envoy-gateway-system
+    sectionName: https-vault
+  hostnames:
+  - vault.rubenhensen.nl
+  rules:
+  - backendRefs:
+    - name: vault-active
+      port: 8200
+    # No limit on the whole request, as with nginx. Envoy's default of 15s
+    # cuts off uploads and long-lived connections.
+    timeouts:
+      request: 0s
+---
+# Lets the Gateway serve the certificate cert-manager keeps in this namespace.
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: gateway-tls
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: envoy-gateway-system
+  to:
+  - group: ""
+    kind: Secret
+    name: letsencrypt-prod