From ef4f5f68a0ed66c0e042f565c74edf050a5ff140 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sat, 8 Aug 2026 23:16:50 +1000 Subject: [PATCH] traefik-internal: add ldaps :636 entrypoint for authentik LDAPS Why: - traefik-internal has no 636 entrypoint, so the authentik-ldap Gateway's 636/TLS passthrough listeners are invalid and the whole Gateway is rejected (Accepted: False), taking LDAPS down. - The traefik-internal LoadBalancer only publishes 80/443, so nothing reaches the Authentik LDAP outpost on 636. How: - Add an `ldaps` entrypoint on :636 (raw TCP, no TLS termination) to the traefik-internal helm values so 636/TLS passthrough streams pass through to the LDAP outpost. - Expose 636 on the traefik-internal LoadBalancer via the port's `expose.default`, keeping the pinned 198.18.200.4 / common group. --- apps/overlays/au-syd1/traefik-system/values-internal.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/apps/overlays/au-syd1/traefik-system/values-internal.yaml b/apps/overlays/au-syd1/traefik-system/values-internal.yaml index 865146f..26ff362 100644 --- a/apps/overlays/au-syd1/traefik-system/values-internal.yaml +++ b/apps/overlays/au-syd1/traefik-system/values-internal.yaml @@ -100,5 +100,11 @@ ports: port: 443 vault-direct: port: 8200 + ldaps: + port: 636 + exposedPort: 636 + expose: + default: true + protocol: TCP enabled: true -- 2.47.3