From dd93ffca28a5a8ccf3e6d368e8ceeb87ea553689 Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Tue, 2 Jun 2026 17:44:33 +1000
Subject: [PATCH] feat: add auth.unkin.net proxying to Kubernetes Traefik
 ingress

Add static haproxy2 backends for syd1 Kubernetes Traefik ingress
(external 198.18.199.0, internal 198.18.200.4) and route
auth.unkin.net to the internal backend with Let's Encrypt cert.
---
 .../au/region/syd1/infra/halb/haproxy2.yaml   | 39 +++++++++++++++++++
 1 file changed, 39 insertions(+)

diff --git a/hieradata/country/au/region/syd1/infra/halb/haproxy2.yaml b/hieradata/country/au/region/syd1/infra/halb/haproxy2.yaml
index 66e37a6..c86c7c6 100644
--- a/hieradata/country/au/region/syd1/infra/halb/haproxy2.yaml
+++ b/hieradata/country/au/region/syd1/infra/halb/haproxy2.yaml
@@ -16,6 +16,7 @@ profiles::haproxy::dns::vrrp_cnames:
   - mail.main.unkin.net
   - autoconfig.main.unkin.net
   - autodiscover.main.unkin.net
+  - auth.unkin.net
 
 profiles::haproxy::mappings:
   fe_http:
@@ -37,6 +38,7 @@ profiles::haproxy::mappings:
       - 'mail-webadmin.main.unkin.net be_stalwart_webadmin'
       - 'autoconfig.main.unkin.net be_stalwart_webadmin'
       - 'autodiscovery.main.unkin.net be_stalwart_webadmin'
+      - 'auth.unkin.net be_k8s_syd1_au_traefik_internal'
   fe_https:
     ensure: present
     mappings:
@@ -56,6 +58,7 @@ profiles::haproxy::mappings:
       - 'mail-webadmin.main.unkin.net be_stalwart_webadmin'
       - 'autoconfig.main.unkin.net be_stalwart_webadmin'
       - 'autodiscovery.main.unkin.net be_stalwart_webadmin'
+      - 'auth.unkin.net be_k8s_syd1_au_traefik_internal'
 
 profiles::haproxy::frontends:
   fe_http:
@@ -80,6 +83,7 @@ profiles::haproxy::frontends:
         - 'acl_stalwart_webadmin req.hdr(host) -i mail-webadmin.main.unkin.net'
         - 'acl_stalwart_webadmin req.hdr(host) -i autoconfig.main.unkin.net'
         - 'acl_stalwart_webadmin req.hdr(host) -i autodiscovery.main.unkin.net'
+        - 'acl_kubernetes req.hdr(host) -i auth.unkin.net'
         - 'acl_internalsubnets src 198.18.0.0/16 10.10.12.0/24'
       use_backend:
         - "%[req.hdr(host),lower,map(/etc/haproxy/fe_https.map,be_default)]"
@@ -99,6 +103,7 @@ profiles::haproxy::frontends:
         - 'set-header X-Frame-Options DENY if acl_grafana'
         - 'set-header X-Frame-Options DENY if acl_ceph_dashboard'
         - 'set-header X-Frame-Options DENY if acl_stalwart_webadmin'
+        - 'set-header X-Frame-Options DENY if acl_kubernetes'
         - 'set-header X-Content-Type-Options nosniff'
         - 'set-header X-XSS-Protection 1;mode=block'
 
@@ -320,6 +325,38 @@ profiles::haproxy::backends:
         - add-header X-Forwarded-Proto https if { dst_port 9443 }
       redirect: 'scheme https if !{ ssl_fc }'
       stick-table: 'type ip size 200k expire 30m'
+  be_k8s_syd1_au_traefik_external:
+    description: Backend for Kubernetes ingress (external Traefik)
+    collect_exported: false
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      http-reuse: always
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 443 }
+      redirect: 'scheme https if !{ ssl_fc }'
+      server: 'k8s-traefik-external 198.18.199.0:443 ssl verify none check inter 2s rise 3 fall 2'
+  be_k8s_syd1_au_traefik_internal:
+    description: Backend for Kubernetes ingress (internal Traefik)
+    collect_exported: false
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      http-reuse: always
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 443 }
+      redirect: 'scheme https if !{ ssl_fc }'
+      server: 'k8s-traefik-internal 198.18.200.4:443 ssl verify none check inter 2s rise 3 fall 2'
   be_stalwart_imap:
     description: Backend for Stalwart IMAP (STARTTLS)
     collect_exported: false
@@ -393,6 +430,7 @@ profiles::haproxy::certlist::certificates:
   - /etc/pki/tls/letsencrypt/git.unkin.net/fullchain_combined.pem
   - /etc/pki/tls/letsencrypt/grafana.unkin.net/fullchain_combined.pem
   - /etc/pki/tls/letsencrypt/dashboard.ceph.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/auth.unkin.net/fullchain_combined.pem
   - /etc/pki/tls/vault/certificate.pem
 
 # additional altnames
@@ -422,3 +460,4 @@ certbot::client::domains:
   - git.unkin.net
   - grafana.unkin.net
   - dashboard.ceph.unkin.net
+  - auth.unkin.net