# k8s/ingress/nginx-values.yaml
# Nginx Ingress Controller — bare-metal homelab config.
# LoadBalancer service with Cilium LB-IPAM assigns fixed IP (192.168.1.160).
# Access services at https://grafana.riotpiao.homelab.com (80/443 via LoadBalancer).

controller:
  kind: DaemonSet

  # Single wildcard cert served for every *.riotpiao.homelab.com host.
  # Applied by the ingress-nginx presync hook (wildcard-cert.yaml) before nginx starts.
  # nginx hot-reloads when cert-manager renews homelab-tls — no restart needed.
  extraArgs:
    default-ssl-certificate: "ingress-nginx/homelab-tls"

  hostPort:
    enabled: true
    ports:
      http: 80
      https: 443

  # TCP proxy: forward port 2222 on every node → Forgejo SSH service.
  # This lets `git clone git@forgejo.riotpiao.homelab.com:repo` work via the
  # same hostname as HTTPS without a separate LoadBalancer IP for SSH.
  tcp:
    2222: "cicd/forgejo-gitea-ssh:2222"

  # Service as LoadBalancer — Cilium LB-IPAM assigns fixed IP.
  service:
    type: LoadBalancer
    annotations:
      io.cilium/lb-ipam-ips: "192.168.1.160"

  # Allow the controller to land on the control-plane node.
  tolerations:
    - key: node-role.kubernetes.io/control-plane
      operator: Exists
      effect: NoSchedule

  # Use the ingress-nginx IngressClass by default.
  ingressClassResource:
    default: true

  # Required when using hostPort so DNS resolves correctly inside the pod.
  dnsPolicy: ClusterFirstWithHostNet

  # Reduce noise in a single-admin homelab.
  admissionWebhooks:
    enabled: false

  # ── Connection timeouts to upstreams ──────────────────────────────────────────
  # Increased to tolerate 5+ second pod-to-pod network latency spikes.
  # Default: 60s for all — acceptable but explicitly set for clarity.
  config:
    upstream-connect-timeout: "60"
    upstream-send-timeout: "60"
    upstream-read-timeout: "60"
    keepalive-timeout: "65"
    keepalive-requests: "100"

  resources:
    requests:
      cpu: 50m
      memory: 64Mi
    limits:
      cpu: 200m
      memory: 128Mi

  # RED metrics (rate/errors/duration) for every host fronted by this controller —
  # every exposed service in the cluster goes through here, so this single block
  # is the cluster-wide "latency and availability" signal. Prometheus auto-discovers
  # the ServiceMonitor (serviceMonitorSelectorNilUsesHelmValues: false in prometheus-values.yaml).
  metrics:
    enabled: true
    serviceMonitor:
      enabled: true
      namespace: ingress-nginx
      interval: 30s
      scrapeTimeout: 60s