# k8s/ingress/nginx-values.yaml
# Nginx Ingress Controller — bare-metal homelab config.
# LoadBalancer service with Cilium LB-IPAM assigns fixed IP (192.168.1.160).
# Access services at https://grafana.riotpiao.com (80/443 via LoadBalancer).

controller:
  kind: DaemonSet

  # Single wildcard cert served for every *.riotpiao.com host (Let's Encrypt,
  # see ../ingress/riotpiao-com-cert.yaml + ../cert-manager/letsencrypt-issuer.yaml).
  # nginx hot-reloads when cert-manager renews riotpiao-com-tls — no restart needed.
  extraArgs:
    default-ssl-certificate: "ingress-nginx/riotpiao-com-tls"

  hostPort:
    enabled: true
    ports:
      http: 80
      https: 443

  # TCP proxy: forward port 2222 on every node → Forgejo SSH service.
  # This lets `git clone git@forgejo.riotpiao.com:repo` work via the
  # same hostname as HTTPS without a separate LoadBalancer IP for SSH.
  tcp:
    2222: "cicd/forgejo-gitea-ssh:2222"

  # Service as LoadBalancer — Cilium LB-IPAM assigns fixed IP.
  service:
    type: LoadBalancer
    annotations:
      io.cilium/lb-ipam-ips: "192.168.1.160"

  # Allow the controller to land on the control-plane node.
  tolerations:
    - key: node-role.kubernetes.io/control-plane
      operator: Exists
      effect: NoSchedule

  # Use the ingress-nginx IngressClass by default.
  ingressClassResource:
    default: true

  # Required when using hostPort so DNS resolves correctly inside the pod.
  dnsPolicy: ClusterFirstWithHostNet

  # Reduce noise in a single-admin homelab.
  admissionWebhooks:
    enabled: false

  # ── Connection timeouts to upstreams ──────────────────────────────────────────
  # Increased to tolerate 5+ second pod-to-pod network latency spikes.
  # Default: 60s for all — acceptable but explicitly set for clarity.
  config:
    upstream-connect-timeout: "60"
    upstream-send-timeout: "60"
    upstream-read-timeout: "60"
    keepalive-timeout: "65"
    keepalive-requests: "100"

    # force-ssl-redirect: our Ingress objects intentionally omit per-rule `tls:`
    # blocks (single wildcard cert served via default-ssl-certificate above).
    # nginx-ingress's normal `ssl-redirect` only forces HTTPS for hosts that have
    # an explicit TLS block on their own Ingress resource — since none of ours do,
    # plain http://*.riotpiao.com requests were being served directly instead of
    # 301-redirected to https://, silently serving every client-facing console
    # over plaintext HTTP. force-ssl-redirect forces the redirect globally
    # regardless of per-ingress TLS block presence.
    force-ssl-redirect: "true"

  resources:
    requests:
      cpu: 50m
      memory: 64Mi
    limits:
      cpu: 200m
      memory: 128Mi

  # RED metrics (rate/errors/duration) for every host fronted by this controller —
  # every exposed service in the cluster goes through here, so this single block
  # is the cluster-wide "latency and availability" signal. Prometheus auto-discovers
  # the ServiceMonitor (serviceMonitorSelectorNilUsesHelmValues: false in prometheus-values.yaml).
  metrics:
    enabled: true
    serviceMonitor:
      enabled: true
      namespace: ingress-nginx
      interval: 30s
      scrapeTimeout: 30s