Story Crater Bot
6d5a0ba205
- Nginx ingress + TLS termination (homelab-ca) - Portainer container UI - CoreDNS internal DNS rewrites - DuckDNS DDNS updater - Ollama LLM inference - 8 project-usage guides (team reference)
79 lines
2.6 KiB
YAML
79 lines
2.6 KiB
YAML
# k8s/ingress/nginx-values.yaml
|
|
# Nginx Ingress Controller — bare-metal homelab config.
|
|
# LoadBalancer service with Cilium LB-IPAM assigns fixed IP (192.168.1.160).
|
|
# Access services at https://grafana.riotpiao.homelab.com (80/443 via LoadBalancer).
|
|
|
|
controller:
|
|
kind: DaemonSet
|
|
|
|
# Single wildcard cert served for every *.riotpiao.homelab.com host.
|
|
# Applied by the ingress-nginx presync hook (wildcard-cert.yaml) before nginx starts.
|
|
# nginx hot-reloads when cert-manager renews homelab-tls — no restart needed.
|
|
extraArgs:
|
|
default-ssl-certificate: "ingress-nginx/homelab-tls"
|
|
|
|
hostPort:
|
|
enabled: true
|
|
ports:
|
|
http: 80
|
|
https: 443
|
|
|
|
# TCP proxy: forward port 2222 on every node → Forgejo SSH service.
|
|
# This lets `git clone [email protected]:repo` work via the
|
|
# same hostname as HTTPS without a separate LoadBalancer IP for SSH.
|
|
tcp:
|
|
2222: "cicd/forgejo-gitea-ssh:2222"
|
|
|
|
# Service as LoadBalancer — Cilium LB-IPAM assigns fixed IP.
|
|
service:
|
|
type: LoadBalancer
|
|
annotations:
|
|
io.cilium/lb-ipam-ips: "192.168.1.160"
|
|
|
|
# Allow the controller to land on the control-plane node.
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
|
|
# Use the ingress-nginx IngressClass by default.
|
|
ingressClassResource:
|
|
default: true
|
|
|
|
# Required when using hostPort so DNS resolves correctly inside the pod.
|
|
dnsPolicy: ClusterFirstWithHostNet
|
|
|
|
# Reduce noise in a single-admin homelab.
|
|
admissionWebhooks:
|
|
enabled: false
|
|
|
|
# ── Connection timeouts to upstreams ──────────────────────────────────────────
|
|
# Increased to tolerate 5+ second pod-to-pod network latency spikes.
|
|
# Default: 60s for all — acceptable but explicitly set for clarity.
|
|
config:
|
|
upstream-connect-timeout: "60"
|
|
upstream-send-timeout: "60"
|
|
upstream-read-timeout: "60"
|
|
keepalive-timeout: "65"
|
|
keepalive-requests: "100"
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
limits:
|
|
cpu: 200m
|
|
memory: 128Mi
|
|
|
|
# RED metrics (rate/errors/duration) for every host fronted by this controller —
|
|
# every exposed service in the cluster goes through here, so this single block
|
|
# is the cluster-wide "latency and availability" signal. Prometheus auto-discovers
|
|
# the ServiceMonitor (serviceMonitorSelectorNilUsesHelmValues: false in prometheus-values.yaml).
|
|
metrics:
|
|
enabled: true
|
|
serviceMonitor:
|
|
enabled: true
|
|
namespace: ingress-nginx
|
|
interval: 30s
|
|
scrapeTimeout: 60s
|