certmanager

networking/cert-manager.yaml

@@ -0,0 +1,59 @@
+# using the same issuer for everything
+# ntr@strix is the big boss
+
+---
+
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  repo: https://charts.jetstack.io
+  chart: cert-manager
+  targetNamespace: networking
+  valuesContent: |-
+    crds:
+      enabled: true
+
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging
+spec:
+  acme:
+    # The ACME server URL
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    # Email address used for ACME registration
+    email: ntr@strix.systems
+    # Name of a secret used to store the ACME account private key
+    privateKeySecretRef:
+      name: letsencrypt-staging
+    # Enable the HTTP-01 challenge provider
+    solvers:
+      - http01:
+          ingress:
+            ingressClassName: haproxy
+
+---
+
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    # The ACME server URL
+    server: https://acme-v02.api.letsencrypt.org/directory
+    # Email address used for ACME registration
+    email: ntr@strix.systems
+    # Name of a secret used to store the ACME account private key
+    privateKeySecretRef:
+      name: letsencrypt-prod
+    # Enable the HTTP-01 challenge provider
+    solvers:
+      - http01:
+          ingress:
+            ingressClassName: haproxy
+

networking/haproxy.yaml

@@ -1,11 +1,4 @@
 ---
-
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: networking
-
----
 apiVersion: helm.cattle.io/v1
 kind: HelmChart
 metadata:
@@ -19,4 +12,8 @@ spec:
     controller:
       kind: DaemonSet
       daemonset:
-        useHostPort: true
+        useHostPort: true
+      config:
+        ssl-redirect-port: "443"
+
+# - --https-bind-port=443

networking/networking.yaml

@@ -0,0 +1,6 @@
+---
+
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: networking