feat: add LAN ingresses for all services

Add *.f3s.lan.buetow.org ingress resources for all services to enable
LAN access with TLS termination. This allows direct access from the
192.168.1.0/24 network through the FreeBSD CARP/relayd setup.

Services updated:
- argocd: argocd.f3s.lan.buetow.org
- cgit: cgit.f3s.lan.buetow.org
- grafana: grafana.f3s.lan.buetow.org
- anki-sync-server: anki.f3s.lan.buetow.org
- apache: f3s.lan.buetow.org, www.f3s.lan.buetow.org, standby.f3s.lan.buetow.org
- audiobookshelf: audiobookshelf.f3s.lan.buetow.org
- filebrowser: filebrowser.f3s.lan.buetow.org
- immich: immich.f3s.lan.buetow.org
- ipv6test: ipv6test.f3s.lan.buetow.org (+ ipv4/ipv6 subdomains)
- keybr: keybr.f3s.lan.buetow.org
- koreader-sync-server: koreader.f3s.lan.buetow.org
- miniflux: flux.f3s.lan.buetow.org
- opodsync: gpodder.f3s.lan.buetow.org
- radicale: radicale.f3s.lan.buetow.org
- syncthing: syncthing.f3s.lan.buetow.org
- tracing-demo: tracing-demo.f3s.lan.buetow.org
- wallabag: bag.f3s.lan.buetow.org
- webdav: webdav.f3s.lan.buetow.org

All LAN ingresses use:
- TLS with f3s-lan-tls certificate (cert-manager)
- Traefik entrypoints: web,websecure
- Same backend services as external ingresses

Also fixed koreader-sync-server ingress to use modern annotations.

Co-authored-by: Cursor <cursoragent@cursor.com>

18 files changed, 492 insertions, 2 deletions

diff --git a/f3s/anki-sync-server/helm-chart/templates/ingress.yaml b/f3s/anki-sync-server/helm-chart/templates/ingress.yaml
index 010c588..ff98d15 100644
--- a/f3s/anki-sync-server/helm-chart/templates/ingress.yaml
+++ b/f3s/anki-sync-server/helm-chart/templates/ingress.yaml
@@ -18,3 +18,28 @@ spec:
                 name: anki-sync-server-service
                 port:
                   number: 8080
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: anki-sync-server-ingress-lan
+  namespace: services
+  annotations:
+    spec.ingressClassName: traefik
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+spec:
+  tls:
+    - hosts:
+        - anki.f3s.lan.buetow.org
+      secretName: f3s-lan-tls
+  rules:
+    - host: anki.f3s.lan.buetow.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: anki-sync-server-service
+                port:
+                  number: 8080
diff --git a/f3s/apache/helm-chart/templates/apache-ingress.yaml b/f3s/apache/helm-chart/templates/apache-ingress.yaml
index 241978e..2842c68 100644
--- a/f3s/apache/helm-chart/templates/apache-ingress.yaml
+++ b/f3s/apache/helm-chart/templates/apache-ingress.yaml
@@ -3,7 +3,6 @@ kind: Ingress
 metadata:
   name: apache-ingress
   namespace: services
-  namespace: services
   annotations:
     spec.ingressClassName: traefik
     traefik.ingress.kubernetes.io/router.entrypoints: web
@@ -39,3 +38,50 @@ spec:
                 name: apache-service
                 port:
                   number: 80
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: apache-ingress-lan
+  namespace: services
+  annotations:
+    spec.ingressClassName: traefik
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+spec:
+  tls:
+    - hosts:
+        - f3s.lan.buetow.org
+        - standby.f3s.lan.buetow.org
+        - www.f3s.lan.buetow.org
+      secretName: f3s-lan-tls
+  rules:
+    - host: f3s.lan.buetow.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: apache-service
+                port:
+                  number: 80
+    - host: standby.f3s.lan.buetow.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: apache-service
+                port:
+                  number: 80
+    - host: www.f3s.lan.buetow.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: apache-service
+                port:
+                  number: 80
diff --git a/f3s/argocd-apps/services/immich.yaml b/f3s/argocd-apps/services/immich.yaml
index 32c7d11..d8870eb 100644
--- a/f3s/argocd-apps/services/immich.yaml
+++ b/f3s/argocd-apps/services/immich.yaml
@@ -61,6 +61,23 @@ spec:
                         service:
                           identifier: main
                           port: 2283
+              lan:
+                enabled: true
+                annotations:
+                  spec.ingressClassName: traefik
+                  traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+                  traefik.ingress.kubernetes.io/router.middlewares: services-immich-body-size@kubernetescrd
+                tls:
+                  - hosts:
+                      - immich.f3s.lan.buetow.org
+                    secretName: f3s-lan-tls
+                hosts:
+                  - host: immich.f3s.lan.buetow.org
+                    paths:
+                      - path: "/"
+                        service:
+                          identifier: main
+                          port: 2283
           machine-learning:
             enabled: true
             persistence:
diff --git a/f3s/argocd/ingress.yaml b/f3s/argocd/ingress.yaml
index b10c288..f87f475 100644
--- a/f3s/argocd/ingress.yaml
+++ b/f3s/argocd/ingress.yaml
@@ -22,3 +22,29 @@ spec:
                 name: argocd-server
                 port:
                   number: 80
+---
+# ArgoCD UI LAN Ingress
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: argocd-server-ingress-lan
+  namespace: cicd
+  annotations:
+    spec.ingressClassName: traefik
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+spec:
+  tls:
+    - hosts:
+        - argocd.f3s.lan.buetow.org
+      secretName: f3s-lan-tls
+  rules:
+    - host: argocd.f3s.lan.buetow.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: argocd-server
+                port:
+                  number: 80
diff --git a/f3s/audiobookshelf/helm-chart/templates/ingress.yaml b/f3s/audiobookshelf/helm-chart/templates/ingress.yaml
index 6e4f7ac..72cdb4c 100644
--- a/f3s/audiobookshelf/helm-chart/templates/ingress.yaml
+++ b/f3s/audiobookshelf/helm-chart/templates/ingress.yaml
@@ -18,3 +18,28 @@ spec:
                 name: audiobookshelf-service
                 port:
                   number: 80
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: audiobookshelf-ingress-lan
+  namespace: services
+  annotations:
+    spec.ingressClassName: traefik
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+spec:
+  tls:
+    - hosts:
+        - audiobookshelf.f3s.lan.buetow.org
+      secretName: f3s-lan-tls
+  rules:
+    - host: audiobookshelf.f3s.lan.buetow.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: audiobookshelf-service
+                port:
+                  number: 80
diff --git a/f3s/filebrowser/helm-chart/templates/ingress.yaml b/f3s/filebrowser/helm-chart/templates/ingress.yaml
index 4623501..a8a9d2b 100644
--- a/f3s/filebrowser/helm-chart/templates/ingress.yaml
+++ b/f3s/filebrowser/helm-chart/templates/ingress.yaml
@@ -18,3 +18,28 @@ spec:
                 name: filebrowser-service
                 port:
                   number: 80
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: filebrowser-ingress-lan
+  namespace: services
+  annotations:
+    spec.ingressClassName: traefik
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+spec:
+  tls:
+    - hosts:
+        - filebrowser.f3s.lan.buetow.org
+      secretName: f3s-lan-tls
+  rules:
+    - host: filebrowser.f3s.lan.buetow.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: filebrowser-service
+                port:
+                  number: 80
diff --git a/f3s/git-server/helm-chart/templates/ingress.yaml b/f3s/git-server/helm-chart/templates/ingress.yaml
index e47ff7f..96609fc 100644
--- a/f3s/git-server/helm-chart/templates/ingress.yaml
+++ b/f3s/git-server/helm-chart/templates/ingress.yaml
@@ -22,3 +22,29 @@ spec:
                 name: git-server
                 port:
                   number: 80
+---
+# CGit Web UI LAN Ingress
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: cgit-ingress-lan
+  namespace: cicd
+  annotations:
+    spec.ingressClassName: traefik
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+spec:
+  tls:
+    - hosts:
+        - cgit.f3s.lan.buetow.org
+      secretName: f3s-lan-tls
+  rules:
+    - host: cgit.f3s.lan.buetow.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: git-server
+                port:
+                  number: 80
diff --git a/f3s/ipv6test/helm-chart/templates/ingress.yaml b/f3s/ipv6test/helm-chart/templates/ingress.yaml
index 7c3f0c1..5b8cf26 100644
--- a/f3s/ipv6test/helm-chart/templates/ingress.yaml
+++ b/f3s/ipv6test/helm-chart/templates/ingress.yaml
@@ -38,3 +38,50 @@ spec:
                 name: ipv6test-service
                 port:
                   number: 80
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: ipv6test-ingress-lan
+  namespace: services
+  annotations:
+    spec.ingressClassName: traefik
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+spec:
+  tls:
+    - hosts:
+        - ipv6test.f3s.lan.buetow.org
+        - ipv4.ipv6test.f3s.lan.buetow.org
+        - ipv6.ipv6test.f3s.lan.buetow.org
+      secretName: f3s-lan-tls
+  rules:
+    - host: ipv6test.f3s.lan.buetow.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: ipv6test-service
+                port:
+                  number: 80
+    - host: ipv4.ipv6test.f3s.lan.buetow.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: ipv6test-service
+                port:
+                  number: 80
+    - host: ipv6.ipv6test.f3s.lan.buetow.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: ipv6test-service
+                port:
+                  number: 80
diff --git a/f3s/keybr/helm-chart/templates/ingress.yaml b/f3s/keybr/helm-chart/templates/ingress.yaml
index 05cfe16..babcfd9 100644
--- a/f3s/keybr/helm-chart/templates/ingress.yaml
+++ b/f3s/keybr/helm-chart/templates/ingress.yaml
@@ -18,3 +18,28 @@ spec:
                 name: keybr-service
                 port:
                   number: 3000
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: keybr-ingress-lan
+  namespace: services
+  annotations:
+    spec.ingressClassName: traefik
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+spec:
+  tls:
+    - hosts:
+        - keybr.f3s.lan.buetow.org
+      secretName: f3s-lan-tls
+  rules:
+    - host: keybr.f3s.lan.buetow.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: keybr-service
+                port:
+                  number: 3000
diff --git a/f3s/kobo-sync-server/helm-chart/templates/ingress.yaml b/f3s/kobo-sync-server/helm-chart/templates/ingress.yaml
index d5991cf..29dcf54 100644
--- a/f3s/kobo-sync-server/helm-chart/templates/ingress.yaml
+++ b/f3s/kobo-sync-server/helm-chart/templates/ingress.yaml
@@ -2,8 +2,10 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: koreader-sync-server-ingress
+  namespace: services
   annotations:
-    kubernetes.io/ingress.class: "traefik"
+    spec.ingressClassName: traefik
+    traefik.ingress.kubernetes.io/router.entrypoints: web
 spec:
   rules:
   - host: koreader.f3s.buetow.org
@@ -16,3 +18,28 @@ spec:
             name: koreader-sync-server
             port:
               number: 80
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: koreader-sync-server-ingress-lan
+  namespace: services
+  annotations:
+    spec.ingressClassName: traefik
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+spec:
+  tls:
+    - hosts:
+        - koreader.f3s.lan.buetow.org
+      secretName: f3s-lan-tls
+  rules:
+  - host: koreader.f3s.lan.buetow.org
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: koreader-sync-server
+            port:
+              number: 80
diff --git a/f3s/miniflux/helm-chart/templates/ingress.yaml b/f3s/miniflux/helm-chart/templates/ingress.yaml
index 95f1838..014c839 100644
--- a/f3s/miniflux/helm-chart/templates/ingress.yaml
+++ b/f3s/miniflux/helm-chart/templates/ingress.yaml
@@ -18,3 +18,28 @@ spec:
                 name: miniflux
                 port:
                   number: 8080
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: miniflux-ingress-lan
+  namespace: services
+  annotations:
+    spec.ingressClassName: traefik
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+spec:
+  tls:
+    - hosts:
+        - flux.f3s.lan.buetow.org
+      secretName: f3s-lan-tls
+  rules:
+    - host: flux.f3s.lan.buetow.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: miniflux
+                port:
+                  number: 8080
diff --git a/f3s/opodsync/helm-chart/templates/ingress.yaml b/f3s/opodsync/helm-chart/templates/ingress.yaml
index a29d27b..a7b22a0 100644
--- a/f3s/opodsync/helm-chart/templates/ingress.yaml
+++ b/f3s/opodsync/helm-chart/templates/ingress.yaml
@@ -18,3 +18,28 @@ spec:
                 name: opodsync-service
                 port:
                   number: 80
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: opodsync-ingress-lan
+  namespace: services
+  annotations:
+    spec.ingressClassName: traefik
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+spec:
+  tls:
+    - hosts:
+        - gpodder.f3s.lan.buetow.org
+      secretName: f3s-lan-tls
+  rules:
+    - host: gpodder.f3s.lan.buetow.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: opodsync-service
+                port:
+                  number: 80
diff --git a/f3s/prometheus/grafana-ingress/templates/ingress.yaml b/f3s/prometheus/grafana-ingress/templates/ingress.yaml
index 5d6b08d..b99720d 100644
--- a/f3s/prometheus/grafana-ingress/templates/ingress.yaml
+++ b/f3s/prometheus/grafana-ingress/templates/ingress.yaml
@@ -18,3 +18,28 @@ spec:
                 name: {{ .Values.ingress.service.name }}
                 port:
                   number: {{ .Values.ingress.service.port }}
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: grafana-ingress-lan
+  namespace: {{ .Values.ingress.namespace }}
+  annotations:
+    spec.ingressClassName: {{ index .Values.ingress.annotations "spec.ingressClassName" }}
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+spec:
+  tls:
+    - hosts:
+        - grafana.f3s.lan.buetow.org
+      secretName: f3s-lan-tls
+  rules:
+    - host: grafana.f3s.lan.buetow.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ .Values.ingress.service.name }}
+                port:
+                  number: {{ .Values.ingress.service.port }}
diff --git a/f3s/radicale/helm-chart/templates/ingress.yaml b/f3s/radicale/helm-chart/templates/ingress.yaml
index 680ab7d..ba217af 100644
--- a/f3s/radicale/helm-chart/templates/ingress.yaml
+++ b/f3s/radicale/helm-chart/templates/ingress.yaml
@@ -18,3 +18,28 @@ spec:
                 name: radicale-service
                 port:
                   number: 80
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: radicale-ingress-lan
+  namespace: services
+  annotations:
+    spec.ingressClassName: traefik
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+spec:
+  tls:
+    - hosts:
+        - radicale.f3s.lan.buetow.org
+      secretName: f3s-lan-tls
+  rules:
+    - host: radicale.f3s.lan.buetow.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: radicale-service
+                port:
+                  number: 80
diff --git a/f3s/syncthing/helm-chart/templates/ingress.yaml b/f3s/syncthing/helm-chart/templates/ingress.yaml
index b1e68e1..bb2e81c 100644
--- a/f3s/syncthing/helm-chart/templates/ingress.yaml
+++ b/f3s/syncthing/helm-chart/templates/ingress.yaml
@@ -18,3 +18,28 @@ spec:
                 name: syncthing-service
                 port:
                   number: 8384
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: syncthing-ingress-lan
+  namespace: services
+  annotations:
+    spec.ingressClassName: traefik
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+spec:
+  tls:
+    - hosts:
+        - syncthing.f3s.lan.buetow.org
+      secretName: f3s-lan-tls
+  rules:
+    - host: syncthing.f3s.lan.buetow.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: syncthing-service
+                port:
+                  number: 8384
diff --git a/f3s/tracing-demo/helm-chart/templates/ingress.yaml b/f3s/tracing-demo/helm-chart/templates/ingress.yaml
index f080761..2d10042 100644
--- a/f3s/tracing-demo/helm-chart/templates/ingress.yaml
+++ b/f3s/tracing-demo/helm-chart/templates/ingress.yaml
@@ -20,3 +20,29 @@ spec:
                 name: frontend-service
                 port:
                   number: 5000
+---
+# LAN Ingress for Frontend Service
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: tracing-demo-ingress-lan
+  namespace: services
+  annotations:
+    spec.ingressClassName: traefik
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+spec:
+  tls:
+    - hosts:
+        - tracing-demo.f3s.lan.buetow.org
+      secretName: f3s-lan-tls
+  rules:
+    - host: tracing-demo.f3s.lan.buetow.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: frontend-service
+                port:
+                  number: 5000
diff --git a/f3s/wallabag/helm-chart/templates/ingress.yaml b/f3s/wallabag/helm-chart/templates/ingress.yaml
index deb489a..3405b42 100644
--- a/f3s/wallabag/helm-chart/templates/ingress.yaml
+++ b/f3s/wallabag/helm-chart/templates/ingress.yaml
@@ -18,3 +18,28 @@ spec:
                 name: wallabag-service
                 port:
                   number: 80
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: wallabag-ingress-lan
+  namespace: services
+  annotations:
+    spec.ingressClassName: traefik
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+spec:
+  tls:
+    - hosts:
+        - bag.f3s.lan.buetow.org
+      secretName: f3s-lan-tls
+  rules:
+    - host: bag.f3s.lan.buetow.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: wallabag-service
+                port:
+                  number: 80
diff --git a/f3s/webdav/helm-chart/templates/ingress.yaml b/f3s/webdav/helm-chart/templates/ingress.yaml
index e79aadb..9961510 100644
--- a/f3s/webdav/helm-chart/templates/ingress.yaml
+++ b/f3s/webdav/helm-chart/templates/ingress.yaml
@@ -18,3 +18,28 @@ spec:
                 name: webdav-service
                 port:
                   number: 80
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: webdav-ingress-lan
+  namespace: services
+  annotations:
+    spec.ingressClassName: traefik
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+spec:
+  tls:
+    - hosts:
+        - webdav.f3s.lan.buetow.org
+      secretName: f3s-lan-tls
+  rules:
+    - host: webdav.f3s.lan.buetow.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: webdav-service
+                port:
+                  number: 80