From e52087185d5764d600d8a9a94f35c368fbbe31d3 Mon Sep 17 00:00:00 2001
From: Paul Buetow <paul@buetow.org>
Date: Fri, 6 Feb 2026 09:10:47 +0200
Subject: Add Traefik ingresses for jellyfin (external and LAN with TLS)

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 f3s/jellyfin/helm-chart/templates/ingress.yaml | 49 ++++++++++++++++++++++++--
 1 file changed, 46 insertions(+), 3 deletions(-)

diff --git a/f3s/jellyfin/helm-chart/templates/ingress.yaml b/f3s/jellyfin/helm-chart/templates/ingress.yaml
index ed01eca..2a76ba5 100644
--- a/f3s/jellyfin/helm-chart/templates/ingress.yaml
+++ b/f3s/jellyfin/helm-chart/templates/ingress.yaml
@@ -1,3 +1,46 @@
-# Jellyfin is exposed via NodePorts 30096 and 30920
-# relayd on frontend proxies directly to these ports, bypassing Traefik
-# This avoids double reverse-proxy complexity and certificate chain issues
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: jellyfin-ingress
+  namespace: services
+  annotations:
+    spec.ingressClassName: traefik
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+spec:
+  rules:
+    - host: jellyfin.f3s.buetow.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: jellyfin-server
+                port:
+                  number: 8096
+---
+# LAN Ingress for jellyfin.f3s.lan.buetow.org with TLS
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: jellyfin-ingress-lan
+  namespace: services
+  annotations:
+    spec.ingressClassName: traefik
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+spec:
+  tls:
+    - hosts:
+        - jellyfin.f3s.lan.buetow.org
+      secretName: f3s-lan-tls
+  rules:
+    - host: jellyfin.f3s.lan.buetow.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: jellyfin-server
+                port:
+                  number: 8096
-- 
cgit v1.2.3