From 404f7b9309b9206459681c5b56a57bc1aeb47c5c Mon Sep 17 00:00:00 2001
From: Paul Buetow <paul@buetow.org>
Date: Sat, 7 Feb 2026 22:54:26 +0200
Subject: feat: add LAN ingresses for all services

Add *.f3s.lan.buetow.org ingress resources for all services to enable
LAN access with TLS termination. This allows direct access from the
192.168.1.0/24 network through the FreeBSD CARP/relayd setup.

Services updated:
- argocd: argocd.f3s.lan.buetow.org
- cgit: cgit.f3s.lan.buetow.org
- grafana: grafana.f3s.lan.buetow.org
- anki-sync-server: anki.f3s.lan.buetow.org
- apache: f3s.lan.buetow.org, www.f3s.lan.buetow.org, standby.f3s.lan.buetow.org
- audiobookshelf: audiobookshelf.f3s.lan.buetow.org
- filebrowser: filebrowser.f3s.lan.buetow.org
- immich: immich.f3s.lan.buetow.org
- ipv6test: ipv6test.f3s.lan.buetow.org (+ ipv4/ipv6 subdomains)
- keybr: keybr.f3s.lan.buetow.org
- koreader-sync-server: koreader.f3s.lan.buetow.org
- miniflux: flux.f3s.lan.buetow.org
- opodsync: gpodder.f3s.lan.buetow.org
- radicale: radicale.f3s.lan.buetow.org
- syncthing: syncthing.f3s.lan.buetow.org
- tracing-demo: tracing-demo.f3s.lan.buetow.org
- wallabag: bag.f3s.lan.buetow.org
- webdav: webdav.f3s.lan.buetow.org

All LAN ingresses use:
- TLS with f3s-lan-tls certificate (cert-manager)
- Traefik entrypoints: web,websecure
- Same backend services as external ingresses

Also fixed koreader-sync-server ingress to use modern annotations.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 f3s/wallabag/helm-chart/templates/ingress.yaml | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

(limited to 'f3s/wallabag/helm-chart/templates')

diff --git a/f3s/wallabag/helm-chart/templates/ingress.yaml b/f3s/wallabag/helm-chart/templates/ingress.yaml
index deb489a..3405b42 100644
--- a/f3s/wallabag/helm-chart/templates/ingress.yaml
+++ b/f3s/wallabag/helm-chart/templates/ingress.yaml
@@ -18,3 +18,28 @@ spec:
                 name: wallabag-service
                 port:
                   number: 80
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: wallabag-ingress-lan
+  namespace: services
+  annotations:
+    spec.ingressClassName: traefik
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+spec:
+  tls:
+    - hosts:
+        - bag.f3s.lan.buetow.org
+      secretName: f3s-lan-tls
+  rules:
+    - host: bag.f3s.lan.buetow.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: wallabag-service
+                port:
+                  number: 80
-- 
cgit v1.2.3