From 690ff2a19ca494373b12d658d22a96e0b8de7825 Mon Sep 17 00:00:00 2001
From: Aleksandr Bogomiakov <git@hexor.cy>
Date: Mon, 5 Oct 2026 19:00:28 +0100
Subject: [PATCH] NG: added http -> https redir

---
 k8s-ng/core-state/values.yaml                 |  4 +++
 .../core/traefik-config/helmchartconfig.yaml  | 16 ++++++++++
 k8s-ng/core/traefik-config/http-redirect.yaml | 29 +++++++++++++++++++
 k8s-ng/core/traefik-config/kustomization.yaml |  6 ++++
 4 files changed, 55 insertions(+)
 create mode 100644 k8s-ng/core/traefik-config/helmchartconfig.yaml
 create mode 100644 k8s-ng/core/traefik-config/http-redirect.yaml
 create mode 100644 k8s-ng/core/traefik-config/kustomization.yaml

diff --git a/k8s-ng/core-state/values.yaml b/k8s-ng/core-state/values.yaml
index 03dfc16..6f96541 100644
--- a/k8s-ng/core-state/values.yaml
+++ b/k8s-ng/core-state/values.yaml
@@ -20,6 +20,10 @@ apps:
     path: k8s-ng/core/cnpg
     namespace: cnpg-system
     wave: 1
+  - name: traefik-config
+    path: k8s-ng/core/traefik-config
+    namespace: kube-system
+    wave: 1
   - name: cert-manager
     path: k8s-ng/core/cert-manager
     namespace: cert-manager
diff --git a/k8s-ng/core/traefik-config/helmchartconfig.yaml b/k8s-ng/core/traefik-config/helmchartconfig.yaml
new file mode 100644
index 0000000..64947aa
--- /dev/null
+++ b/k8s-ng/core/traefik-config/helmchartconfig.yaml
@@ -0,0 +1,16 @@
+# Configuration of the Traefik that ships with k3s.
+# Ingresses without a router.entrypoints annotation now use only "websecure", so
+# plain HTTP is redirected to HTTPS by default (see http-redirect.yaml).
+# To publish an Ingress over plain HTTP add the annotation
+#   traefik.ingress.kubernetes.io/router.entrypoints: web
+# (or "web,websecure" to serve both without a redirect).
+apiVersion: helm.cattle.io/v1
+kind: HelmChartConfig
+metadata:
+  name: traefik
+  namespace: kube-system
+spec:
+  valuesContent: |-
+    ports:
+      websecure:
+        asDefault: true
diff --git a/k8s-ng/core/traefik-config/http-redirect.yaml b/k8s-ng/core/traefik-config/http-redirect.yaml
new file mode 100644
index 0000000..f814e06
--- /dev/null
+++ b/k8s-ng/core/traefik-config/http-redirect.yaml
@@ -0,0 +1,29 @@
+# Catch-all on the "web" entrypoint with the lowest priority: every host that has
+# no explicit HTTP router of its own is redirected to HTTPS.
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: redirect-https
+  namespace: kube-system
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: http-redirect
+  namespace: kube-system
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: HostRegexp(`.+`)
+      kind: Rule
+      priority: 1
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: noop@internal
+          kind: TraefikService
diff --git a/k8s-ng/core/traefik-config/kustomization.yaml b/k8s-ng/core/traefik-config/kustomization.yaml
new file mode 100644
index 0000000..593246c
--- /dev/null
+++ b/k8s-ng/core/traefik-config/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - helmchartconfig.yaml
+  - http-redirect.yaml