diff --git a/k8s/apps/syncthing/asset-router.yaml b/k8s/apps/syncthing/asset-router.yaml
deleted file mode 100644
index 0bff4c3..0000000
--- a/k8s/apps/syncthing/asset-router.yaml
+++ /dev/null
@@ -1,85 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
- name: nginx-router-config
- namespace: syncthing
-data:
- default.conf: |
- server {
- listen 80;
- server_name _;
-
- # Route assets based on cookie or referer
- location / {
- # Check cookie first
- if ($cookie_syncthing_instance = "nas") {
- proxy_pass http://syncthing-nas:8384;
- }
- if ($cookie_syncthing_instance = "master") {
- proxy_pass http://syncthing-master:8384;
- }
- if ($cookie_syncthing_instance = "iris") {
- proxy_pass http://syncthing-khv:8384;
- }
-
- # Check referer as fallback
- if ($http_referer ~ "/nas") {
- proxy_pass http://syncthing-nas:8384;
- }
- if ($http_referer ~ "/master") {
- proxy_pass http://syncthing-master:8384;
- }
- if ($http_referer ~ "/iris") {
- proxy_pass http://syncthing-khv:8384;
- }
-
- # Default to nas if no match
- proxy_pass http://syncthing-nas:8384;
-
- proxy_set_header Host $host;
- proxy_set_header X-Real-IP $remote_addr;
- proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
- proxy_set_header X-Forwarded-Proto $scheme;
- }
- }
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
- name: syncthing-router
- namespace: syncthing
-spec:
- replicas: 1
- selector:
- matchLabels:
- app: syncthing-router
- template:
- metadata:
- labels:
- app: syncthing-router
- spec:
- containers:
- - name: nginx
- image: nginx:alpine
- ports:
- - containerPort: 80
- volumeMounts:
- - name: config
- mountPath: /etc/nginx/conf.d
- volumes:
- - name: config
- configMap:
- name: nginx-router-config
----
-apiVersion: v1
-kind: Service
-metadata:
- name: syncthing-router
- namespace: syncthing
-spec:
- selector:
- app: syncthing-router
- ports:
- - protocol: TCP
- port: 80
- targetPort: 80
\ No newline at end of file
diff --git a/k8s/apps/syncthing/ingress-route.yaml b/k8s/apps/syncthing/ingress-route.yaml
deleted file mode 100644
index a9a8adc..0000000
--- a/k8s/apps/syncthing/ingress-route.yaml
+++ /dev/null
@@ -1,85 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
- name: syncthing-ingressroute
- namespace: syncthing
-spec:
- entryPoints:
- - websecure
- routes:
- # Landing page
- - match: Host(`ss.hexor.cy`) && Path(`/`)
- kind: Rule
- services:
- - name: syncthing-landing
- port: 80
- middlewares:
- - name: authentik-forward-auth
- namespace: syncthing
-
- # NAS instance and its assets
- - match: Host(`ss.hexor.cy`) && PathPrefix(`/nas`)
- kind: Rule
- priority: 100
- services:
- - name: syncthing-nas
- port: 8384
- middlewares:
- - name: authentik-forward-auth
- namespace: syncthing
- - name: syncthing-headers-nas
- namespace: syncthing
- - name: set-cookie-nas
- namespace: syncthing
- - name: strip-prefix-nas
- namespace: syncthing
-
- # Master instance and its assets
- - match: Host(`ss.hexor.cy`) && PathPrefix(`/master`)
- kind: Rule
- priority: 100
- services:
- - name: syncthing-master
- port: 8384
- middlewares:
- - name: authentik-forward-auth
- namespace: syncthing
- - name: syncthing-headers-master
- namespace: syncthing
- - name: set-cookie-master
- namespace: syncthing
- - name: strip-prefix-master
- namespace: syncthing
-
- # Iris instance and its assets
- - match: Host(`ss.hexor.cy`) && PathPrefix(`/iris`)
- kind: Rule
- priority: 100
- services:
- - name: syncthing-khv
- port: 8384
- middlewares:
- - name: authentik-forward-auth
- namespace: syncthing
- - name: syncthing-headers-iris
- namespace: syncthing
- - name: set-cookie-iris
- namespace: syncthing
- - name: strip-prefix-iris
- namespace: syncthing
-
- # Catch all static assets and route based on referer header
- - match: Host(`ss.hexor.cy`) && (PathPrefix(`/vendor`) || PathPrefix(`/theme-assets`) || PathPrefix(`/meta`) || PathPrefix(`/syncthing`))
- kind: Rule
- priority: 50
- services:
- - name: syncthing-router
- namespace: syncthing
- port: 80
- middlewares:
- - name: authentik-forward-auth
- namespace: syncthing
- - name: asset-router
- namespace: syncthing
- tls:
- secretName: syncthing-tls
\ No newline at end of file
diff --git a/k8s/apps/syncthing/kustomization.yaml b/k8s/apps/syncthing/kustomization.yaml
index d29ea1e..3b2e879 100644
--- a/k8s/apps/syncthing/kustomization.yaml
+++ b/k8s/apps/syncthing/kustomization.yaml
@@ -4,10 +4,8 @@ kind: Kustomization
resources:
- app.yaml
- - ingress-route.yaml
- - middleware.yaml
- - landing-page.yaml
- - asset-router.yaml
+ - nginx-router.yaml
+ - traefik-simple.yaml
helmCharts:
- name: syncthing
@@ -32,4 +30,4 @@ helmCharts:
releaseName: syncthing-nas
namespace: syncthing
valuesFile: syncthing-nas.yaml
- includeCRDs: true
+ includeCRDs: true
\ No newline at end of file
diff --git a/k8s/apps/syncthing/landing-page.yaml b/k8s/apps/syncthing/landing-page.yaml
deleted file mode 100644
index 50fed59..0000000
--- a/k8s/apps/syncthing/landing-page.yaml
+++ /dev/null
@@ -1,103 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
- name: syncthing-landing-html
- namespace: syncthing
-data:
- index.html: |
-
-
-
- Syncthing Instances
-
-
-
-
-
Syncthing Instances
-
-
-
-
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
- name: syncthing-landing
- namespace: syncthing
-spec:
- replicas: 1
- selector:
- matchLabels:
- app: syncthing-landing
- template:
- metadata:
- labels:
- app: syncthing-landing
- spec:
- containers:
- - name: nginx
- image: nginx:alpine
- ports:
- - containerPort: 80
- volumeMounts:
- - name: html
- mountPath: /usr/share/nginx/html
- volumes:
- - name: html
- configMap:
- name: syncthing-landing-html
----
-apiVersion: v1
-kind: Service
-metadata:
- name: syncthing-landing
- namespace: syncthing
-spec:
- selector:
- app: syncthing-landing
- ports:
- - protocol: TCP
- port: 80
- targetPort: 80
\ No newline at end of file
diff --git a/k8s/apps/syncthing/middleware.yaml b/k8s/apps/syncthing/middleware.yaml
deleted file mode 100644
index 28b33bc..0000000
--- a/k8s/apps/syncthing/middleware.yaml
+++ /dev/null
@@ -1,125 +0,0 @@
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
- name: authentik-forward-auth
- namespace: syncthing
-spec:
- forwardAuth:
- address: http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/traefik
- trustForwardHeader: true
- authResponseHeaders:
- - X-authentik-username
- - X-authentik-groups
- - X-authentik-email
- - X-authentik-name
- - X-authentik-uid
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
- name: strip-prefix-nas
- namespace: syncthing
-spec:
- stripPrefix:
- prefixes:
- - /nas
- forceSlash: false
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
- name: strip-prefix-master
- namespace: syncthing
-spec:
- stripPrefix:
- prefixes:
- - /master
- forceSlash: false
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
- name: strip-prefix-iris
- namespace: syncthing
-spec:
- stripPrefix:
- prefixes:
- - /iris
- forceSlash: false
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
- name: syncthing-headers-nas
- namespace: syncthing
-spec:
- headers:
- customRequestHeaders:
- X-Forwarded-Prefix: "/nas"
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
- name: syncthing-headers-master
- namespace: syncthing
-spec:
- headers:
- customRequestHeaders:
- X-Forwarded-Prefix: "/master"
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
- name: syncthing-headers-iris
- namespace: syncthing
-spec:
- headers:
- customRequestHeaders:
- X-Forwarded-Prefix: "/iris"
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
- name: set-cookie-nas
- namespace: syncthing
-spec:
- headers:
- customResponseHeaders:
- Set-Cookie: "syncthing_instance=nas; Path=/; HttpOnly"
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
- name: set-cookie-master
- namespace: syncthing
-spec:
- headers:
- customResponseHeaders:
- Set-Cookie: "syncthing_instance=master; Path=/; HttpOnly"
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
- name: set-cookie-iris
- namespace: syncthing
-spec:
- headers:
- customResponseHeaders:
- Set-Cookie: "syncthing_instance=iris; Path=/; HttpOnly"
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
- name: asset-router
- namespace: syncthing
-spec:
- plugin:
- simplerouter:
- routes:
- - match: Header(`Referer`, `.*\/nas.*`)
- service: syncthing-nas
- - match: Header(`Referer`, `.*\/master.*`)
- service: syncthing-master
- - match: Header(`Referer`, `.*\/iris.*`)
- service: syncthing-khv
\ No newline at end of file
diff --git a/k8s/apps/syncthing/nginx-router.yaml b/k8s/apps/syncthing/nginx-router.yaml
new file mode 100644
index 0000000..4ea0325
--- /dev/null
+++ b/k8s/apps/syncthing/nginx-router.yaml
@@ -0,0 +1,216 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: nginx-config
+ namespace: syncthing
+data:
+ default.conf: |
+ server {
+ listen 80;
+ server_name _;
+
+ # Landing page
+ location = / {
+ root /usr/share/nginx/html;
+ try_files /index.html =404;
+ }
+
+ # NAS instance
+ location /nas {
+ rewrite ^/nas$ /nas/ permanent;
+ }
+
+ location /nas/ {
+ proxy_pass http://syncthing-nas:8384/;
+
+ # Important: tell syncthing that we're using /nas as base path
+ proxy_set_header Host $host;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ proxy_set_header X-Forwarded-Proto $scheme;
+
+ # Handle websockets
+ proxy_http_version 1.1;
+ proxy_set_header Upgrade $http_upgrade;
+ proxy_set_header Connection "upgrade";
+
+ # Sub filter to fix asset paths
+ sub_filter 'href="/' 'href="/nas/';
+ sub_filter 'src="/' 'src="/nas/';
+ sub_filter 'url(/' 'url(/nas/';
+ sub_filter '"/meta' '"/nas/meta';
+ sub_filter '"/rest' '"/nas/rest';
+ sub_filter '"/vendor' '"/nas/vendor';
+ sub_filter '"/theme-assets' '"/nas/theme-assets';
+ sub_filter '"/syncthing' '"/nas/syncthing';
+ sub_filter_once off;
+ sub_filter_types text/html text/css application/javascript;
+ }
+
+ # Master instance
+ location /master {
+ rewrite ^/master$ /master/ permanent;
+ }
+
+ location /master/ {
+ proxy_pass http://syncthing-master:8384/;
+
+ proxy_set_header Host $host;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ proxy_set_header X-Forwarded-Proto $scheme;
+
+ proxy_http_version 1.1;
+ proxy_set_header Upgrade $http_upgrade;
+ proxy_set_header Connection "upgrade";
+
+ sub_filter 'href="/' 'href="/master/';
+ sub_filter 'src="/' 'src="/master/';
+ sub_filter 'url(/' 'url(/master/';
+ sub_filter '"/meta' '"/master/meta';
+ sub_filter '"/rest' '"/master/rest';
+ sub_filter '"/vendor' '"/master/vendor';
+ sub_filter '"/theme-assets' '"/master/theme-assets';
+ sub_filter '"/syncthing' '"/master/syncthing';
+ sub_filter_once off;
+ sub_filter_types text/html text/css application/javascript;
+ }
+
+ # Iris instance
+ location /iris {
+ rewrite ^/iris$ /iris/ permanent;
+ }
+
+ location /iris/ {
+ proxy_pass http://syncthing-khv:8384/;
+
+ proxy_set_header Host $host;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ proxy_set_header X-Forwarded-Proto $scheme;
+
+ proxy_http_version 1.1;
+ proxy_set_header Upgrade $http_upgrade;
+ proxy_set_header Connection "upgrade";
+
+ sub_filter 'href="/' 'href="/iris/';
+ sub_filter 'src="/' 'src="/iris/';
+ sub_filter 'url(/' 'url(/iris/';
+ sub_filter '"/meta' '"/iris/meta';
+ sub_filter '"/rest' '"/iris/rest';
+ sub_filter '"/vendor' '"/iris/vendor';
+ sub_filter '"/theme-assets' '"/iris/theme-assets';
+ sub_filter '"/syncthing' '"/iris/syncthing';
+ sub_filter_once off;
+ sub_filter_types text/html text/css application/javascript;
+ }
+ }
+
+ index.html: |
+
+
+
+ Syncthing Instances
+
+
+
+
+
Syncthing Instances
+
+
+
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: syncthing-router
+ namespace: syncthing
+spec:
+ replicas: 1
+ selector:
+ matchLabels:
+ app: syncthing-router
+ template:
+ metadata:
+ labels:
+ app: syncthing-router
+ spec:
+ containers:
+ - name: nginx
+ image: nginx:alpine
+ ports:
+ - containerPort: 80
+ volumeMounts:
+ - name: config
+ mountPath: /etc/nginx/conf.d
+ - name: html
+ mountPath: /usr/share/nginx/html
+ volumes:
+ - name: config
+ configMap:
+ name: nginx-config
+ items:
+ - key: default.conf
+ path: default.conf
+ - name: html
+ configMap:
+ name: nginx-config
+ items:
+ - key: index.html
+ path: index.html
+---
+apiVersion: v1
+kind: Service
+metadata:
+ name: syncthing-router
+ namespace: syncthing
+spec:
+ selector:
+ app: syncthing-router
+ ports:
+ - protocol: TCP
+ port: 80
+ targetPort: 80
\ No newline at end of file
diff --git a/k8s/apps/syncthing/traefik-simple.yaml b/k8s/apps/syncthing/traefik-simple.yaml
new file mode 100644
index 0000000..4795934
--- /dev/null
+++ b/k8s/apps/syncthing/traefik-simple.yaml
@@ -0,0 +1,36 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+ name: syncthing-ingressroute
+ namespace: syncthing
+spec:
+ entryPoints:
+ - websecure
+ routes:
+ - match: Host(`ss.hexor.cy`)
+ kind: Rule
+ services:
+ - name: syncthing-router
+ port: 80
+ middlewares:
+ - name: authentik-forward-auth
+ namespace: syncthing
+ tls:
+ secretName: syncthing-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+ name: authentik-forward-auth
+ namespace: syncthing
+spec:
+ forwardAuth:
+ address: http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/traefik
+ trustForwardHeader: true
+ authResponseHeaders:
+ - X-authentik-username
+ - X-authentik-groups
+ - X-authentik-email
+ - X-authentik-name
+ - X-authentik-uid
\ No newline at end of file