From f0f455c7dd58e8f27df48b76025e3468d4a8095a Mon Sep 17 00:00:00 2001
From: Ultradesu <ultradesu@hexor.cy>
Date: Thu, 30 Jul 2026 16:19:37 +0100
Subject: [PATCH] Added firefly-iii open banking importer

---
 .../firefly-iii/data-importer-ingress.yaml    | 53 +++++++++++++++++++
 k8s/apps/firefly-iii/data-importer.yaml       | 23 --------
 k8s/apps/firefly-iii/kustomization.yaml       |  1 +
 k8s/apps/firefly-iii/network-policy.yaml      | 13 ++++-
 4 files changed, 66 insertions(+), 24 deletions(-)
 create mode 100644 k8s/apps/firefly-iii/data-importer-ingress.yaml

diff --git a/k8s/apps/firefly-iii/data-importer-ingress.yaml b/k8s/apps/firefly-iii/data-importer-ingress.yaml
new file mode 100644
index 0000000..ef1c287
--- /dev/null
+++ b/k8s/apps/firefly-iii/data-importer-ingress.yaml
@@ -0,0 +1,53 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: firefly-data-importer-auth
+spec:
+  forwardAuth:
+    address: http://auth-proxy.auth-proxy.svc:80/auth
+    trustForwardHeader: true
+    authResponseHeaders:
+      - X-Auth-Request-User
+      - X-Auth-Request-Email
+      - X-Auth-Request-Groups
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: firefly-data-importer
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    # OAuth callback is intentionally public. Data Importer validates both the
+    # state parameter and its browser session before exchanging the code.
+    - match: Host(`import.hexor.cy`) && Path(`/eb-callback`)
+      kind: Rule
+      priority: 200
+      services:
+        - name: firefly-data-importer
+          port: 80
+    # Everything else requires a valid auth-proxy session and group.
+    - match: Host(`import.hexor.cy`)
+      kind: Rule
+      priority: 100
+      middlewares:
+        - name: firefly-data-importer-auth
+      services:
+        - name: firefly-data-importer
+          port: 80
+  tls:
+    secretName: firefly-data-importer-tls
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: firefly-data-importer-tls
+spec:
+  secretName: firefly-data-importer-tls
+  issuerRef:
+    name: letsencrypt
+    kind: ClusterIssuer
+  dnsNames:
+    - import.hexor.cy
+
diff --git a/k8s/apps/firefly-iii/data-importer.yaml b/k8s/apps/firefly-iii/data-importer.yaml
index c820461..8e429a8 100644
--- a/k8s/apps/firefly-iii/data-importer.yaml
+++ b/k8s/apps/firefly-iii/data-importer.yaml
@@ -103,26 +103,3 @@ spec:
       port: 80
       targetPort: http
       protocol: TCP
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: firefly-data-importer
-  labels:
-    app.kubernetes.io/name: firefly-data-importer
-    firefly.hexor.cy/private-ai: "true"
-  annotations:
-    kubernetes.io/ingress.class: traefik-ai
-spec:
-  rules:
-    - host: import.ff.lan
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: firefly-data-importer
-                port:
-                  number: 80
-
diff --git a/k8s/apps/firefly-iii/kustomization.yaml b/k8s/apps/firefly-iii/kustomization.yaml
index d90eb53..9614d5d 100644
--- a/k8s/apps/firefly-iii/kustomization.yaml
+++ b/k8s/apps/firefly-iii/kustomization.yaml
@@ -4,6 +4,7 @@ kind: Kustomization
 resources:
   - app.yaml
   - data-importer.yaml
+  - data-importer-ingress.yaml
   - external-secrets.yaml
   - postgres.yaml
   - storage.yaml
diff --git a/k8s/apps/firefly-iii/network-policy.yaml b/k8s/apps/firefly-iii/network-policy.yaml
index d98b11e..a48ab87 100644
--- a/k8s/apps/firefly-iii/network-policy.yaml
+++ b/k8s/apps/firefly-iii/network-policy.yaml
@@ -76,7 +76,18 @@ spec:
   policyTypes:
     - Ingress
   ingress:
-    # traefik-ai uses hostNetwork and is therefore seen as node traffic.
+    # Shared Traefik serves the public HTTPS importer.
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
+      ports:
+        - protocol: TCP
+          port: 8080
+    # Keep node traffic allowed for probes and local diagnostics.
     - from:
         - ipBlock:
             cidr: 192.168.1.117/32