change to single traefik and endpoint distinction

infrastructure/03-traefik/base/deployment-traefik.yaml

@@ -5,7 +5,7 @@ metadata:
   namespace: traefik
 spec:
   minReadySeconds: 0
-  replicas: 1
+  replicas: 3
   selector:
     matchLabels:
       app: traefik
@@ -22,26 +22,37 @@ spec:
     spec: 
       containers:
       - resources: {}
+        name: traefik         
         args:
         - --global.sendanonymoususage=false
         - --global.checknewversion=false
         - --entrypoints.metrics.address=:9100/tcp
         - --entrypoints.traefik.address=:9000/tcp
-        - --entrypoints.web.address=:8000/tcp
-        - --entrypoints.web.transport.respondingTimeouts.readTimeout=300
-        - --entrypoints.web.transport.respondingTimeouts.idleTimeout=0
-        - --entrypoints.websecure.address=:8443/tcp
-        - --entrypoints.websecure.http.middlewares=traefik-default-headers
-        - --entrypoints.websecure.http.tls=true
-        - --entrypoints.websecure.transport.respondingTimeouts.readTimeout=300
-        - --entrypoints.websecure.transport.respondingTimeouts.idleTimeout=0
+        - --entrypoints.dns.address=:53/udp
+
+        - --entrypoints.web-local.address=:8000/tcp
+        - --entrypoints.web-local.transport.respondingTimeouts.readTimeout=300
+        - --entrypoints.web-local.transport.respondingTimeouts.idleTimeout=0
+        - --entrypoints.web-local.http.redirections.entryPoint.to=websecure-local
+        - --entrypoints.web-local.http.redirections.entryPoint.scheme=https
+
+        - --entrypoints.websecure-local.address=:8443/tcp
+        - --entrypoints.websecure-local.http.middlewares=traefik-default-headers
+        - --entrypoints.websecure-local.http.tls=true
+        - --entrypoints.websecure-local.transport.respondingTimeouts.readTimeout=300
+        - --entrypoints.websecure-local.transport.respondingTimeouts.idleTimeout=0
+
+        - --certificatesResolvers.default.acme.caServer=https://acme-staging-v02.api.letsencrypt.org/directory
+        - --certificatesResolvers.default.acme.email=steffen.illium@gmail.com
+        - --certificatesResolvers.default.acme.dnsChallenge.provider=ionos
+        - --certificatesResolvers.default.acme.storage=/certs/acme.json
 
         - --api.dashboard=true
         - --ping=true
         - --metrics.prometheus=true
         - --metrics.prometheus.entrypoint=metrics
         - --providers.kubernetescrd
-        - --providers.kubernetescrd.labelSelector=local=true
+        # - --providers.kubernetescrd.labelSelector=local=true
         - --providers.kubernetescrd.allowExternalNameServices=true
         
         - --log.level=WARN
@@ -59,6 +70,11 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
+        - name: IONOS_API_KEY
+          valueFrom:
+            secretKeyRef:
+              name: ionos-secret
+              key: IONOS_API_KEY
         image: docker.io/traefik:latest
         imagePullPolicy: IfNotPresent
         livenessProbe:
@@ -71,7 +87,6 @@ spec:
           periodSeconds: 10
           successThreshold: 1
           timeoutSeconds: 2
-        name: traefik
         ports:
         - containerPort: 53
           name: dns
@@ -82,11 +97,17 @@ spec:
         - containerPort: 9000
           name: traefik
           protocol: TCP
+        - containerPort: 80
+          name: web-local
+          protocol: TCP
+        - containerPort: 443
+          name: websecure-local
+          protocol: TCP
         - containerPort: 8000
-          name: web
+          name: web-front
           protocol: TCP
         - containerPort: 8443
-          name: websecure
+          name: websecure-front
           protocol: TCP
         readinessProbe:
           failureThreshold: 1
@@ -105,10 +126,15 @@ spec:
             - NET_BIND_SERVICE
           readOnlyRootFilesystem: true
         volumeMounts:
-        - mountPath: /data
-          name: data
-        - mountPath: /tmp
-          name: tmp
+          - mountPath: /certs
+            name: traefik-pvc
+            subPath: certs
+          - mountPath: /data
+            name: traefik-pvc
+            subPath: data
+          - mountPath: /tmp
+            name: traefik-pvc
+            subPath: tmp
       securityContext:
         fsGroupChangePolicy: OnRootMismatch
         runAsGroup: 65532
@@ -117,8 +143,7 @@ spec:
       serviceAccountName: traefik
       terminationGracePeriodSeconds: 60
       volumes:
-      - emptyDir: {}
-        name: data
-      - emptyDir: {}
-        name: tmp
+        - name: traefik-pvc
+          persistentVolumeClaim:
+            claimName: traefik-pvc