From 015cbf56def091fc313f852a6ad5714a71051943 Mon Sep 17 00:00:00 2001
From: CTO Agent <andreas.leinen@team-ag.de>
Date: Sat, 8 Aug 2026 14:52:29 +0000
Subject: [PATCH] Traefik: check in HelmChartConfig with DEV-457 changes for
 reproducibility

Adds infrastructure/networking/traefik-helmchartconfig.yaml so the k3s
Traefik overrides (badger plugin, allowCrossNamespace, letsencrypt
resolver + persistent acme.json, non-root fsGroup) are tracked in git.

kube-system is not managed by ArgoCD in this cluster; kubectl apply of
this file is the manual reproducibility path.

Refs: DEV-455, DEV-457

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 .../networking/traefik-helmchartconfig.yaml   | 45 +++++++++++++++++++
 1 file changed, 45 insertions(+)
 create mode 100644 infrastructure/networking/traefik-helmchartconfig.yaml

diff --git a/infrastructure/networking/traefik-helmchartconfig.yaml b/infrastructure/networking/traefik-helmchartconfig.yaml
new file mode 100644
index 0000000..501aea5
--- /dev/null
+++ b/infrastructure/networking/traefik-helmchartconfig.yaml
@@ -0,0 +1,45 @@
+---
+# k3s built-in Traefik HelmChartConfig overrides.
+#
+# k3s ships with a Traefik HelmChart; this HelmChartConfig layers extra
+# values on top without forking the chart. The helm-controller reconciles it
+# and rolls Traefik whenever this changes.
+#
+# Not managed by ArgoCD (ArgoCD doesn't manage kube-system in this cluster);
+# `kubectl apply -f infrastructure/networking/traefik-helmchartconfig.yaml`
+# is the reproducibility path if the cluster is rebuilt.
+#
+# Change history:
+# - DEV-455: badger plugin experimental + additionalArguments.
+# - DEV-457: enable providers.kubernetesCRD.allowCrossNamespace so Pangolin's
+#   TraefikService (ns=pangolin) can reference the paperclip Service (ns=paperclip).
+#   Add certResolver `letsencrypt` (HTTP-01) with persistent acme.json backing so
+#   Pangolin-generated IngressRoutes with `tls.certResolver=letsencrypt` load.
+#   podSecurityContext.fsGroup=65532 makes /data writable by Traefik's non-root UID.
+apiVersion: helm.cattle.io/v1
+kind: HelmChartConfig
+metadata:
+  name: traefik
+  namespace: kube-system
+spec:
+  valuesContent: |-
+    experimental:
+      plugins:
+        badger:
+          moduleName: "github.com/fosrl/badger"
+          version: "v1.5.0"
+    persistence:
+      enabled: true
+      size: 128Mi
+      path: /data
+    podSecurityContext:
+      fsGroup: 65532
+      fsGroupChangePolicy: OnRootMismatch
+    additionalArguments:
+      - "--experimental.plugins.badger.moduleName=github.com/fosrl/badger"
+      - "--experimental.plugins.badger.version=v1.5.0"
+      - "--providers.kubernetescrd.allowCrossNamespace=true"
+      - "--certificatesresolvers.letsencrypt.acme.email=admin@basicstack.de"
+      - "--certificatesresolvers.letsencrypt.acme.storage=/data/acme.json"
+      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
+      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"