---
# k3s built-in Traefik HelmChartConfig overrides.
#
# k3s ships with a Traefik HelmChart; this HelmChartConfig layers extra
# values on top without forking the chart. The helm-controller reconciles it
# and rolls Traefik whenever this changes.
#
# Not managed by ArgoCD (ArgoCD doesn't manage kube-system in this cluster);
# `kubectl apply -f infrastructure/networking/traefik-helmchartconfig.yaml`
# is the reproducibility path if the cluster is rebuilt.
#
# Change history:
# - DEV-455: badger plugin experimental + additionalArguments.
# - DEV-457: enable providers.kubernetesCRD.allowCrossNamespace so Pangolin's
#   TraefikService (ns=pangolin) can reference the paperclip Service (ns=paperclip).
#   Add certResolver `letsencrypt` (HTTP-01) with persistent acme.json backing so
#   Pangolin-generated IngressRoutes with `tls.certResolver=letsencrypt` load.
#   podSecurityContext.fsGroup=65532 makes /data writable by Traefik's non-root UID.
apiVersion: helm.cattle.io/v1
kind: HelmChartConfig
metadata:
  name: traefik
  namespace: kube-system
spec:
  valuesContent: |-
    experimental:
      plugins:
        badger:
          moduleName: "github.com/fosrl/badger"
          version: "v1.5.0"
    persistence:
      enabled: true
      size: 128Mi
      path: /data
    podSecurityContext:
      fsGroup: 65532
      fsGroupChangePolicy: OnRootMismatch
    additionalArguments:
      - "--experimental.plugins.badger.moduleName=github.com/fosrl/badger"
      - "--experimental.plugins.badger.version=v1.5.0"
      - "--providers.kubernetescrd.allowCrossNamespace=true"
      - "--certificatesresolvers.letsencrypt.acme.email=admin@basicstack.de"
      - "--certificatesresolvers.letsencrypt.acme.storage=/data/acme.json"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"