disable allowIp middleware while fixing ip filtering - upgrade traefik and fix gitea admin urls by adding prefix

ansible/arcodange/factory/playbooks/01_system.yml

@@ -72,10 +72,11 @@
 
 - name: k3s
   tags: never
-  ansible.builtin.import_playbook: k3s.orchestration.site
+  # ansible.builtin.import_playbook: k3s.orchestration.site
+  ansible.builtin.import_playbook: k3s.orchestration.upgrade
   # ansible.builtin.import_playbook: k3s.orchestration.reset
   vars:
-    k3s_version: v1.31.3+k3s1
+    k3s_version: v1.32.2+k3s1
     extra_server_args: "--docker --disable traefik"
     extra_agent_args: "--docker"
     api_endpoint: "{{ hostvars[groups['server'][0]]['ansible_host'] | default(groups['server'][0]) }}"
@@ -122,7 +123,7 @@
               spec:
                 repo: https://traefik.github.io/charts
                 chart: traefik
-                version: v30.1.0
+                version: v37.0.0
                 targetNamespace: kube-system
                 valuesContent: |-
                   {{ traefik_helm_values | to_nice_yaml | indent( width=4 ) }}
@@ -162,15 +163,20 @@
                       - websecure
                 middlewares:
                   localIp:
-                    IPAllowList:
+                    ipAllowList:
                       sourceRange:
-                        - "192.168.1.0/24"
-                        - "{{ ipify_public_ip }}/32"
+                      - "0.0.0.0/0"
+                    #     - "192.168.1.0/24"
+                    #     - "{{ ipify_public_ip }}/32"
+                      # ipStrategy:
+                      #   depth: 2
             traefik_helm_values:
+              deployment:
+                kind: "Deployment"
               # default is https://github.com/traefik/traefik-helm-chart/blob/v25.0.0/traefik/values.yaml <- for v25 (`kubectl describe deployments.apps traefik -n kube-system | grep helm.sh/chart`)
               # current is https://github.com/traefik/traefik-helm-chart/blob/v30.1.0/traefik/values.yaml
               nodeSelector:
-                node-role.kubernetes.io/master: true # make predictible choice of node to direct https traffic to this node and avoid NAT/loss of client IP
+                node-role.kubernetes.io/master: 'true' # make predictible choice of node to direct https traffic to this node and avoid NAT/loss of client IP
               service:
                 spec:
                   externalTrafficPolicy: Local
@@ -182,6 +188,17 @@
                 dashboard:
                   enabled: true
               globalArguments: [] # deactivate --global.sendanonymoususage
+              env:
+                - name: POD_NAME
+                  valueFrom:
+                    fieldRef:
+                      fieldPath: metadata.name
+                - name: POD_NAMESPACE
+                  valueFrom:
+                    fieldRef:
+                      fieldPath: metadata.namespace
+                - name: LEGO_DISABLE_CNAME_SUPPORT
+                  value: 'true'
               logs:
                 general:
                   level: DEBUG
@@ -209,18 +226,19 @@
               additionalArguments:
                 - '--providers.file.filename=/config/dynamic.yaml'
                 - '--providers.kubernetesingress.ingressendpoint.publishedservice=kube-system/traefik'
-              certResolvers:
+              certificatesResolvers:
                 letsencrypt:
-                  # for challenge options cf. https://doc.traefik.io/traefik/https/acme/
-                  email: arcodange@gmail.com
-                  tlsChallenge: true
-                  dnsChallenge:
-                    # requires env variable DUCKDNS_TOKEN
-                    provider: duckdns
-                  httpChallenge:
-                    entryPoint: "web"
-                  # It has to match the path with a persistent volume
-                  storage: /data/acme.json
+                  acme:
+                    # for challenge options cf. https://doc.traefik.io/traefik/https/acme/
+                    email: arcodange@gmail.com
+                    tlsChallenge: true
+                    dnsChallenge:
+                      # requires env variable DUCKDNS_TOKEN
+                      provider: duckdns
+                    httpChallenge:
+                      entryPoint: "web"
+                    # It has to match the path with a persistent volume
+                    storage: /data/acme.json
               envFrom:
                 - secretRef:
                     name: traefik-duckdns-token