traefik:
  # Default values for Traefik
  image:
    repository: &traefikImage library/traefik
    name: *traefikImage
    # defaults to appVersion
    tag: v2.7.0
    pullPolicy: IfNotPresent

  cloudflaredmage:
    image: &cloudflaredImage cloudflare/cloudflared:2022.5.3

  #
  # Configure the deployment
  #
  deployment:
    enabled: true
    # Can be either Deployment or DaemonSet
    kind: Deployment
    # Number of pods of the deployment (only applies when kind == Deployment)
    replicas: 1
    # Amount of time (in seconds) before Kubernetes will send the SIGKILL signal if Traefik does not shut down
    terminationGracePeriodSeconds: 60
    # The minimum number of seconds Traefik needs to be up and running before the DaemonSet/Deployment controller considers it available
    minReadySeconds: 0
    # Additional deployment annotations (e.g. for jaeger-operator sidecar injection)
    annotations: {}
    # Additional deployment labels (e.g. for filtering deployment by custom labels)
    labels: {}
    # Additional pod annotations (e.g. for mesh injection or prometheus scraping)
    podAnnotations: {}
    # Additional Pod labels (e.g. for filtering Pod by custom labels)
    podLabels: {}
    # Additional containers (e.g. for metric offloading sidecars)
    additionalContainers:
      # https://docs.datadoghq.com/developers/dogstatsd/unix_socket/?tab=host
      - name: cloudflare
        image: *cloudflaredImage
        args: ["tunnel", "--no-autoupdate", "run", "--token", "$(cloudflared)"]
        resources:
          limits:
            cpu: "800m"
            memory: "100Mi"
          requests:
            cpu: "300m"
            memory: "40Mi"
        envFrom:
          - secretRef:
              name: cloudflared-secrets
      - image: ghcr.io/roxedus/pipelines:traefik-cloudflare-tunnel-cca7aa94
        name: auto-cloudflare
        resources:
          limits:
            cpu: "800m"
            memory: "100Mi"
          requests:
            cpu: "300m"
            memory: "40Mi"
        envFrom:
          - secretRef:
              name: auto-cloudflared-secrets
        env:
          - name: TRAEFIK_SERVICE_ENDPOINT
            value: http://localhost:8000
          - name: TRAEFIK_API_ENDPOINT
            value: http://localhost:9000
          - name: TRAEFIK_ENTRYPOINT
            value: web
      # volumeMounts:
      #   - name: dsdsocket
      #     mountPath: /socket
    # Additional volumes available for use with initContainers and additionalContainers
    additionalVolumes:
      []
      # - name: dsdsocket
      #   hostPath:
      #     path: /var/run/statsd-exporter
    # Additional initContainers (e.g. for setting file permission as shown below)
    initContainers:
      []
      # The "volume-permissions" init container is required if you run into permission issues.
      # Related issue: https://github.com/traefik/traefik/issues/6972
      # - name: volume-permissions
      #   image: busybox:1.31.1
      #   command: ["sh", "-c", "chmod -Rv 600 /data/*"]
      #   volumeMounts:
      #     - name: data
      #       mountPath: /data
    # Use process namespace sharing
    shareProcessNamespace: false
    # Custom pod DNS policy. Apply if `hostNetwork: true`
    # dnsPolicy: ClusterFirstWithHostNet
    # Additional imagePullSecrets
    imagePullSecrets:
      []
      # - name: myRegistryKeySecretName

  # Pod disruption budget
  podDisruptionBudget:
    enabled: false
    # maxUnavailable: 1
    # maxUnavailable: 33%
    # minAvailable: 0
    # minAvailable: 25%

  # Use ingressClass. Ignored if Traefik version < 2.3 / kubernetes < 1.18.x
  ingressClass:
    # true is not unit-testable yet, pending https://github.com/rancher/helm-unittest/pull/12
    enabled: false
    isDefaultClass: false
    # Use to force a networking.k8s.io API Version for certain CI/CD applications. E.g. "v1beta1"
    fallbackApiVersion: ""

  # Activate Pilot integration
  pilot:
    enabled: true

  # Enable experimental features
  experimental:
    http3:
      enabled: true
    plugins:
      enabled: false
    kubernetesGateway:
      enabled: false

  # Create an IngressRoute for the dashboard
  ingressRoute:
    dashboard:
      enabled: false
      # Additional ingressRoute annotations (e.g. for kubernetes.io/ingress.class)
      annotations: {}
      # Additional ingressRoute labels (e.g. for filtering IngressRoute by custom labels)
      labels: {}

  rollingUpdate:
    maxUnavailable: 1
    maxSurge: 1

  # Customize liveness and readiness probe values.
  readinessProbe:
    failureThreshold: 1
    initialDelaySeconds: 10
    periodSeconds: 10
    successThreshold: 1
    timeoutSeconds: 2

  livenessProbe:
    failureThreshold: 3
    initialDelaySeconds: 10
    periodSeconds: 10
    successThreshold: 1
    timeoutSeconds: 2

  #
  # Configure providers
  #
  providers:
    kubernetesCRD:
      enabled: true
      allowCrossNamespace: false
      allowExternalNameServices: false
      # ingressClass: traefik-internal
      # labelSelector: environment=production,method=traefik
      namespaces:
        - "default"

    kubernetesIngress:
      enabled: true
      allowExternalNameServices: false
      allowEmptyServices: false
      # ingressClass: traefik-internal
      # labelSelector: environment=production,method=traefik
      namespaces:
        - "default"
      # IP used for Kubernetes Ingress endpoints
      publishedService:
        enabled: false
        # Published Kubernetes Service to copy status from. Format: namespace/servicename
        # By default this Traefik service
        # pathOverride: ""

  #
  # Add volumes to the traefik pod. The volume name will be passed to tpl.
  # This can be used to mount a cert pair or a configmap that holds a config.toml file.
  # After the volume has been mounted, add the configs into traefik by using the `additionalArguments` list below, eg:
  # additionalArguments:
  # - "--providers.file.filename=/config/dynamic.toml"
  # - "--ping"
  # - "--ping.entrypoint=web"
  volumes:
    []
    # - name: public-cert
    #   mountPath: "/certs"
    #   type: emptyDir
  # - name: '{{ printf "%s-configs" .Release.Name }}'
  #   mountPath: "/config"
  #   type: configMap

  # Additional volumeMounts to add to the Traefik container
  additionalVolumeMounts:
    []
    # For instance when using a logshipper for access logs
    # - name: traefik-logs
    #   mountPath: /var/log/traefik

  # Logs
  # https://docs.traefik.io/observability/logs/
  logs:
    # Traefik logs concern everything that happens to Traefik itself (startup, configuration, events, shutdown, and so on).
    general:
      # By default, the logs use a text format (common), but you can
      # also ask for the json format in the format option
      # format: json
      # By default, the level is set to ERROR. Alternative logging levels are DEBUG, PANIC, FATAL, ERROR, WARN, and INFO.
      level: ERROR
    access:
      # To enable access logs
      enabled: false
      # By default, logs are written using the Common Log Format (CLF).
      # To write logs in JSON, use json in the format option.
      # If the given format is unsupported, the default (CLF) is used instead.
      # format: json
      # To write the logs in an asynchronous fashion, specify a bufferingSize option.
      # This option represents the number of log lines Traefik will keep in memory before writing
      # them to the selected output. In some cases, this option can greatly help performances.
      # bufferingSize: 100
      # Filtering https://docs.traefik.io/observability/access-logs/#filtering
      filters:
        {}
        # statuscodes: "200,300-302"
        # retryattempts: true
        # minduration: 10ms
      # Fields
      # https://docs.traefik.io/observability/access-logs/#limiting-the-fieldsincluding-headers
      fields:
        general:
          defaultmode: keep
          names:
            {}
            # Examples:
            # ClientUsername: drop
        headers:
          defaultmode: drop
          names:
            {}
            # Examples:
            # User-Agent: redact
            # Authorization: drop
            # Content-Type: keep

  metrics:
    # datadog:
    #   address: 127.0.0.1:8125
    # influxdb:
    #   address: localhost:8089
    #   protocol: udp
    prometheus:
      entryPoint: metrics
    #  addRoutersLabels: true
    # statsd:
    #   address: localhost:8125

  tracing:
    {}
    # instana:
    #   enabled: true
    # datadog:
    #   localAgentHostPort: 127.0.0.1:8126
    #   debug: false
    #   globalTag: ""
    #   prioritySampling: false

  globalArguments:
    - "--global.checknewversion"

  #
  # Configure Traefik static configuration
  # Additional arguments to be passed at Traefik's binary
  # All available options available on https://docs.traefik.io/reference/static-configuration/cli/
  ## Use curly braces to pass values: `helm install --set="additionalArguments={--providers.kubernetesingress.ingressclass=traefik-internal,--log.level=DEBUG}"`
  additionalArguments:
    - "--entryPoints.web.forwardedHeaders.trustedIPs=127.0.0.1/32"
    - "--api.insecure=true"

  # certResolvers:
  #   cf:
  #     dnsChallenge:
  #       provider: cloudflare
  #       # add futher options for the dns challenge as needed
  #       # cf. https://doc.traefik.io/traefik/https/acme/#dnschallenge
  #       delayBeforeCheck: 30
  #       resolvers:
  #         - 1.1.1.1
  #         - 1.0.0.1
  #     # match the path to persistence
  #     storage: /data/acme.json
  #  - "--providers.kubernetesingress.ingressclass=traefik-internal"
  #  - "--log.level=DEBUG"

  # Environment variables to be passed to Traefik's binary
  env: []
  # - name: SOME_VAR
  #   value: some-var-value
  # - name: SOME_VAR_FROM_CONFIG_MAP
  #   valueFrom:
  #     configMapRef:
  #       name: configmap-name
  #       key: config-key
  # - name: SOME_SECRET
  #   valueFrom:
  #     secretKeyRef:
  #       name: secret-name
  #       key: secret-key

  envFrom:
    # - configMapRef:
    #     name: config-map-name
    - secretRef:
        name: traefik-secrets

  # Configure ports
  ports:
    # The name of this one can't be changed as it is used for the readiness and
    # liveness probes, but you can adjust its config to your liking
    traefik:
      port: 9000
      expose: false
      # The exposed port for this service
      exposedPort: 9000
      # The port protocol (TCP/UDP)
      protocol: TCP
    web:
      port: 8000
      # hostPort: 8000
      expose: false
      exposedPort: 80
      # The port protocol (TCP/UDP)
      protocol: TCP
      # Use nodeport if set. This is useful if you have configured Traefik in a
      # LoadBalancer
      # nodePort: 32080
      # Port Redirections
      # Added in 2.2, you can make permanent redirects via entrypoints.
      # https://docs.traefik.io/routing/entrypoints/#redirection
      # redirectTo: websecure
    websecure:
      port: 8443
      # hostPort: 8443
      expose: false
      exposedPort: 443
      # The port protocol (TCP/UDP)
      protocol: TCP
      # nodePort: 32443
      # Enable HTTP/3.
      # Requires enabling experimental http3 feature and tls.
      # Note that you cannot have a UDP entrypoint with the same port.
      http3: true
      # Set TLS at the entrypoint
      # https://doc.traefik.io/traefik/routing/entrypoints/#tls
      tls:
        enabled: true
      #   # this is the name of a TLSOption definition
      #   options: ""
      #   certResolver: cf
      #   domains:
      #     - main: roxedus.com
      #       sans:
      #         - "*.roxedus.com"
      #     - bar.example.com
    metrics:
      port: 9100
      # hostPort: 9100
      # Defines whether the port is exposed if service.type is LoadBalancer or
      # NodePort.
      #
      # You may not want to expose the metrics port on production deployments.
      # If you want to access it from outside of your cluster,
      # use `kubectl port-forward` or create a secure ingress
      expose: false
      # The exposed port for this service
      exposedPort: 9100
      # The port protocol (TCP/UDP)
      protocol: TCP

  # TLS Options are created as TLSOption CRDs
  # https://doc.traefik.io/traefik/https/tls/#tls-options
  # Example:
  tlsOptions:
    default:
      sniStrict: true
      minVersion: VersionTLS12
  #     preferServerCipherSuites: true
  #   foobar:
  #     curvePreferences:
  #       - CurveP521
  #       - CurveP384

  # Options for the main traefik service, where the entrypoints traffic comes
  # from.
  service:
    enabled: false
    type: NodePort
    # Additional annotations applied to both TCP and UDP services (e.g. for cloud provider specific config)
    annotations: {}
    # Additional annotations for TCP service only
    annotationsTCP: {}
    # Additional annotations for UDP service only
    annotationsUDP: {}
    # Additional service labels (e.g. for filtering Service by custom labels)
    labels: {}
    # Additional entries here will be added to the service spec.
    # Cannot contain type, selector or ports entries.
    spec:
      {}
      # externalTrafficPolicy: Cluster
      # loadBalancerIP: "1.2.3.4"
      # clusterIP: "2.3.4.5"
    loadBalancerSourceRanges:
      []
      # - 192.168.0.1/32
      # - 172.16.0.0/16
    externalIPs:
      []
      # - 1.2.3.4
    # One of SingleStack, PreferDualStack, or RequireDualStack.
    # ipFamilyPolicy: SingleStack
    # List of IP families (e.g. IPv4 and/or IPv6).
    # ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
    # ipFamilies:
    #   - IPv4
    #   - IPv6

  ## Create HorizontalPodAutoscaler object.
  ##
  autoscaling:
    enabled: false
  #   minReplicas: 1
  #   maxReplicas: 10
  #   metrics:
  #   - type: Resource
  #     resource:
  #       name: cpu
  #       targetAverageUtilization: 60
  #   - type: Resource
  #     resource:
  #       name: memory
  #       targetAverageUtilization: 60

  # Enable persistence using Persistent Volume Claims
  # ref: http://kubernetes.io/docs/user-guide/persistent-volumes/
  # After the pvc has been mounted, add the configs into traefik by using the `additionalArguments` list below, eg:
  # additionalArguments:
  # - "--certificatesresolvers.le.acme.storage=/data/acme.json"
  # It will persist TLS certificates.
  persistence:
    enabled: false
    name: data
    #  existingClaim: ""
    accessMode: ReadWriteOnce
    size: 128Mi
    # storageClass: ""
    path: /data
    annotations: {}
    # subPath: "" # only mount a subpath of the Volume into the pod

  # If hostNetwork is true, runs traefik in the host network namespace
  # To prevent unschedulabel pods due to port collisions, if hostNetwork=true
  # and replicas>1, a pod anti-affinity is recommended and will be set if the
  # affinity is left as default.
  hostNetwork: false

  # Whether Role Based Access Control objects like roles and rolebindings should be created
  rbac:
    enabled: true

    # If set to false, installs ClusterRole and ClusterRoleBinding so Traefik can be used across namespaces.
    # If set to true, installs namespace-specific Role and RoleBinding and requires provider configuration be set to that same namespace
    namespaced: false

  # Enable to create a PodSecurityPolicy and assign it to the Service Account via RoleBinding or ClusterRoleBinding
  podSecurityPolicy:
    enabled: false

  # The service account the pods will use to interact with the Kubernetes API
  serviceAccount:
    # If set, an existing service account is used
    # If not set, a service account is created automatically using the fullname template
    name: ""

  # Additional serviceAccount annotations (e.g. for oidc authentication)
  serviceAccountAnnotations: {}

  resources:
    {}
    # requests:
    #   cpu: "100m"
    #   memory: "50Mi"
    # limits:
    #   cpu: "300m"
    #   memory: "150Mi"
  affinity: {}
  # # This example pod anti-affinity forces the scheduler to put traefik pods
  # # on nodes where no other traefik pods are scheduled.
  # # It should be used when hostNetwork: true to prevent port conflicts
  #   podAntiAffinity:
  #     requiredDuringSchedulingIgnoredDuringExecution:
  #       - labelSelector:
  #           matchExpressions:
  #             - key: app.kubernetes.io/name
  #               operator: In
  #               values:
  #                 - {{ template "traefik.name" . }}
  #         topologyKey: kubernetes.io/hostname
  nodeSelector:
    kubernetes.io/arch: amd64
  tolerations: []

  # Pods can have priority.
  # Priority indicates the importance of a Pod relative to other Pods.
  priorityClassName: ""

  # Set the container security context
  # To run the container with ports below 1024 this will need to be adjust to run as root
  securityContext:
    capabilities:
      drop: [ALL]
    readOnlyRootFilesystem: true
    runAsGroup: 65532
    runAsNonRoot: true
    runAsUser: 65532

  podSecurityContext:
    fsGroup: 65532