Use tailscale for auth proxy

Signed-off-by: Marcus Noble <github@marcusnoble.co.uk>

manifests/_apps/argocd.yaml

@@ -1,24 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: argocd
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: cluster.fun
-  destination:
-    namespace: inlets
-    name: cluster-fun (scaleway)
-  source:
-    path: manifests/argocd
-    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
-    targetRevision: HEAD
-  syncPolicy:
-    automated: {}
-    syncOptions:
-      - CreateNamespace=true
-  ignoreDifferences:
-  - kind: Secret
-    jsonPointers:
-    - /data

manifests/_apps/auth-proxy.yaml

@@ -8,7 +8,7 @@ metadata:
 spec:
   project: cluster.fun
   destination:
-    namespace: inlets
+    namespace: auth-proxy
     name: cluster-fun (scaleway)
   source:
     path: manifests/auth-proxy

manifests/_apps/code-server.yaml

@@ -1,24 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: code-server
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: cluster.fun
-  destination:
-    namespace: inlets
-    name: cluster-fun (scaleway)
-  source:
-    path: manifests/code-server
-    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
-    targetRevision: HEAD
-  syncPolicy:
-    automated: {}
-    syncOptions:
-      - CreateNamespace=true
-  ignoreDifferences:
-  - kind: Secret
-    jsonPointers:
-    - /data

manifests/_apps/downloads.yaml

@@ -1,24 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: downloads
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: cluster.fun
-  destination:
-    namespace: inlets
-    name: cluster-fun (scaleway)
-  source:
-    path: manifests/downloads
-    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
-    targetRevision: HEAD
-  syncPolicy:
-    automated: {}
-    syncOptions:
-      - CreateNamespace=true
-  ignoreDifferences:
-  - kind: Secret
-    jsonPointers:
-    - /data

manifests/_apps/inlets.yaml

@@ -1,24 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: inlets
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: cluster.fun
-  destination:
-    namespace: inlets
-    name: cluster-fun (scaleway)
-  source:
-    path: manifests/inlets
-    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
-    targetRevision: HEAD
-  syncPolicy:
-    automated: {}
-    syncOptions:
-      - CreateNamespace=true
-  ignoreDifferences:
-  - kind: Secret
-    jsonPointers:
-    - /data

manifests/_apps/jackett.yaml

@@ -1,24 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: jackett
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: cluster.fun
-  destination:
-    namespace: inlets
-    name: cluster-fun (scaleway)
-  source:
-    path: manifests/jackett
-    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
-    targetRevision: HEAD
-  syncPolicy:
-    automated: {}
-    syncOptions:
-      - CreateNamespace=true
-  ignoreDifferences:
-  - kind: Secret
-    jsonPointers:
-    - /data

manifests/_apps/printer.yaml

@@ -1,24 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: printer
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: cluster.fun
-  destination:
-    namespace: inlets
-    name: cluster-fun (scaleway)
-  source:
-    path: manifests/printer
-    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
-    targetRevision: HEAD
-  syncPolicy:
-    automated: {}
-    syncOptions:
-      - CreateNamespace=true
-  ignoreDifferences:
-  - kind: Secret
-    jsonPointers:
-    - /data

manifests/_apps/radarr.yaml

@@ -1,24 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: radarr
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: cluster.fun
-  destination:
-    namespace: inlets
-    name: cluster-fun (scaleway)
-  source:
-    path: manifests/radarr
-    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
-    targetRevision: HEAD
-  syncPolicy:
-    automated: {}
-    syncOptions:
-      - CreateNamespace=true
-  ignoreDifferences:
-  - kind: Secret
-    jsonPointers:
-    - /data

manifests/_apps/sonarr.yaml

@@ -1,24 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: sonarr
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: cluster.fun
-  destination:
-    namespace: inlets
-    name: cluster-fun (scaleway)
-  source:
-    path: manifests/sonarr
-    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
-    targetRevision: HEAD
-  syncPolicy:
-    automated: {}
-    syncOptions:
-      - CreateNamespace=true
-  ignoreDifferences:
-  - kind: Secret
-    jsonPointers:
-    - /data

manifests/_apps/transmission.yaml

@@ -1,24 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: transmission
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: cluster.fun
-  destination:
-    namespace: inlets
-    name: cluster-fun (scaleway)
-  source:
-    path: manifests/transmission
-    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
-    targetRevision: HEAD
-  syncPolicy:
-    automated: {}
-    syncOptions:
-      - CreateNamespace=true
-  ignoreDifferences:
-  - kind: Secret
-    jsonPointers:
-    - /data

manifests/argocd/argocd.yaml

@@ -1,27 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: argo
-  namespace: inlets
-  labels:
-    app: argo
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-spec:
-  ingressClassName: nginx
-  tls:
-  - hosts:
-    - argo.cluster.fun
-    secretName: argo-ingress
-  rules:
-  - host: argo.cluster.fun
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: auth-proxy
-            port:
-              number: 80

manifests/auth-proxy/auth-proxy.yaml

@@ -1,18 +1,33 @@
 apiVersion: v1
+kind: Namespace
+metadata:
+  name: auth-proxy
+---
+apiVersion: v1
 kind: Secret
 metadata:
   name: auth-proxy
-  namespace: inlets
+  namespace: auth-proxy
   annotations:
     kube-1password: mr6spkkx7n3memkbute6ojaarm
     kube-1password/vault: Kubernetes
 type: Opaque
 ---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: tailscale-auth
+  namespace: auth-proxy
+  annotations:
+    kube-1password: 2cqycmsgv5r7vcyvjpblcl2l4y
+    kube-1password/vault: Kubernetes
+type: Opaque
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: auth-proxy
-  namespace: inlets
+  namespace: auth-proxy
   labels:
     app: auth-proxy
 spec:
@@ -25,13 +40,19 @@ spec:
       labels:
         app: auth-proxy
     spec:
+      dnsPolicy: None
+      dnsConfig:
+        nameservers:
+          - 100.100.100.100
       containers:
-      - args:
+      - name: oauth-proxy
+        image: quay.io/oauth2-proxy/oauth2-proxy:v7.2.0
+        args:
         - --cookie-secure=false
         - --provider=oidc
         - --provider-display-name=Auth0
-        - --upstream=http://inlets.inlets.svc.cluster.local
+        - --upstream=http://talos.averagemarcus.github.beta.tailscale.net
-        - --http-address=$(HOST_IP):8080
+        - --http-address=0.0.0.0:8080
         - --email-domain=*
         - --pass-basic-auth=false
         - --pass-access-token=false
@@ -54,8 +75,6 @@ spec:
             secretKeyRef:
               key: password
               name: auth-proxy
-        image: quay.io/oauth2-proxy/oauth2-proxy:v6.1.1
-        name: oauth-proxy
         ports:
         - containerPort: 8080
           protocol: TCP
@@ -64,12 +83,43 @@ spec:
             memory: 50Mi
           requests:
             memory: 50Mi
+      - name: tailscale
+        image: ghcr.io/tailscale/tailscale:latest
+        imagePullPolicy: IfNotPresent
+        env:
+        - name: AUTH_KEY
+          valueFrom:
+            secretKeyRef:
+              name: tailscale-auth
+              key: password
+        securityContext:
+          capabilities:
+            add:
+            - NET_ADMIN
+        command:
+        - sh
+        - -c
+        - |
+          export PATH=$PATH:/tailscale/bin
+          if [[ ! -d /dev/net ]]; then mkdir -p /dev/net; fi
+          if [[ ! -c /dev/net/tun ]]; then mknod /dev/net/tun c 10 200; fi
+          echo "Starting tailscaled"
+          tailscaled --socket=/tmp/tailscaled.sock &
+          PID=$!
+          echo "Running tailscale up"
+          tailscale --socket=/tmp/tailscaled.sock up \
+            --accept-dns=true \
+            --authkey=${AUTH_KEY} \
+            --hostname=auth-proxy
+          echo "Re-enabling incoming traffic from the cluster"
+          iptables -D ts-input -s 100.64.0.0/10 ! -i tailscale0 -j DROP
+          wait ${PID}
 ---
 apiVersion: v1
 kind: Service
 metadata:
   name: auth-proxy
-  namespace: inlets
+  namespace: auth-proxy
   labels:
     app: auth-proxy
 spec:

manifests/auth-proxy/ingress.yaml

@@ -0,0 +1,135 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: auth-proxy
+  namespace: auth-proxy
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - downloads.cluster.fun
+    - argo.cluster.fun
+    - code.cluster.fun
+    - home.cluster.fun
+    - adguard.cluster.fun
+    - podify.cluster.fun
+    - jackett.cluster.fun
+    - printer.cluster.fun
+    - radarr.cluster.fun
+    - sonarr.cluster.fun
+    - transmission.cluster.fun
+    secretName: auth-proxy-ingress
+  rules:
+  - host: downloads.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: auth-proxy
+            port:
+              name: http
+  - host: argo.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: auth-proxy
+            port:
+              name: http
+  - host: code.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: auth-proxy
+            port:
+              name: http
+  - host: home.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: auth-proxy
+            port:
+              name: http
+  - host: adguard.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: auth-proxy
+            port:
+              name: http
+  - host: podify.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: auth-proxy
+            port:
+              name: http
+  - host: jackett.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: auth-proxy
+            port:
+              name: http
+  - host: printer.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: auth-proxy
+            port:
+              name: http
+  - host: radarr.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: auth-proxy
+            port:
+              name: http
+  - host: sonarr.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: auth-proxy
+            port:
+              name: http
+  - host: transmission.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: auth-proxy
+            port:
+              name: http

manifests/code-server/code-server.yaml

@@ -1,25 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: code
-  namespace: inlets
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-spec:
-  ingressClassName: nginx
-  tls:
-  - hosts:
-    - code.cluster.fun
-    secretName: code-ingress
-  rules:
-  - host: code.cluster.fun
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: auth-proxy
-            port:
-              number: 80

manifests/downloads/downloads.yaml

@@ -1,27 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: downloads-auth
-  namespace: inlets
-  labels:
-    app: downloads-auth
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-spec:
-  ingressClassName: nginx
-  tls:
-  - hosts:
-    - downloads.cluster.fun
-    secretName: downloads-ingress
-  rules:
-  - host: downloads.cluster.fun
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: auth-proxy
-            port:
-              number: 80

manifests/inlets/inlets.yaml

@@ -1,247 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: inlets
-  namespace: inlets
-  annotations:
-    kube-1password: podju6t2s2osc3vbkimyce25ti
-    kube-1password/vault: Kubernetes
-    kube-1password/password-key: token
-type: Opaque
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: inlets
-  namespace: inlets
-  labels:
-    app: inlets
-spec:
-  type: ClusterIP
-  ports:
-    - port: 80
-      protocol: TCP
-      targetPort: 8000
-  selector:
-    app: inlets
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: inlets
-  namespace: inlets
-  labels:
-    app: inlets
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: inlets
-  template:
-    metadata:
-      labels:
-        app: inlets
-    spec:
-      containers:
-      - name: inlets
-        image: docker.cluster.fun/averagemarcus/inlets:3.0.3
-        imagePullPolicy: IfNotPresent
-        command: ["inlets"]
-        args:
-        - "server"
-        - "--token-from=/var/inlets/token"
-        volumeMounts:
-          - name: inlets-token-volume
-            mountPath: /var/inlets/
-        resources:
-          limits:
-            memory: 50Mi
-          requests:
-            memory: 50Mi
-      volumes:
-        - name: inlets-token-volume
-          secret:
-            secretName: inlets
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: inlets
-  namespace: inlets
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-spec:
-  tls:
-  - hosts:
-    - inlets.cluster.fun
-    secretName: inlets-ingress
-  rules:
-  - host: inlets.cluster.fun
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: inlets
-            port:
-              number: 80
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: home-assistant
-  namespace: inlets
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-spec:
-  tls:
-  - hosts:
-    - home.cluster.fun
-    secretName: home-assistant-ingress
-  rules:
-  - host: home.cluster.fun
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: inlets
-            port:
-              number: 80
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: downloads-rpc
-  namespace: inlets
-  labels:
-    app: inlets
-spec:
-  type: ClusterIP
-  ports:
-    - port: 80
-      protocol: TCP
-      targetPort: 8000
-  selector:
-    app: inlets
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: vpn-check
-  namespace: inlets
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-spec:
-  tls:
-  - hosts:
-    - vpn-check.cluster.fun
-    secretName: vpn-check-ingress
-  rules:
-  - host: vpn-check.cluster.fun
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: inlets
-            port:
-              number: 80
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: adguard
-  namespace: inlets
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-spec:
-  tls:
-  - hosts:
-    - adguard.cluster.fun
-    secretName: adguard-ingress
-  rules:
-  - host: adguard.cluster.fun
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: inlets
-            port:
-              number: 80
-
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: podify
-  namespace: inlets
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-spec:
-  tls:
-  - hosts:
-    - podify.cluster.fun
-    secretName: podify-ingress
-  rules:
-  - host: podify.cluster.fun
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: inlets
-            port:
-              number: 80
-
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: photos
-  namespace: inlets
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-spec:
-  tls:
-  - hosts:
-    - photos.cluster.fun
-    secretName: photos-ingress
-  rules:
-  - host: photos.cluster.fun
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: inlets
-            port:
-              number: 80
-
----
-kind: Service
-apiVersion: v1
-metadata:
-  name: loki
-  namespace: inlets
-spec:
-  type: ClusterIP
-  ports:
-    - port: 80
-      protocol: TCP
-      targetPort: 8000
-  selector:
-    app: inlets
----

manifests/jackett/jackett.yaml

@@ -1,27 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: jackett-auth
-  namespace: inlets
-  labels:
-    app: jackett-auth
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-spec:
-  ingressClassName: nginx
-  tls:
-  - hosts:
-    - jackett.cluster.fun
-    secretName: jackett-ingress
-  rules:
-  - host: jackett.cluster.fun
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: auth-proxy
-            port:
-              number: 80

manifests/printer/printer.yaml

@@ -1,27 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: printer-auth
-  namespace: inlets
-  labels:
-    app: printer-auth
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-spec:
-  tls:
-  - hosts:
-    - printer.cluster.fun
-    secretName: printer-ingress
-  rules:
-  - host: printer.cluster.fun
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: auth-proxy
-            port:
-              number: 80
-

manifests/radarr/radarr.yaml

@@ -1,27 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: radarr
-  namespace: inlets
-  labels:
-    app: radarr
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-spec:
-  ingressClassName: nginx
-  tls:
-  - hosts:
-    - radarr.cluster.fun
-    secretName: radarr-ingress
-  rules:
-  - host: radarr.cluster.fun
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: auth-proxy
-            port:
-              number: 80

manifests/sonarr/sonarr.yaml

@@ -1,27 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: sonarr
-  namespace: inlets
-  labels:
-    app: sonarr
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-spec:
-  ingressClassName: nginx
-  tls:
-  - hosts:
-    - sonarr.cluster.fun
-    secretName: sonarr-ingress
-  rules:
-  - host: sonarr.cluster.fun
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: auth-proxy
-            port:
-              number: 80

manifests/transmission/transmission.yaml

@@ -1,27 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: transmission
-  namespace: inlets
-  labels:
-    app: transmission
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-spec:
-  ingressClassName: nginx
-  tls:
-  - hosts:
-    - transmission.cluster.fun
-    secretName: transmission-ingress
-  rules:
-  - host: transmission.cluster.fun
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: auth-proxy
-            port:
-              number: 80