Reset git history for making manifests public

envoy-gateway/argocd/certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: argocd-tls
+  namespace: envoy-gateway
+spec:
+  secretName: argocd-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - argocd.jsme.be

envoy-gateway/argocd/gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: argocd
+    protocol: HTTPS
+    port: 443
+    hostname: "argocd.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: argocd
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: argocd-tls
+          namespace: envoy-gateway

envoy-gateway/arrstack/radarr-certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: radarr-tls
+  namespace: envoy-gateway
+spec:
+  secretName: radarr-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - radarr.jsme.be

envoy-gateway/arrstack/radarr-gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: radarr
+    protocol: HTTPS
+    port: 443
+    hostname: "radarr.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: arrstack
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: radarr-tls
+          namespace: envoy-gateway

envoy-gateway/arrstack/sonarr-certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: sonarr-tls
+  namespace: envoy-gateway
+spec:
+  secretName: sonarr-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - sonarr.jsme.be

envoy-gateway/arrstack/sonarr-gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: sonarr
+    protocol: HTTPS
+    port: 443
+    hostname: "sonarr.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: arrstack
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: sonarr-tls
+          namespace: envoy-gateway

envoy-gateway/authentik/certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: authentik-tls
+  namespace: envoy-gateway
+spec:
+  secretName: authentik-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - auth.jsme.be

envoy-gateway/authentik/gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: authentik
+    protocol: HTTPS
+    port: 443
+    hostname: "auth.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: authentik
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: authentik-tls
+          namespace: envoy-gateway

envoy-gateway/authentik/gateway-public-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: authentik
+    protocol: HTTPS
+    port: 443
+    hostname: "auth.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: authentik
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: authentik-tls
+          namespace: envoy-gateway

envoy-gateway/bentopdf/certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: bentopdf-tls
+  namespace: envoy-gateway
+spec:
+  secretName: bentopdf-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - pdf.jsme.be

envoy-gateway/bentopdf/gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: bentopdf
+    protocol: HTTPS
+    port: 443
+    hostname: "pdf.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: bentopdf
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: bentopdf-tls
+          namespace: envoy-gateway

envoy-gateway/bentopdf/gateway-public-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: bentopdf
+    protocol: HTTPS
+    port: 443
+    hostname: "pdf.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: bentopdf
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: bentopdf-tls
+          namespace: envoy-gateway

envoy-gateway/clientsettingspolicies.yaml

@@ -0,0 +1,21 @@
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: ClientTrafficPolicy
+metadata:
+  name: gateway-internal-client-settings
+  namespace: envoy-gateway
+spec:
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-internal
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: ClientTrafficPolicy
+metadata:
+  name: gateway-public-client-settings
+  namespace: envoy-gateway
+spec:
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-public

envoy-gateway/databasus/certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: databasus-tls
+  namespace: envoy-gateway
+spec:
+  secretName: databasus-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - databasus.jsme.be

envoy-gateway/databasus/gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: databasus
+    protocol: HTTPS
+    port: 443
+    hostname: "databasus.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: databasus
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: databasus-tls
+          namespace: envoy-gateway

envoy-gateway/excalidraw/certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: excalidraw-tls
+  namespace: envoy-gateway
+spec:
+  secretName: excalidraw-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - draw.jsme.be

envoy-gateway/excalidraw/gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: excalidraw
+    protocol: HTTPS
+    port: 443
+    hostname: "draw.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: excalidraw
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: excalidraw-tls
+          namespace: envoy-gateway

envoy-gateway/excalidraw/gateway-public-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: excalidraw
+    protocol: HTTPS
+    port: 443
+    hostname: "draw.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: excalidraw
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: excalidraw-tls
+          namespace: envoy-gateway

envoy-gateway/gateway-public.yaml

@@ -0,0 +1,11 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: gateway-public
+  namespace: envoy-gateway
+spec:
+  gatewayClassName: eg
+  infrastructure:
+    annotations:
+      metallb.universe.tf/loadBalancerIPs: "10.8.11.105"
+  listeners: []

envoy-gateway/gateway.yaml

@@ -0,0 +1,11 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: gateway-internal
+  namespace: envoy-gateway
+spec:
+  gatewayClassName: eg
+  infrastructure:
+    annotations:
+      metallb.universe.tf/loadBalancerIPs: "10.8.11.104"
+  listeners: []

envoy-gateway/gitea/certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: gitea-tls
+  namespace: envoy-gateway
+spec:
+  secretName: gitea-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - gitea.jsme.be

envoy-gateway/gitea/gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: gitea
+    protocol: HTTPS
+    port: 443
+    hostname: "gitea.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: gitea
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: gitea-tls
+          namespace: envoy-gateway

envoy-gateway/gitea/gateway-public-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: gitea
+    protocol: HTTPS
+    port: 443
+    hostname: "gitea.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: gitea
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: gitea-tls
+          namespace: envoy-gateway

envoy-gateway/gotify/certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: gotify-tls
+  namespace: envoy-gateway
+spec:
+  secretName: gotify-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - gotify.jsme.be

envoy-gateway/gotify/gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: gotify
+    protocol: HTTPS
+    port: 443
+    hostname: "gotify.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: gotify
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: gotify-tls
+          namespace: envoy-gateway

envoy-gateway/gotify/gateway-public-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: gotify
+    protocol: HTTPS
+    port: 443
+    hostname: "gotify.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: gotify
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: gotify-tls
+          namespace: envoy-gateway

envoy-gateway/httproute-template.yaml

@@ -0,0 +1,68 @@
+# =============================================================================
+# PLACEHOLDERS:
+#   <SERVICE>       - listener/route name (e.g. jellyfin)
+#   <NAMESPACE>     - namespace the service runs in (e.g. jellyfin)
+#   <HOSTNAME>      - full hostname (e.g. jellyfin.jsme.be)
+#   <BACKEND_SVC>   - Kubernetes Service name (e.g. jellyfin)
+#   <BACKEND_PORT>  - port the Service exposes (e.g. 8096)
+# =============================================================================
+# apiVersion: gateway.networking.k8s.io/v1
+# kind: HTTPRoute
+# metadata:
+#   name: <SERVICE>-route
+#   namespace: <NAMESPACE>
+# spec:
+#   parentRefs:
+#     - group: gateway.networking.k8s.io
+#       kind: Gateway
+#       name: gateway-internal
+#       namespace: envoy-gateway
+#       sectionName: <SERVICE>
+#     # - group: gateway.networking.k8s.io    # uncomment if publicly accessible
+#     #   kind: Gateway
+#     #   name: gateway-public
+#     #   namespace: envoy-gateway
+#     #   sectionName: <SERVICE>
+#   hostnames:
+#     - "<HOSTNAME>"
+#   rules:
+#     - filters:
+#         - type: RequestHeaderModifier
+#           requestHeaderModifier:
+#             set:
+#               - name: X-Forwarded-Host
+#                 value: "<HOSTNAME>"
+#               - name: X-Forwarded-Proto
+#                 value: https
+#         - type: ResponseHeaderModifier
+#           responseHeaderModifier:
+#             set:
+#               - name: Strict-Transport-Security
+#                 value: "max-age=31536000; includeSubDomains"
+#               - name: X-Content-Type-Options
+#                 value: nosniff
+#               - name: X-Frame-Options
+#                 value: SAMEORIGIN
+#               - name: Referrer-Policy
+#                 value: strict-origin-when-cross-origin
+#               - name: Permissions-Policy
+#                 value: "camera=(), microphone=(), geolocation=(), payment=()"
+#       backendRefs:
+#         - name: <BACKEND_SVC>
+#           port: <BACKEND_PORT>
+#           kind: Service
+# ---
+# # Optional: only needed if you need to override body size limits
+# # Remove this section if not needed
+# apiVersion: gateway.nginx.org/v1alpha1
+# kind: ClientSettingsPolicy
+# metadata:
+#   name: <SERVICE>-client-settings
+#   namespace: <NAMESPACE>
+# spec:
+#   targetRef:
+#     group: gateway.networking.k8s.io
+#     kind: HTTPRoute
+#     name: <SERVICE>-route
+#   body:
+#     maxSize: 100m  # adjust as needed, use "0" for unlimited

envoy-gateway/immich/certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: immich-tls
+  namespace: envoy-gateway
+spec:
+  secretName: immich-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - photos.jsme.be

envoy-gateway/immich/gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: immich
+    protocol: HTTPS
+    port: 443
+    hostname: "photos.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: immich
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: immich-tls
+          namespace: envoy-gateway

envoy-gateway/immich/gateway-public-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: immich
+    protocol: HTTPS
+    port: 443
+    hostname: "photos.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: immich
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: immich-tls
+          namespace: envoy-gateway

envoy-gateway/infisical/certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: infisical-tls
+  namespace: envoy-gateway
+spec:
+  secretName: infisical-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - infisical.jsme.be

envoy-gateway/infisical/gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: infisical
+    protocol: HTTPS
+    port: 443
+    hostname: "infisical.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: infisical
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: infisical-tls
+          namespace: envoy-gateway

envoy-gateway/it-tools/certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: it-tools-tls
+  namespace: envoy-gateway
+spec:
+  secretName: it-tools-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - tools.jsme.be

envoy-gateway/it-tools/gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: it-tools
+    protocol: HTTPS
+    port: 443
+    hostname: "tools.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: it-tools
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: it-tools-tls
+          namespace: envoy-gateway

envoy-gateway/it-tools/gateway-public-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: it-tools
+    protocol: HTTPS
+    port: 443
+    hostname: "tools.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: it-tools
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: it-tools-tls
+          namespace: envoy-gateway

envoy-gateway/jellyfin/certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: jellyfin-tls
+  namespace: envoy-gateway
+spec:
+  secretName: jellyfin-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - jellyfin.jsme.be

envoy-gateway/jellyfin/gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: jellyfin
+    protocol: HTTPS
+    port: 443
+    hostname: "jellyfin.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: jellyfin
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: jellyfin-tls
+          namespace: envoy-gateway

envoy-gateway/jellyfin/gateway-public-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: jellyfin
+    protocol: HTTPS
+    port: 443
+    hostname: "jellyfin.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: jellyfin
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: jellyfin-tls
+          namespace: envoy-gateway

envoy-gateway/jenkins/certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: jenkins-tls
+  namespace: envoy-gateway
+spec:
+  secretName: jenkins-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - jenkins.jsme.be

envoy-gateway/jenkins/gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: jenkins
+    protocol: HTTPS
+    port: 443
+    hostname: "jenkins.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: jenkins
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: jenkins-tls
+          namespace: envoy-gateway

envoy-gateway/kustomization.yaml

@@ -0,0 +1,372 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - gateway.yaml
+  - gateway-public.yaml
+
+  # Certificates
+  - authentik/certificate.yaml
+  - argocd/certificate.yaml
+  - arrstack/radarr-certificate.yaml
+  - arrstack/sonarr-certificate.yaml
+  - bentopdf/certificate.yaml
+  - gitea/certificate.yaml
+  - immich/certificate.yaml
+  - infisical/certificate.yaml
+  - it-tools/certificate.yaml
+  - jellyfin/certificate.yaml
+  - seerr/certificate.yaml
+  - jenkins/certificate.yaml
+  - longhorn/certificate.yaml
+  - monitoring/certificate.yaml
+  - n8n/certificate.yaml
+  - netbootxyz/certificate.yaml
+  - passbolt/certificate.yaml
+  - proxmox/certificate.yaml
+  - prowlarr/certificate.yaml
+  - resume/resume-certificate.yaml
+  - resume/minio-certificate.yaml
+  - resume/minio-webui-certificate.yaml
+  - minio-aistor/api-certificate.yaml
+  - minio-aistor/console-certificate.yaml
+  - technitium/technitium-certificate.yaml
+  - technitium/technitium-backup-certificate.yaml
+  - torrent/certificate.yaml
+  - truenas/certificate.yaml
+  - unifi/certificate.yaml
+  - shelfmark/certificate.yaml
+  - wikijs/certificate.yaml
+  - zipline/certificate.yaml
+  - vaultwarden/certificate.yaml
+  - databasus/certificate.yaml
+  - excalidraw/certificate.yaml
+  - gotify/certificate.yaml
+  - uptime-kuma/certificate.yaml
+  - ollama/certificate.yaml
+  - openwebui/certificate.yaml
+  - searxng/certificate.yaml
+
+patches:
+  # Internal gateway patches
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: authentik/gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: argocd/gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: gitea/gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: immich/gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: infisical/gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: seerr/gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: jenkins/gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: longhorn/gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: n8n/gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: netbootxyz/gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: arrstack/radarr-gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: arrstack/sonarr-gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: prowlarr/gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: torrent/gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: resume/minio-gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: resume/minio-webui-gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: technitium/technitium-gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: technitium/technitium-backup-gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: unifi/gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: proxmox/gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: truenas/gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: monitoring/gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: bentopdf/gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: it-tools/gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: jellyfin/gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: passbolt/gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: resume/resume-gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: shelfmark/gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: wikijs/gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: zipline/gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: minio-aistor/api-gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: minio-aistor/console-gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: vaultwarden/gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: databasus/gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: excalidraw/gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: gotify/gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: uptime-kuma/gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: ollama/gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: openwebui/gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: searxng/gateway-patch.yaml
+
+  # Public gateway patches
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-public
+    path: gitea/gateway-public-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-public
+    path: authentik/gateway-public-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-public
+    path: bentopdf/gateway-public-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-public
+    path: it-tools/gateway-public-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-public
+    path: jellyfin/gateway-public-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-public
+    path: immich/gateway-public-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-public
+    path: passbolt/gateway-public-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-public
+    path: resume/resume-gateway-public-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-public
+    path: wikijs/gateway-public-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-public
+    path: zipline/gateway-public-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-public
+    path: excalidraw/gateway-public-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-public
+    path: gotify/gateway-public-patch.yaml
+  # Uncomment to expose Grafana publicly — ensure Grafana auth is properly configured first
+  # - target:
+  #     group: gateway.networking.k8s.io
+  #     version: v1
+  #     kind: Gateway
+  #     name: gateway-public
+  #   path: monitoring/grafana-gateway-public-patch.yaml

envoy-gateway/longhorn/certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: longhorn-tls
+  namespace: envoy-gateway
+spec:
+  secretName: longhorn-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - longhorn.jsme.be

envoy-gateway/longhorn/gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: longhorn
+    protocol: HTTPS
+    port: 443
+    hostname: "longhorn.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: longhorn-system
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: longhorn-tls
+          namespace: envoy-gateway

envoy-gateway/minio-aistor/api-certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: minio-aistor-api-tls
+  namespace: envoy-gateway
+spec:
+  secretName: minio-aistor-api-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - s3.jsme.be

envoy-gateway/minio-aistor/api-gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: minio-aistor-api
+    protocol: HTTPS
+    port: 443
+    hostname: "s3.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: minio-aistor
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: minio-aistor-api-tls
+          namespace: envoy-gateway

envoy-gateway/minio-aistor/console-certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: minio-aistor-console-tls
+  namespace: envoy-gateway
+spec:
+  secretName: minio-aistor-console-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - s3-console.jsme.be

envoy-gateway/minio-aistor/console-gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: minio-aistor-console
+    protocol: HTTPS
+    port: 443
+    hostname: "s3-console.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: minio-aistor
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: minio-aistor-console-tls
+          namespace: envoy-gateway

envoy-gateway/monitoring/certificate.yaml

@@ -0,0 +1,44 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: grafana-tls
+  namespace: envoy-gateway
+spec:
+  secretName: grafana-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - grafana.jsme.be
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: vmagent-tls
+  namespace: envoy-gateway
+spec:
+  secretName: vmagent-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - vmagent.jsme.be
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: vmetrics-tls
+  namespace: envoy-gateway
+spec:
+  secretName: vmetrics-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - vmetrics.jsme.be

envoy-gateway/monitoring/gateway-patch.yaml

@@ -0,0 +1,57 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: grafana
+    protocol: HTTPS
+    port: 443
+    hostname: "grafana.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: victoria-metrics
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: grafana-tls
+          namespace: envoy-gateway
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: vmagent
+    protocol: HTTPS
+    port: 443
+    hostname: "vmagent.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: victoria-metrics
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: vmagent-tls
+          namespace: envoy-gateway
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: vmetrics
+    protocol: HTTPS
+    port: 443
+    hostname: "vmetrics.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: victoria-metrics
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: vmetrics-tls
+          namespace: envoy-gateway

envoy-gateway/monitoring/grafana-gateway-public-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: grafana
+    protocol: HTTPS
+    port: 443
+    hostname: "grafana.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: victoria-metrics
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: grafana-tls
+          namespace: envoy-gateway

envoy-gateway/n8n/certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: n8n-tls
+  namespace: envoy-gateway
+spec:
+  secretName: n8n-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - n8n.jsme.be

envoy-gateway/n8n/gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: n8n
+    protocol: HTTPS
+    port: 443
+    hostname: "n8n.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: n8n
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: n8n-tls
+          namespace: envoy-gateway

envoy-gateway/netbootxyz/certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: netbootxyz-tls
+  namespace: envoy-gateway
+spec:
+  secretName: netbootxyz-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - netboot.jsme.be

envoy-gateway/netbootxyz/gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: netbootxyz
+    protocol: HTTPS
+    port: 443
+    hostname: "netboot.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: netbootxyz
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: netbootxyz-tls
+          namespace: envoy-gateway

envoy-gateway/ollama/certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: ollama-tls
+  namespace: envoy-gateway
+spec:
+  secretName: ollama-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - ollama.jsme.be

envoy-gateway/ollama/gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: ollama
+    protocol: HTTPS
+    port: 443
+    hostname: "ollama.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: ollama
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: ollama-tls
+          namespace: envoy-gateway

envoy-gateway/openwebui/certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: forge-tls
+  namespace: envoy-gateway
+spec:
+  secretName: forge-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - forge.jsme.be

envoy-gateway/openwebui/gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: forge
+    protocol: HTTPS
+    port: 443
+    hostname: "forge.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: openwebui
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: forge-tls
+          namespace: envoy-gateway

envoy-gateway/passbolt/certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: passbolt-tls
+  namespace: envoy-gateway
+spec:
+  secretName: passbolt-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - passbolt.jsme.be

envoy-gateway/passbolt/gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: passbolt
+    protocol: HTTPS
+    port: 443
+    hostname: "passbolt.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: passbolt
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: passbolt-tls
+          namespace: envoy-gateway

envoy-gateway/passbolt/gateway-public-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: passbolt
+    protocol: HTTPS
+    port: 443
+    hostname: "passbolt.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: passbolt
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: passbolt-tls
+          namespace: envoy-gateway

envoy-gateway/prowlarr/certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: prowlarr-tls
+  namespace: envoy-gateway
+spec:
+  secretName: prowlarr-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - prowlarr.jsme.be

envoy-gateway/prowlarr/gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: prowlarr
+    protocol: HTTPS
+    port: 443
+    hostname: "prowlarr.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: arrstack
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: prowlarr-tls
+          namespace: envoy-gateway

envoy-gateway/proxmox/certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: proxmox-tls
+  namespace: envoy-gateway
+spec:
+  secretName: proxmox-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - proxmox.jsme.be

envoy-gateway/proxmox/gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: proxmox
+    protocol: HTTPS
+    port: 443
+    hostname: "proxmox.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: proxmox
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: proxmox-tls
+          namespace: envoy-gateway

envoy-gateway/resume/minio-certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: minio-tls
+  namespace: envoy-gateway
+spec:
+  secretName: minio-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - resume-minio.jsme.be

envoy-gateway/resume/minio-gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: minio
+    protocol: HTTPS
+    port: 443
+    hostname: "resume-minio.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: resume
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: minio-tls
+          namespace: envoy-gateway

envoy-gateway/resume/minio-webui-certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: minio-webui-tls
+  namespace: envoy-gateway
+spec:
+  secretName: minio-webui-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - resume-minioweb.jsme.be

envoy-gateway/resume/minio-webui-gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: minio-webui
+    protocol: HTTPS
+    port: 443
+    hostname: "resume-minioweb.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: resume
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: minio-webui-tls
+          namespace: envoy-gateway

envoy-gateway/resume/resume-certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: resume-tls
+  namespace: envoy-gateway
+spec:
+  secretName: resume-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - resume.jsme.be

envoy-gateway/resume/resume-gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: resume
+    protocol: HTTPS
+    port: 443
+    hostname: "resume.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: resume
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: resume-tls
+          namespace: envoy-gateway

envoy-gateway/resume/resume-gateway-public-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: resume
+    protocol: HTTPS
+    port: 443
+    hostname: "resume.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: resume
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: resume-tls
+          namespace: envoy-gateway

envoy-gateway/searxng/certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: searxng-tls
+  namespace: envoy-gateway
+spec:
+  secretName: searxng-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - search.jsme.be

envoy-gateway/searxng/gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: searxng
+    protocol: HTTPS
+    port: 443
+    hostname: "search.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: searxng
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: searxng-tls
+          namespace: envoy-gateway

envoy-gateway/searxng/gateway-public-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: searxng
+    protocol: HTTPS
+    port: 443
+    hostname: "search.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: searxng
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: searxng-tls
+          namespace: envoy-gateway

envoy-gateway/seerr/certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: seerr-tls
+  namespace: envoy-gateway
+spec:
+  secretName: seerr-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - seerr.jsme.be

envoy-gateway/seerr/gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: seerr
+    protocol: HTTPS
+    port: 443
+    hostname: "seerr.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: seerr
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: seerr-tls
+          namespace: envoy-gateway

envoy-gateway/technitium/technitium-backup-certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: technitium-backup-tls
+  namespace: envoy-gateway
+spec:
+  secretName: technitium-backup-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - dns2.jsme.be

envoy-gateway/technitium/technitium-backup-gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: technitium-backup
+    protocol: HTTPS
+    port: 443
+    hostname: "dns2.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: technitium
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: technitium-backup-tls
+          namespace: envoy-gateway

envoy-gateway/technitium/technitium-certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: technitium-tls
+  namespace: envoy-gateway
+spec:
+  secretName: technitium-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - dns1.jsme.be

envoy-gateway/technitium/technitium-gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: technitium
+    protocol: HTTPS
+    port: 443
+    hostname: "dns1.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: technitium
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: technitium-tls
+          namespace: envoy-gateway

envoy-gateway/torrent/certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: torrent-tls
+  namespace: envoy-gateway
+spec:
+  secretName: torrent-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - torrent.jsme.be

envoy-gateway/torrent/gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: torrent
+    protocol: HTTPS
+    port: 443
+    hostname: "torrent.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: arrstack
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: torrent-tls
+          namespace: envoy-gateway

envoy-gateway/truenas/certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: truenas-tls
+  namespace: envoy-gateway
+spec:
+  secretName: truenas-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - truenas.jsme.be

envoy-gateway/truenas/gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: truenas
+    protocol: HTTPS
+    port: 443
+    hostname: "truenas.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: truenas
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: truenas-tls
+          namespace: envoy-gateway

envoy-gateway/unifi/certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: unifi-tls
+  namespace: envoy-gateway
+spec:
+  secretName: unifi-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - unifi.jsme.be

envoy-gateway/unifi/gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: unifi
+    protocol: HTTPS
+    port: 443
+    hostname: "unifi.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: unifi
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: unifi-tls
+          namespace: envoy-gateway

envoy-gateway/uptime-kuma/certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: uptime-kuma-tls
+  namespace: envoy-gateway
+spec:
+  secretName: uptime-kuma-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - status.jsme.be

envoy-gateway/uptime-kuma/gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: uptime-kuma
+    protocol: HTTPS
+    port: 443
+    hostname: "status.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: uptime-kuma
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: uptime-kuma-tls
+          namespace: envoy-gateway

envoy-gateway/vaultwarden/certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: vaultwarden-tls
+  namespace: envoy-gateway
+spec:
+  secretName: vaultwarden-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - vault.jsme.be

envoy-gateway/vaultwarden/gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: vaultwarden
+    protocol: HTTPS
+    port: 443
+    hostname: "vault.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: vaultwarden
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: vaultwarden-tls
+          namespace: envoy-gateway

envoy-gateway/wikijs/certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: wikijs-tls
+  namespace: envoy-gateway
+spec:
+  secretName: wikijs-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - wiki.jsme.be

envoy-gateway/wikijs/gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: wikijs
+    protocol: HTTPS
+    port: 443
+    hostname: "wiki.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: wiki
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: wikijs-tls
+          namespace: envoy-gateway

envoy-gateway/wikijs/gateway-public-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: wikijs
+    protocol: HTTPS
+    port: 443
+    hostname: "wiki.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: wiki
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: wikijs-tls
+          namespace: envoy-gateway

envoy-gateway/zipline/certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: zipline-tls
+  namespace: envoy-gateway
+spec:
+  secretName: zipline-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - share.jsme.be

envoy-gateway/zipline/gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: zipline
+    protocol: HTTPS
+    port: 443
+    hostname: "share.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: zipline
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: zipline-tls
+          namespace: envoy-gateway

envoy-gateway/zipline/gateway-public-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: zipline
+    protocol: HTTPS
+    port: 443
+    hostname: "share.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: zipline
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: zipline-tls
+          namespace: envoy-gateway