From 8319ee60c09b6abf504f17224f9b1778665280ed Mon Sep 17 00:00:00 2001
From: alkatrazz <aliyesilkaya93@gmail.com>
Date: Tue, 7 Jul 2026 16:04:30 +0200
Subject: [PATCH] feat(auth): routes HTTPS publiques du hub
 (auth./portail.funklab.online)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

IngressRoutes websecure + certResolver Let's Encrypt pour Authentik et
Guacamole, en plus des routes internes *.lab.local (non destructif).
Cert auth.funklab.online émis et vérifié (issuer Let's Encrypt).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 k8s/apps/authentik/ingress-public.yaml | 18 ++++++++++++++++++
 k8s/apps/guacamole/ingress-public.yaml | 18 ++++++++++++++++++
 2 files changed, 36 insertions(+)
 create mode 100644 k8s/apps/authentik/ingress-public.yaml
 create mode 100644 k8s/apps/guacamole/ingress-public.yaml

diff --git a/k8s/apps/authentik/ingress-public.yaml b/k8s/apps/authentik/ingress-public.yaml
new file mode 100644
index 0000000..232ef89
--- /dev/null
+++ b/k8s/apps/authentik/ingress-public.yaml
@@ -0,0 +1,18 @@
+# Accès public HTTPS — auth.funklab.online (cert Let's Encrypt auto).
+# S'ajoute à la route interne auth.lab.local (non destructif).
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: authentik-public
+  namespace: auth
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`auth.funklab.online`)
+      kind: Rule
+      services:
+        - name: authentik
+          port: 9000
+  tls:
+    certResolver: letsencrypt
diff --git a/k8s/apps/guacamole/ingress-public.yaml b/k8s/apps/guacamole/ingress-public.yaml
new file mode 100644
index 0000000..b017719
--- /dev/null
+++ b/k8s/apps/guacamole/ingress-public.yaml
@@ -0,0 +1,18 @@
+# Accès public HTTPS — portail.funklab.online (cert Let's Encrypt auto).
+# S'ajoute à la route interne portail.lab.local (non destructif).
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: guacamole-public
+  namespace: auth
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`portail.funklab.online`)
+      kind: Rule
+      services:
+        - name: guacamole
+          port: 8080
+  tls:
+    certResolver: letsencrypt