apiVersion: apps/v1
kind: Deployment
metadata:
  name: home-proxy
spec:
  revisionHistoryLimit: 3
  selector:
    matchLabels:
      app: home-proxy
  replicas: 1
  template:
    metadata:
      labels:
        app: home-proxy
    spec:
      volumes:
        - name: caddy-config
          configMap:
            name: caddy-config
            items:
              - key: Caddyfile
                path: Caddyfile
      containers:
        - name: home-proxy
          image: caddy:2
          args:
            [
              "caddy",
              "run",
              "--config",
              "/etc/caddy/Caddyfile",
              "--adapter",
              "caddyfile",
            ]
          securityContext:
            runAsUser: 1000
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 8080
              name: jellyfin-port
              protocol: TCP
            - containerPort: 8081
              name: nas-port
              protocol: TCP
            - containerPort: 8082
              name: plex-port
              protocol: TCP
            - containerPort: 8083
              name: vm-port
              protocol: TCP
          env:
            - name: TZ
              value: Australia/Melbourne
            - name: CADDY_LOG_LEVEL
              value: WARN
          volumeMounts:
            - name: caddy-config
              mountPath: /etc/caddy
          resources:
            requests:
              cpu: 100m
              memory: 126Mi
            limits:
              cpu: 400m
              memory: 512Mi
---
apiVersion: v1
kind: Service
metadata:
  name: home-proxy
  labels:
    app: home-proxy
spec:
  type: ClusterIP
  ports:
    - port: 8080
      targetPort: 8080
      protocol: TCP
      name: jellyfin-port
    - port: 8081
      targetPort: 8081
      protocol: TCP
      name: nas-port
    - port: 8082
      targetPort: 8082
      protocol: TCP
      name: plex-port
    - port: 8083
      targetPort: 8083
      protocol: TCP
      name: vm-port
  selector:
    app: home-proxy

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: caddy-config
  namespace: home-apps
data:
  Caddyfile: |
    # Jellyfin
    :8080 {
      log {
        level {env.CADDY_LOG_LEVEL}
        output stderr
      }

      reverse_proxy 192.168.1.11:8096

      route /ping {
        respond "Hi, I am running with version app version: {env.APP_VERSION}"
      }
      encode gzip zstd
    }
    # Nas
    :8081 {
      log {
        level {env.CADDY_LOG_LEVEL}
        output stderr
      }
      # nas
      reverse_proxy 192.168.1.4:8080

      encode gzip zstd
    }

    # Plex
    :8082 {
      log {
        level {env.CADDY_LOG_LEVEL}
        output stderr
      }

      reverse_proxy 192.168.1.11:32400
      encode gzip zstd
    }
    # VMware
    :8083 {
      log {
        level {env.CADDY_LOG_LEVEL}
        output stderr
      }

      reverse_proxy https://192.168.1.56 {
        transport http {
          tls_insecure_skip_verify
        }
      }
      encode gzip zstd
    }
    # Adguard web
    :8084 {
      log {
        level {env.CADDY_LOG_LEVEL}
        output stderr
      }

      reverse_proxy 192.168.1.11:28888
      encode gzip zstd
    }

---

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nas-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
    kubernetes.io/tls-acme: "true"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    nginx.ingress.kubernetes.io/proxy-body-size: 1024000m
    nginx.ingress.kubernetes.io/auth-url: "https://id.junv.cc/oauth2/auth"
    nginx.ingress.kubernetes.io/auth-signin: "https://id.junv.cc/oauth2/start?rd=https%3A%2F%2F$host$request_uri"
spec:
  tls:
  - hosts:
    - nas.junv.cc
    secretName: nas-tls
  rules:
  - host: nas.junv.cc
    http:
      paths:
      - backend:
          service:
            name: home-proxy
            port:
              number: 8081
        path: /
        pathType: Prefix

---

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: jellyfin-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
    kubernetes.io/tls-acme: "true"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    nginx.ingress.kubernetes.io/auth-url: "https://id.junv.cc/oauth2/auth"
    nginx.ingress.kubernetes.io/auth-signin: "https://id.junv.cc/oauth2/start?rd=https%3A%2F%2F$host$request_uri"
spec:
  tls:
  - hosts:
    - jellyfin.junv.cc
    secretName: jellyfin-tls
  rules:
  - host: jellyfin.junv.cc
    http:
      paths:
      - backend:
          service:
            name: home-proxy
            port:
              number: 8080
        path: /
        pathType: Prefix

---

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: vm-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
    kubernetes.io/tls-acme: "true"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
    nginx.ingress.kubernetes.io/auth-url: "https://id.junv.cc/oauth2/auth"
    nginx.ingress.kubernetes.io/auth-signin: "https://id.junv.cc/oauth2/start?rd=https%3A%2F%2F$host$request_uri"
spec:
  tls:
  - hosts:
    - vm.junv.cc
    secretName: vm-tls
  rules:
  - host: vm.junv.cc
    http:
      paths:
      - backend:
          service:
            name: home-proxy
            port:
              number: 8083
        path: /
        pathType: Prefix

---

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: plex-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
    kubernetes.io/tls-acme: "true"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
  tls:
  - hosts:
    - plex.junv.cc
    secretName: plex-tls
  rules:
  - host: plex.junv.cc
    http:
      paths:
      - pathType: Prefix
        path: /
        backend:
          service:
            name: home-proxy
            port:
              number: 8082

---

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: adguard-ingress
  namespace: home-apps
  annotations:
    kubernetes.io/ingress.class: "nginx"
    kubernetes.io/tls-acme: "true"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    nginx.ingress.kubernetes.io/auth-url: "https://id.junv.cc/oauth2/auth"
    nginx.ingress.kubernetes.io/auth-signin: "https://id.junv.cc/oauth2/start?rd=https%3A%2F%2F$host$request_uri"
spec:
  tls:
  - hosts:
    - adguard.junv.cc
    secretName: adguard-tls
  rules:
  - host: adguard.junv.cc
    http:
      paths:
      - backend:
          service:
            name: home-proxy
            port:
              number: 8084
        path: /
        pathType: Prefix

---

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: plex-home-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
    kubernetes.io/tls-acme: "true"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
  tls:
  - hosts:
    - plex.home.junv.cc
    secretName: plex-home-tls
  rules:
  - host: plex.home.junv.cc
    http:
      paths:
      - pathType: Prefix
        path: /
        backend:
          service:
            name: home-proxy
            port:
              number: 8082

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nas-home-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
    kubernetes.io/tls-acme: "true"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    nginx.ingress.kubernetes.io/proxy-body-size: 1024000m
spec:
  tls:
  - hosts:
    - nas.home.junv.cc
    secretName: nas-home-tls
  rules:
  - host: nas.home.junv.cc
    http:
      paths:
      - backend:
          service:
            name: home-proxy
            port:
              number: 8081
        path: /
        pathType: Prefix

---

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: jellyfin-home-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
    kubernetes.io/tls-acme: "true"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
  tls:
  - hosts:
    - jellyfin.home.junv.cc
    secretName: jellyfin-home-tls
  rules:
  - host: jellyfin.home.junv.cc
    http:
      paths:
      - backend:
          service:
            name: home-proxy
            port:
              number: 8080
        path: /
        pathType: Prefix

---

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: vm-home-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
    kubernetes.io/tls-acme: "true"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
spec:
  tls:
  - hosts:
    - vm.home.junv.cc
    secretName: vm-home-tls
  rules:
  - host: vm.home.junv.cc
    http:
      paths:
      - backend:
          service:
            name: home-proxy
            port:
              number: 8083
        path: /
        pathType: Prefix