From bd8ffd130b939448fb6b68594a8f5f2420f77cea Mon Sep 17 00:00:00 2001
From: Rob Watson <rob@netflux.io>
Date: Sun, 27 Apr 2025 21:54:08 +0200
Subject: [PATCH] chore(traefik): ssl redirect

---
 deploy/prod-ovh/ingress.yaml                             | 2 ++
 deploy/prod-ovh/kustomization.yaml                       | 3 ++-
 ...tea-ssh.yaml => traefik-ingress-route-gitea-ssh.yaml} | 0
 deploy/prod-ovh/traefik-middleware-ssl-redirect.yaml     | 9 +++++++++
 4 files changed, 13 insertions(+), 1 deletion(-)
 rename deploy/prod-ovh/{ingress-route-gitea-ssh.yaml => traefik-ingress-route-gitea-ssh.yaml} (100%)
 create mode 100644 deploy/prod-ovh/traefik-middleware-ssl-redirect.yaml

diff --git a/deploy/prod-ovh/ingress.yaml b/deploy/prod-ovh/ingress.yaml
index 1e0478a..983397d 100644
--- a/deploy/prod-ovh/ingress.yaml
+++ b/deploy/prod-ovh/ingress.yaml
@@ -2,6 +2,8 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: ingress
+  annotations:
+    traefik.ingress.kubernetes.io/router.middlewares: default-prod-redirect-ssl@kubernetescrd
 
 spec:
   rules:
diff --git a/deploy/prod-ovh/kustomization.yaml b/deploy/prod-ovh/kustomization.yaml
index 19ad58d..c462cef 100644
--- a/deploy/prod-ovh/kustomization.yaml
+++ b/deploy/prod-ovh/kustomization.yaml
@@ -34,7 +34,8 @@ resources:
 
 - statefulset-gitea.yaml
 - svc-gitea.yaml
-- ingress-route-gitea-ssh.yaml
+- traefik-ingress-route-gitea-ssh.yaml
+- traefik-middleware-ssl-redirect.yaml
 
 - statefulset-radicale.yaml
 - svc-radicale.yaml
diff --git a/deploy/prod-ovh/ingress-route-gitea-ssh.yaml b/deploy/prod-ovh/traefik-ingress-route-gitea-ssh.yaml
similarity index 100%
rename from deploy/prod-ovh/ingress-route-gitea-ssh.yaml
rename to deploy/prod-ovh/traefik-ingress-route-gitea-ssh.yaml
diff --git a/deploy/prod-ovh/traefik-middleware-ssl-redirect.yaml b/deploy/prod-ovh/traefik-middleware-ssl-redirect.yaml
new file mode 100644
index 0000000..4803964
--- /dev/null
+++ b/deploy/prod-ovh/traefik-middleware-ssl-redirect.yaml
@@ -0,0 +1,9 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: redirect-ssl
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true