image:
  repository: tccr.io/tccr/traefik
  tag: v2.11.2@sha256:4890e4e0d369773b31104ec9e2a357bec0d18a0070c6c9516bc7fdc8906a71cb
  pullPolicy: IfNotPresent

workload:
  main:
    replicas: 2
    strategy: RollingUpdate
    podSpec:
      containers:
        main:
          args: []
          probes:
            # -- Liveness probe configuration
            # @default -- See below
            liveness:
              # -- sets the probe type when not using a custom probe
              # @default -- "TCP"
              type: tcp
              # -- If a HTTP probe is used (default for HTTP/HTTPS services) this path is used
              # @default -- "/"
              # path: "/ping"
            # -- Readiness probe configuration
            # @default -- See below
            readiness:
              # -- sets the probe type when not using a custom probe
              # @default -- "TCP"
              type: tcp
              # -- If a HTTP probe is used (default for HTTP/HTTPS services) this path is used
              # @default -- "/"
              # path: "/ping"
            # -- Startup probe configuration
            # @default -- See below
            startup:
              # -- sets the probe type when not using a custom probe
              # @default -- "TCP"
              type: tcp
              # -- If a HTTP probe is used (default for HTTP/HTTPS services) this path is used
              # @default -- "/"
              # path: "/ping"
# -- Options for all pods
# Can be overruled per pod
podOptions:
  automountServiceAccountToken: true
operator:
  register: true
# -- Use ingressClass. Ignored if Traefik version < 2.3 / kubernetes < 1.18.x
ingressClass:
  # true is not unit-testable yet, pending https://github.com/rancher/helm-unittest/pull/12
  enabled: false
  isDefaultClass: false
  # Use to force a networking.k8s.io API Version for certain CI/CD applications. E.g. "v1beta1"
  fallbackApiVersion: ""
# -- Create an IngressRoute for the dashboard
ingressRoute:
  dashboard:
    enabled: true
    # Additional ingressRoute annotations (e.g. for kubernetes.io/ingress.class)
    annotations: {}
    # Additional ingressRoute labels (e.g. for filtering IngressRoute by custom labels)
    labels: {}
#
# -- Configure providers
providers:
  kubernetesCRD:
    enabled: true
    namespaces: []
    # - "default"
  kubernetesIngress:
    enabled: true
    # labelSelector: environment=production,method=traefik
    namespaces: []
    # - "default"
    # IP used for Kubernetes Ingress endpoints
    publishedService:
      enabled: true
      # Published Kubernetes Service to copy status from. Format: namespace/servicename
      # By default this Traefik service
      # pathOverride: ""
# -- Logs
# https://docs.traefik.io/observability/logs/
logs:
  # Traefik logs concern everything that happens to Traefik itself (startup, configuration, events, shutdown, and so on).
  general:
    # By default, the level is set to ERROR. Alternative logging levels are DEBUG, PANIC, FATAL, ERROR, WARN, and INFO.
    level: ERROR
    # -- Set the format of General Logs to be either Common Log Format or JSON. For more information: https://doc.traefik.io/traefik/observability/logs/#format
    format: common
  access:
    # To enable access logs
    enabled: false
    # To write the logs in an asynchronous fashion, specify a bufferingSize option.
    # This option represents the number of log lines Traefik will keep in memory before writing
    # them to the selected output. In some cases, this option can greatly help performances.
    # bufferingSize: 100
    # Filtering https://docs.traefik.io/observability/access-logs/#filtering
    filters: {}
    # statuscodes: "200,300-302"
    # retryattempts: true
    # minduration: 10ms
    # Fields
    # https://docs.traefik.io/observability/access-logs/#limiting-the-fieldsincluding-headers
    fields:
      general:
        defaultmode: keep
        names: {}
        # Examples:
        # ClientUsername: drop
      headers:
        defaultmode: drop
        names: {}
        # Examples:
        # User-Agent: redact
        # Authorization: drop
        # Content-Type: keep
    # -- Set the format of Access Logs to be either Common Log Format or JSON. For more information: https://doc.traefik.io/traefik/observability/access-logs/#format
    format: common
metrics:
  main:
    enabled: true
    type: servicemonitor
    endpoints:
      - port: metrics
        path: /metrics
    targetSelector: metrics

globalArguments:
  - "--global.checknewversion"

configmap:
  dashboard:
    enabled: true
    labels:
      grafana_dashboard: "1"
    data:
      traefik.json: >-
        {{ .Files.Get "dashboard.json" | indent 8 }}

##
# -- Additional arguments to be passed at Traefik's binary
# All available options available on https://docs.traefik.io/reference/static-configuration/cli/
## Use curly braces to pass values: `helm install --set="additionalArguments={--providers.kubernetesingress.ingressclass=traefik-internal,--log.level=DEBUG}"`
additionalArguments:
  - "--serverstransport.insecureskipverify=true"
  - "--providers.kubernetesingress.allowexternalnameservices=true"

# -- Default clusterCertificate generated by clusterissuer
defaultCertificate: ""

# -- Add custom DNSStore objects
tlsStore: {}

# -- TLS Options to be created as TLSOption CRDs
# https://doc.traefik.io/tccr.io/truecharts/https/tls/#tls-options
# Example:
tlsOptions:
  default:
    sniStrict: false
    minVersion: VersionTLS12
    curvePreferences:
      - CurveP521
      - CurveP384
      - X25519
    cipherSuites:
      - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
      - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
      - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
      - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
      - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
      - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
      - TLS_AES_128_GCM_SHA256
      - TLS_AES_256_GCM_SHA384
      - TLS_CHACHA20_POLY1305_SHA256
# -- Options for the main traefik service, where the entrypoints traffic comes from
# from.
service:
  main:
    type: LoadBalancer
    ports:
      main:
        port: 9000
        targetPort: 9000
        protocol: http
        # -- Forwarded Headers should never be enabled on Main entrypoint
        forwardedHeaders:
          enabled: false
        # -- Proxy Protocol should never be enabled on Main entrypoint
        proxyProtocol:
          enabled: false
  tcp:
    enabled: true
    type: LoadBalancer
    ## In most cases, you want this changed to `Local`
    externalTrafficPolicy: Cluster
    ports:
      web:
        enabled: true
        port: 80
        protocol: http
        redirectTo: websecure
        # Options: Empty, 0 (ingore), or positive int
        # redirectPort:
        # -- Configure (Forwarded Headers)[https://doc.traefik.io/traefik/routing/entrypoints/#forwarded-headers] Support
        forwardedHeaders:
          enabled: false
          # -- List of trusted IP and CIDR references
          trustedIPs: []
          # -- Trust all forwarded headers
          insecureMode: false
        # -- Configure (Proxy Protocol Headers)[https://doc.traefik.io/traefik/routing/entrypoints/#proxyprotocol] Support
        proxyProtocol:
          enabled: false
          # -- Only IPs in trustedIPs will lead to remote client address replacement
          trustedIPs: []
          # -- Trust every incoming connection
          insecureMode: false
      websecure:
        enabled: true
        port: 443
        protocol: https
        # -- Configure (Forwarded Headers)[https://doc.traefik.io/traefik/routing/entrypoints/#forwarded-headers] Support
        forwardedHeaders:
          enabled: false
          # -- List of trusted IP and CIDR references
          trustedIPs: []
          # -- Trust all forwarded headers
          insecureMode: false
        # -- Configure (Proxy Protocol Headers)[https://doc.traefik.io/traefik/routing/entrypoints/#proxyprotocol] Support
        proxyProtocol:
          enabled: false
          # -- Only IPs in trustedIPs will lead to remote client address replacement
          trustedIPs: []
          # -- Trust every incoming connection
          insecureMode: false
  #      tcpexample:
  #        enabled: true
  #        targetPort: 9443
  #        protocol: tcp
  #        tls:
  #          enabled: false
  #          # this is the name of a TLSOption definition
  #          options: ""
  #          certResolver: ""
  #          domains: []
  #          # - main: example.com
  #          #   sans:
  #          #     - foo.example.com
  #          #     - bar.example.com
  metrics:
    enabled: true
    type: ClusterIP
    ports:
      metrics:
        enabled: true
        port: 9180
        targetPort: 9180
        protocol: http
        # -- Forwarded Headers should never be enabled on Metrics entrypoint
        forwardedHeaders:
          enabled: false
        # -- Proxy Protocol should never be enabled on Metrics entrypoint
        proxyProtocol:
          enabled: false
  # udp:
  #   enabled: false
# -- Whether Role Based Access Control objects like roles and rolebindings should be created
rbac:
  main:
    enabled: true
    primary: true
    clusterWide: true
    rules:
      - apiGroups:
          - ""
        resources:
          - services
          - endpoints
          - secrets
        verbs:
          - get
          - list
          - watch
      - apiGroups:
          - extensions
          - networking.k8s.io
        resources:
          - ingresses
          - ingressclasses
        verbs:
          - get
          - list
          - watch
      - apiGroups:
          - extensions
          - networking.k8s.io
        resources:
          - ingresses/status
        verbs:
          - update
      - apiGroups:
          - traefik.containo.us
          - traefik.io
        resources:
          - middlewares
          - middlewaretcps
          - ingressroutes
          - traefikservices
          - ingressroutetcps
          - ingressrouteudps
          - tlsoptions
          - tlsstores
          - serverstransports
        verbs:
          - get
          - list
          - watch
# -- The service account the pods will use to interact with the Kubernetes API
serviceAccount:
  main:
    enabled: true
    primary: true
# -- SCALE Middleware Handlers
middlewares:
  basicAuth: []
  # - name: basicauthexample
  #   users:
  #     - username: testuser
  #       password: testpassword
  forwardAuth: []
  # - name: forwardAuthexample
  #   address: https://auth.example.com/
  #   authResponseHeaders:
  #     - X-Secret
  #     - X-Auth-User
  #   authRequestHeaders:
  #     - "Accept"
  #     - "X-CustomHeader"
  #   authResponseHeadersRegex: "^X-"
  #   trustForwardHeader: true
  customRequestHeaders: []
  # - name: customRequestHeaderExample
  #   headers:
  #     - name: X-Custom-Header
  #       value: "foobar"
  #     - name: X-Header-To-Remove
  #       value: ""
  customResponseHeaders: []
  # - name: customResponseHeaderExample
  #   headers:
  #     - name: X-Custom-Header
  #       value: "foobar"
  #     - name: X-Header-To-Remove
  #       value: ""
  rewriteResponseHeaders: []
  # - name: rewriteResponseHeadersName
  #   headers:
  #     - name: "Location"
  #       regex: "^http://(.+)$"
  #       replacement: "https://$1"
  #     - name: "Date"
  #       regex: "^[^,]+,\\s*(.+)$"
  #       replacement: "$1"
  customFrameOptionsValue: []
  # - name: customFrameOptionsValueExample
  #   value: "SAMEORIGIN"
  buffering: []
  # - name: bufferingExample
  #   maxRequestBodyBytes: 1000000
  #   memRequestBodyBytes: 1000000
  #   maxResponseBodyBytes: 1000000
  #   memResponseBodyBytes: 1000000
  #   retryExpression: "IsNetworkError() && Attempts() < 2"
  chain: []
  # - name: chainname
  #   middlewares:
  #    - name: compress
  redirectScheme: []
  # - name: redirectSchemeName
  #   scheme: https
  #   permanent: true
  rateLimit: []
  # - name: rateLimitName
  #   average: 300
  #   burst: 200
  redirectRegex: []
  # - name: redirectRegexName
  #   regex: putregexhere
  #   replacement: replacementurlhere
  #   permanent: false
  stripPrefixRegex: []
  # - name: stripPrefixRegexName
  #   regex: []
  ipWhiteList: []
  # - name: ipWhiteListName
  #   sourceRange: []
  #   ipStrategy:
  #     depth: 2
  #     excludedIPs: []
  themePark: []
  # - name: themeParkName
  # -- Supported apps, lower case name
  # -- https://docs.theme-park.dev/themes
  #   app: appnamehere
  # -- Supported themes, lower case name
  # -- https://docs.theme-park.dev/themes/APPNAMEHERE
  # -- https://docs.theme-park.dev/community-themes
  #   theme: themenamehere
  # -- https://theme-park.dev or a self hosted url
  #   baseUrl: https://theme-park.dev
  # Sets X-Real-Ip with an IP from the X-Forwarded-For or
  # Cf-Connecting-Ip (If from Cloudflare)
  # Evaluation of those headers will go from last to first
  realIP: []
  # - name: realIPName
  # -- The real IP will be the first one that is
  # -- not included in any of the CIDRs passed here
  #   excludedNetworks:
  #     - 1.1.1.1/24
  addPrefix: []
  # - name: addPrefixName
  #   prefix: "/foo"
  geoBlock: []
  # -- https://github.com/PascalMinder/geoblock
  # - name: geoBlockName
  #   allowLocalRequests: true
  #   logLocalRequests: false
  #   logAllowedRequests: false
  #   logApiRequests: false
  #   api: https://get.geojs.io/v1/ip/country/{ip}
  #   apiTimeoutMs: 500
  #   cacheSize: 25
  #   forceMonthlyUpdate: true
  #   allowUnknownCountries: false
  #   unknownCountryApiResponse: nil
  #   blackListMode: false
  #   countries:
  #     - RU
  modsecurity: []
  # - name: modsecurityName
  #   modSecurityUrl: modSecurity container URL
  #   timeoutMillis: Configurated  timeout
  #   maxBodySize: maxBodySize
  bouncer: []
  # - name: bouncer
  #   enabled: false
  #   logLevel: DEBUG
  #   updateIntervalSeconds: 60
  #   defaultDecisionSeconds: 60
  #   httpTimeoutSeconds: 10
  #   crowdsecMode: live
  #   crowdsecAppsecEnabled: false
  #   crowdsecAppsecHost: crowdsec:7422
  #   crowdsecAppsecFailureBlock: true
  #   crowdsecLapiKey: privateKey-foo
  #   crowdsecLapiKeyFile: /etc/traefik/cs-privateKey-foo
  #   crowdsecLapiHost: crowdsec:8080
  #   crowdsecLapiScheme: http
  #   crowdsecLapiTLSInsecureVerify: false
  #   crowdsecCapiMachineId: login
  #   crowdsecCapiPassword: password
  #   crowdsecCapiScenarios:
  #     - crowdsecurity/http-path-traversal-probing
  #     - crowdsecurity/http-xss-probing
  #     - crowdsecurity/http-generic-bf
  #   forwardedHeadersTrustedIPs:
  #     - 10.0.10.23/32
  #     - 10.0.20.0/24
  #   clientTrustedIPs:
  #     - 192.168.1.0/24
  #   forwardedHeadersCustomName: X-Custom-Header
  #   redisCacheEnabled: false
  #   redisCacheHost: "redis:6379"
  #   redisCachePassword: password
  #   redisCacheDatabase: "5"
  #   crowdsecLapiTLSCertificateAuthority: |-
  #   crowdsecLapiTLSCertificateAuthorityFile: /etc/traefik/crowdsec-certs/ca.pem
  #   crowdsecLapiTLSCertificateBouncer: |-
  #   crowdsecLapiTLSCertificateBouncerFile: /etc/traefik/crowdsec-certs/bouncer.pem
  #   crowdsecLapiTLSCertificateBouncerKey: |-
  #   crowdsecLapiTLSCertificateBouncerKeyFile: /etc/traefik/crowdsec-certs/bouncer-key.pem
  ## Note: body of every request will be buffered in memory while the request is in-flight
  ## (i.e.: during the security check and during the request processing by traefik and the backend),
  ## so you may want to tune maxBodySize depending on how much RAM you have.
portalhook:
  enabled: true
persistence:
  plugins:
    enabled: true
    mountPath: "/plugins-storage"
    type: emptyDir
  crowdsec-bouncer-tls:
    enabled: "{{ if .Values.middlewares.bouncer }}true{{ else }}false{{ end }}"
    mountPath: "/etc/traefik/crowdsec-certs"
    type: secret
    expandObjectName: false
    objectName: crowdsec-bouncer-tls
portal:
  open:
    enabled: true
    path: /dashboard/