Updated caddy so it can be a reverse proxy

ionos_sbx/caddy-proxy/deployment.yaml

@@ -4,7 +4,7 @@ metadata:
   name: caddy-proxy
   labels: { app: caddy-proxy }
 spec:
-  replicas: 1                       # 1 replica => 1 IP sorgente in uscita
+  replicas: 1                       
   selector:
     matchLabels: { app: caddy-proxy }
   template:
@@ -37,6 +37,9 @@ spec:
           readinessProbe: { tcpSocket: { port: 8080 }, initialDelaySeconds: 5,  periodSeconds: 10 }
           livenessProbe:  { tcpSocket: { port: 8080 }, initialDelaySeconds: 10, periodSeconds: 15 }
       volumes:
+        - name: caddyfile                                  
+          configMap:
+            name: caddy-proxy-config                                
         - name: data
           emptyDir: {}
         - name: config-store

ionos_sbx/caddy-proxy/ingress.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: tmf-caddy
+  namespace: caddy-proxy
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-sbx-issuer
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - tmf.dome-marketplace-sbx.org
+      secretName: tmf-dome-sbx-tls          
+  rules:
+    - host: tmf.dome-marketplace-sbx.org    
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: caddy-proxy                 
+                port:
+                  number: 80

ionos_sbx/caddy-proxy/kustomization.yaml

@@ -4,4 +4,10 @@ resources:
   - deployment.yaml
   - service.yaml
   - forward-auth-sealed.yaml
-  - ghcr-auth-sealed.yaml   
+  - ghcr-auth-sealed.yaml
+  - ingress.yaml
+  - networkpolicy-tmf.yaml
+configMapGenerator:
+  - name: caddy-proxy-config
+    files:
+      - Caddyfile=Caddyfile   

ionos_sbx/caddy-proxy/networkpolicy-tmf.yaml

@@ -0,0 +1,39 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: tmf-allow-only-caddy
+  namespace: marketplace
+  labels: { app: caddy-proxy }
+spec:
+  podSelector:
+    matchExpressions:
+      - key: app.kubernetes.io/name
+        operator: In
+        values:
+          - tm-forum-api-account
+          - tm-forum-api-agreement
+          - tm-forum-api-product-catalog
+          - tm-forum-api-customer-bill-management
+          - tm-forum-api-customer-management
+          - tm-forum-api-party-catalog
+          - tm-forum-api-party-role
+          - tm-forum-api-product-inventory
+          - tm-forum-api-product-ordering-managementù
+          - tm-forum-api-quote
+          - tm-forum-api-resource-catalog
+          - tm-forum-api-resource-function-activation
+          - tm-forum-api-resource-inventory
+          - tm-forum-api-service-catalog
+          - tm-forum-api-service-inventory
+          - tm-forum-api-usage-management
+          - tm-forum-api-document-management
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app: caddy-proxy
+      ports:
+        - protocol: TCP
+          port: 8080 

ionos_sbx/caddy-proxy/service.yaml

@@ -3,7 +3,8 @@ kind: Service
 metadata:
   name: caddy-proxy
 spec:
-  type: ClusterIP          # consumato dalle app INTERNE via HTTP_PROXY
+  type: ClusterIP          
   selector: { app: caddy-proxy }
   ports:
-    - { name: forward, port: 8080, targetPort: 8080 }
+    - { name: forward, port: 8080, targetPort: 8080 }
+    - { name: http,    port: 80,   targetPort: 80 }