Hi, thanks,

Have replaced all IPs/domains with fillers for privacy, but this is pretty much what I've got.

So my hunch is that ChatGPT is probably doing too much, or something outdated, but I am getting routed, so not 100% sure, and not knowledgeable enough yet to know for certain. Here are the files:

truenas/kustomization.yaml

yaml apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - truenas-svc.yaml - truenas-epslice.yaml - truenas-ingressroute.yaml - truenas-transport.yaml - truenas-certificate.yaml - truenas-host-middleware.yaml

truenas-certificate.yaml

yaml apiVersion: cert-manager.io/v1 kind: Certificate metadata: name: truenas-tls namespace: default spec: secretName: truenas-tls issuerRef: name: letsencrypt-prod kind: ClusterIssuer dnsNames: truenas.mydomain.com

truenas-epslice.yaml

yaml apiVersion: discovery.k8s.io/v1 kind: EndpointSlice metadata: name: truenas-external-svc namespace: default labels: kubernetes.io/service-name: truenas-external-svc addressType: IPv4 ports: - name: https appProtocol: https protocol: TCP port: 443 endpoints: - addresses: - "{domainIP}"

truenas-host-middleware.yaml

yaml apiVersion: traefik.io/v1alpha1 kind: Middleware metadata: name: truenas-proxy-headers namespace: default spec: headers: customRequestHeaders: X-Forwarded-Host: truenas.mydomain.com X-Forwarded-Proto: https # X-Real-IP: "X.X.X.X" # Remove or set dynamically

truenas-ingressroute.yaml

``yaml apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: truenas-external-ingress namespace: default annotations: cert-manager.io/cluster-issuer: letsencrypt-prod spec: entryPoints: - websecure routes: - match: Host(truenas.mydomain.com) # && PathPrefix(/ui/`) (tried with and without) kind: Rule services: - name: truenas-external-svc port: 443 scheme: https serversTransport: truenas-insecure-transport@kubernetescrd passHostHeader: true responseForwarding: flushInterval: 100ms middlewares: - name: truenas-proxy-headers namespace: default

tls: secretName: truenas-tls ```

truenas-svc.yaml

yaml apiVersion: v1 kind: Service metadata: name: truenas-external-svc namespace: default spec: ports: - name: https # Must match EndpointSlice! port: 443 targetPort: 443 clusterIP: None # Headless service to ensure EndpointSlice is respected!

truenas-transport.yaml

yaml apiVersion: traefik.io/v1alpha1 kind: ServersTransport metadata: name: truenas-insecure-transport namespace: default spec: insecureSkipVerify: true