apiVersion: helm.cattle.io/v1
kind: HelmChart
metadata:
  name: ingress-nginx
  namespace: infra-net
spec:
  repo: https://kubernetes.github.io/ingress-nginx
  chart: ingress-nginx
  version: 4.12.0
  targetNamespace: infra-net
  valuesContent: |-
    fullnameOverride: ingress-nginx
    controller:
      nodeSelector:
        svccontroller.k3s.cattle.io/enablelb: "true"
      tolerations:
        - key: "node-role.kubernetes.io/master"
          operator: "Exists"
          effect: "NoSchedule"
      labels:
        log-collecting/enabled: "true"
      kind: DaemonSet
      hostNetwork: true
      hostPort:
        enabled: true
      service:
        enabled: false
      publishService:
        enabled: false
      config:
        use-forwarded-headers: "true"
        allow-snippet-annotations: "true"
        annotations-risk-level: Critical
        # http to https重定向
        ssl-redirect: "true"
        # 自定义错误页面
        custom-http-errors: "403,404,502,503"
        http-snippet: |
          # lua插件配置
          lua_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
          # 缓存配置
          proxy_cache_path /tmp/nginx-cache levels=1:2 keys_zone=cache:2m max_size=100m inactive=7d use_temp_path=off;
          proxy_cache_key $uri$is_args$args;
          proxy_cache_lock on;
          proxy_cache_use_stale updating;
          # 限速配置
          limit_req_zone $binary_remote_addr zone=global_limit:10m rate=10r/s;
        server-snippet: |
          # dns配置 配置在http块下会出现重复配置 所以配置在server块下
          resolver 169.254.20.10 10.43.0.10 ipv6=off;
        location-snippet: |
          # 限速配置
          limit_req zone=global_limit burst=30 nodelay;
          limit_req_status 429;
        # 启用geoip2模块
        use-geoip: "false"
        use-geoip2: "true"
        # 日志配置
        log-format-escape-json: "true"
        log-format-upstream: '{
          "msec": "$msec",
          "connection": "$connection",
          "connection_requests": "$connection_requests",
          "pid": "$pid",
          "request_id": "$request_id",
          "request_length": "$request_length",
          "remote_addr": "$remote_addr",
          "remote_user": "$remote_user",
          "remote_port": "$remote_port",
          "time_local": "$time_local",
          "time_iso8601": "$time_iso8601",
          "request": "$request",
          "request_uri": "$request_uri",
          "args": "$args",
          "status": "$status",
          "body_bytes_sent": "$body_bytes_sent",
          "bytes_sent": "$bytes_sent",
          "http_referer": "$http_referer",
          "http_user_agent": "$http_user_agent",
          "http_x_forwarded_for": "$http_x_forwarded_for",
          "http_host": "$http_host",
          "http_upgrade": "$http_upgrade",
          "server_name": "$server_name",
          "request_time": "$request_time",
          "upstream": "$upstream_addr",
          "upstream_connect_time": "$upstream_connect_time",
          "upstream_header_time": "$upstream_header_time",
          "upstream_response_time": "$upstream_response_time",
          "upstream_response_length": "$upstream_response_length",
          "upstream_cache_status": "$upstream_cache_status",
          "ssl_protocol": "$ssl_protocol",
          "ssl_cipher": "$ssl_cipher",
          "scheme": "$scheme",
          "request_method": "$request_method",
          "server_protocol": "$server_protocol",
          "pipe": "$pipe",
          "gzip_ratio": "$gzip_ratio",
          "http_cf_ray": "$http_cf_ray",
          "geoip_country_code": "$geoip2_city_country_code",
          "geoip_city": "$geoip2_city",
          "geoip_org": "$geoip2_org",
          "geoip_longitude": "$geoip2_longitude",
          "geoip_latitude": "$geoip2_latitude"
        }'
        # crowdsec插件配置
        plugins: "crowdsec"
        lua-shared-dicts: "crowdsec_cache: 50m"
      # 启用geoip2模块
      maxmindLicenseKey: "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"
      extraArgs:
        default-ssl-certificate: "infra-net/dev-cm-crt"
      # crowdsec插件配置
      extraInitContainers:
        - name: init-clone-crowdsec-bouncer
          image: devcm/lua-bouncer-plugin:v1.0.5
          imagePullPolicy: IfNotPresent
          env:
            - name: API_URL
              value: "http://crowdsec-service.infra-net.svc.cluster.local:8080"
            - name: API_KEY
              value: "rgILO2mh/t+30LMvzyyMXbfHRmDfBkDDkhEflzHaoQ0"
            - name: BOUNCER_CONFIG
              value: "/crowdsec/crowdsec-bouncer.conf"
            - name: MODE
              value: "live"
            - name: CACHE_EXPIRATION
              value: "3"
            - name: UPDATE_FREQUENCY
              value: "10"
            - name: REQUEST_TIMEOUT
              value: "1000"
            - name: CAPTCHA_PROVIDER
              value: "turnstile"
            - name: SITE_KEY
              value: "0x4AAAAAAAxJ2RPNWzn2LCc-"
            - name: SECRET_KEY
              value: "0x4AAAAAAAxJ2dwFOaNg5ae3c6wYTmWH0bU"
            - name: CAPTCHA_TEMPLATE_PATH
              value: /etc/nginx/lua/plugins/crowdsec/templates/captcha.html
          command: ['sh', '-c', "bash /docker_start.sh; mkdir -p /lua_plugins/crowdsec/; cp -R /crowdsec/* /lua_plugins/crowdsec/"]
          volumeMounts:
            - name: crowdsec-bouncer-plugin
              mountPath: /lua_plugins
      extraVolumes:
        - name: crowdsec-bouncer-plugin
          emptyDir: {}
        - name: custom-html
          configMap:
            name: custom-html
      extraVolumeMounts:
        - name: crowdsec-bouncer-plugin
          mountPath: /etc/nginx/lua/plugins/crowdsec
          subPath: crowdsec
        - name: custom-html
          mountPath: /etc/nginx/lua/plugins/crowdsec/templates
    defaultBackend:
      enabled: true
      image:
        registry: docker.io
        image: devcm/default-backend
        tag: v0.1.0
      autoscaling:
        enabled: true
        minReplicas: 1
        maxReplicas: 3
        targetCPUUtilizationPercentage: 80
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: topology.kubernetes.io/region
                    operator: In
                    values:
                      - "cn-sh"
                      - "cn-hk"