ingress: cut home-assistant to traefik + global 3600s entrypoint timeouts

Three HA hostnames (home, home.k, vscode.home) flip to traefik. The
proxy sidecar in the HA pod stays the XFF trust anchor on the same
:8124/:8080 ports; the home-assistant-ns CNP already allowed traefik
on those ports (added during the shelly-manager batch).

Raises the websecure entrypoint read/write/idle timeouts to 3600s
globally to match the nginx proxy-read/send-timeout that HA dashboards,
vscode (code-server), woodpecker live log streams, and the pve noVNC
console rely on. Traefik's 180s default cuts long-lived idle WS.

cloudflared retargets home.renner.uno to the traefik Service; the .k.
and vscode.home. names are LAN-only via external-dns-unifi.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

kubernetes/apps/home-assistant/ingress.yaml

@@ -10,7 +10,7 @@ metadata:
     nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
 spec:
-  ingressClassName: nginx
+  ingressClassName: traefik
   rules:
     - host: home.renner.uno
       http:

kubernetes/apps/home-assistant/vscode-ingress.yaml

@@ -9,7 +9,7 @@ metadata:
     nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
     nginx.ingress.kubernetes.io/proxy-buffering: "off"
 spec:
-  ingressClassName: nginx
+  ingressClassName: traefik
   rules:
     - host: vscode.home.renner.uno
       http:

kubernetes/infrastructure/cloudflared/configmap.yaml

@@ -22,7 +22,7 @@ data:
           noTLSVerify: true
 
       - hostname: home.renner.uno
-        service: https://ingress-nginx-controller.ingress.svc.cluster.local:443
+        service: https://traefik.ingress.svc.cluster.local:443
         originRequest:
           noTLSVerify: true
 

kubernetes/infrastructure/traefik/helmrelease.yaml

@@ -75,6 +75,15 @@ spec:
         # against the LAN VIP.
         http3:
           enabled: true
+        transport:
+          respondingTimeouts:
+            # Default is 180s, which cuts long-lived idle WS used by
+            # home-assistant dashboards, vscode (code-server), woodpecker
+            # live log streams, and pve noVNC consoles. Matches the
+            # proxy-read/send-timeout=3600s the nginx ingresses had.
+            readTimeout: "3600s"
+            writeTimeout: "3600s"
+            idleTimeout: "3600s"
     service:
       enabled: true
       spec: