From 2d41d6a2689778da31771b49607d7f2ca2f9bfda Mon Sep 17 00:00:00 2001
From: Konstantin Renner <konstantin@renner.uno>
Date: Sun, 17 May 2026 16:02:44 +0200
Subject: [PATCH] ingress: cut home-assistant to traefik + global 3600s
 entrypoint timeouts

Three HA hostnames (home, home.k, vscode.home) flip to traefik. The
proxy sidecar in the HA pod stays the XFF trust anchor on the same
:8124/:8080 ports; the home-assistant-ns CNP already allowed traefik
on those ports (added during the shelly-manager batch).

Raises the websecure entrypoint read/write/idle timeouts to 3600s
globally to match the nginx proxy-read/send-timeout that HA dashboards,
vscode (code-server), woodpecker live log streams, and the pve noVNC
console rely on. Traefik's 180s default cuts long-lived idle WS.

cloudflared retargets home.renner.uno to the traefik Service; the .k.
and vscode.home. names are LAN-only via external-dns-unifi.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 kubernetes/apps/home-assistant/ingress.yaml          | 2 +-
 kubernetes/apps/home-assistant/vscode-ingress.yaml   | 2 +-
 kubernetes/infrastructure/cloudflared/configmap.yaml | 2 +-
 kubernetes/infrastructure/traefik/helmrelease.yaml   | 9 +++++++++
 4 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/kubernetes/apps/home-assistant/ingress.yaml b/kubernetes/apps/home-assistant/ingress.yaml
index 95671687..871a0568 100644
--- a/kubernetes/apps/home-assistant/ingress.yaml
+++ b/kubernetes/apps/home-assistant/ingress.yaml
@@ -10,7 +10,7 @@ metadata:
     nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
 spec:
-  ingressClassName: nginx
+  ingressClassName: traefik
   rules:
     - host: home.renner.uno
       http:
diff --git a/kubernetes/apps/home-assistant/vscode-ingress.yaml b/kubernetes/apps/home-assistant/vscode-ingress.yaml
index c1abe5b1..c90535db 100644
--- a/kubernetes/apps/home-assistant/vscode-ingress.yaml
+++ b/kubernetes/apps/home-assistant/vscode-ingress.yaml
@@ -9,7 +9,7 @@ metadata:
     nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
     nginx.ingress.kubernetes.io/proxy-buffering: "off"
 spec:
-  ingressClassName: nginx
+  ingressClassName: traefik
   rules:
     - host: vscode.home.renner.uno
       http:
diff --git a/kubernetes/infrastructure/cloudflared/configmap.yaml b/kubernetes/infrastructure/cloudflared/configmap.yaml
index b5df09dd..1079d618 100644
--- a/kubernetes/infrastructure/cloudflared/configmap.yaml
+++ b/kubernetes/infrastructure/cloudflared/configmap.yaml
@@ -22,7 +22,7 @@ data:
           noTLSVerify: true
 
       - hostname: home.renner.uno
-        service: https://ingress-nginx-controller.ingress.svc.cluster.local:443
+        service: https://traefik.ingress.svc.cluster.local:443
         originRequest:
           noTLSVerify: true
 
diff --git a/kubernetes/infrastructure/traefik/helmrelease.yaml b/kubernetes/infrastructure/traefik/helmrelease.yaml
index bc5e61f8..7bacd201 100644
--- a/kubernetes/infrastructure/traefik/helmrelease.yaml
+++ b/kubernetes/infrastructure/traefik/helmrelease.yaml
@@ -75,6 +75,15 @@ spec:
         # against the LAN VIP.
         http3:
           enabled: true
+        transport:
+          respondingTimeouts:
+            # Default is 180s, which cuts long-lived idle WS used by
+            # home-assistant dashboards, vscode (code-server), woodpecker
+            # live log streams, and pve noVNC consoles. Matches the
+            # proxy-read/send-timeout=3600s the nginx ingresses had.
+            readTimeout: "3600s"
+            writeTimeout: "3600s"
+            idleTimeout: "3600s"
     service:
       enabled: true
       spec: