feat(ingress): Traefik ingress to revproxy for web UI; ClusterIP revproxy in k3s example

Made-with: Cursor

gitops/values/k3s-example.yaml

@@ -23,7 +23,8 @@ postgresql:
     password: "DBPasswordPlaceholder"
 
 onelab:
-  domain: "https://localhost"
+  # Match how users reach the UI (Ingress host); use https:// when ingress.tls is true.
+  domain: "http://onelab.local"
   secrets:
     authTokenKey: "TokenAuthPlaceholder"
     monitoringToken: "TokenMonitoringPlaceholder"
@@ -32,6 +33,18 @@ onelab:
     appid: "zxvgsagz"
     secret: "QUw2jEV8utIpe9DeYjOqBjhBY9VxjXddKUCISUNu"
 
+# ClusterIP keeps traffic via Ingress only; use NodePort instead if you need direct node:port access.
 revproxy:
-  serviceType: NodePort
-  nodePort: 30080
+  serviceType: ClusterIP
+
+ingress:
+  enabled: true
+  className: traefik
+  # Set DNS or /etc/hosts to this host pointing at your ingress (e.g. worker external IP or LB).
+  host: onelab.local
+  path: /
+  pathType: Prefix
+  annotations: {}
+  tls: false
+  # tls: true
+  # tlsSecretName: onelab-tls   # create with cert-manager or kubectl