feat(paperless-gpt): add optional traefik ingressroute

charts/paperless-gpt/Chart.yaml

@@ -15,7 +15,7 @@ sources:
   - https://github.com/taskmedia/helm
 icon: https://media.task.media/images/logo.png
 type: application
-version: 0.2.0
+version: 0.3.0
 # upstream image tag without the leading v
 appVersion: "0.29.0"
 
@@ -31,4 +31,4 @@ annotations:
       image: icereed/paperless-gpt:v0.29.0
   artifacthub.io/changes: |
     - kind: added
-      description: Optional ingress (ingress.*) for cert-manager and authenticating proxy integration
+      description: Optional Traefik IngressRoute (ingressRoute.*) with optional cert-manager Certificate

charts/paperless-gpt/README.md

@@ -74,6 +74,29 @@ ingress:
     secretName: paperless-gpt-tls
 ```
 
+## IngressRoute
+
+As an alternative to the `Ingress`, the chart can render a Traefik `IngressRoute` (CRD). Because
+cert-manager's ingress-shim does not handle `IngressRoute`, the chart can also create the
+`Certificate` (example with an authentik forward-auth middleware):
+
+```yaml
+ingressRoute:
+  enabled: true
+  host: gpt.example.com
+  middlewares:
+    - name: proxy
+      namespace: authentik
+  tls:
+    secretName: paperless-gpt-tls
+    certificate:
+      enabled: true
+      issuerRef:
+        name: letsencrypt-prod
+```
+
+Requires the Traefik (and, for the certificate, cert-manager) CRDs in the cluster.
+
 ## Notes
 
 - Runs a single replica with the `Recreate` strategy: state is a local SQLite database.

charts/paperless-gpt/templates/certificate.yaml

@@ -0,0 +1,16 @@
+{{- if and .Values.ingressRoute.enabled .Values.ingressRoute.tls.certificate.enabled }}
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: "{{ include "paperlessgpt.fullname" . }}"
+  labels:
+    {{- include "paperlessgpt.labels" . | nindent 4 }}
+spec:
+  secretName: {{ required "ingressRoute.tls.secretName is required for the certificate" .Values.ingressRoute.tls.secretName }}
+  dnsNames:
+    - {{ required "ingressRoute.host is required" .Values.ingressRoute.host | quote }}
+  issuerRef:
+    name: {{ required "ingressRoute.tls.certificate.issuerRef.name is required" .Values.ingressRoute.tls.certificate.issuerRef.name }}
+    kind: {{ .Values.ingressRoute.tls.certificate.issuerRef.kind }}
+    group: {{ .Values.ingressRoute.tls.certificate.issuerRef.group }}
+{{- end }}

charts/paperless-gpt/templates/ingressroute.yaml

@@ -0,0 +1,30 @@
+{{- if .Values.ingressRoute.enabled }}
+{{- $host := required "ingressRoute.host is required" .Values.ingressRoute.host }}
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: "{{ include "paperlessgpt.fullname" . }}"
+  labels:
+    {{- include "paperlessgpt.labels" . | nindent 4 }}
+  {{- with .Values.ingressRoute.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  entryPoints:
+    {{- toYaml .Values.ingressRoute.entryPoints | nindent 4 }}
+  routes:
+    - match: Host(`{{ $host }}`)
+      kind: Rule
+      {{- with .Values.ingressRoute.middlewares }}
+      middlewares:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      services:
+        - name: "{{ include "paperlessgpt.fullname" . }}"
+          port: {{ .Values.service.port }}
+  {{- with .Values.ingressRoute.tls.secretName }}
+  tls:
+    secretName: {{ . }}
+  {{- end }}
+{{- end }}

charts/paperless-gpt/values.yaml

@@ -93,6 +93,43 @@ ingress:
     # secretName enables TLS for ingress.host (certificate e.g. created by cert-manager)
     secretName: ""
 
+# ingressRoute exposes the service via a Traefik IngressRoute CRD (alternative
+# to ingress). The IngressRoute cannot trigger cert-manager's ingress-shim, so
+# the chart can create the Certificate itself (tls.certificate).
+# paperless-gpt has no built-in authentication: add an authenticating
+# middleware (e.g. authentik forward-auth).
+# Example:
+#   enabled: true
+#   host: gpt.example.com
+#   middlewares:
+#     - name: proxy
+#       namespace: authentik
+#   tls:
+#     secretName: paperless-gpt-tls
+#     certificate:
+#       enabled: true
+#       issuerRef:
+#         name: letsencrypt-prod
+ingressRoute:
+  enabled: false
+  annotations: {}
+  entryPoints:
+    - websecure
+  host: ""
+  # middlewares is a list of Traefik middleware references (name, optional namespace)
+  middlewares: []
+  tls:
+    # secretName enables TLS for ingressRoute.host
+    secretName: ""
+    # certificate creates a cert-manager Certificate for ingressRoute.host
+    # stored in tls.secretName
+    certificate:
+      enabled: false
+      issuerRef:
+        name: ""
+        kind: ClusterIssuer
+        group: cert-manager.io
+
 # runs as non-root; the entrypoint then skips PUID/PGID handling
 podSecurityContext:
   runAsNonRoot: true