nixos/manifests/helm/traefik.yaml

apiVersion: "helm.cattle.io/v1"
kind: "HelmChartConfig"
metadata:
  name: "traefik"
  namespace: "kube-system"
spec:
  valuesContent: |-
    additionalArguments:
      - "--entryPoints.postgres.address=:5432/tcp"
      - "--api.dashboard=true"
      - "--api.insecure=true"
      - "--log.level=DEBUG"
      # Access logging: gives per-request visibility (client IP, host,
      # path, bytes, duration) for every ingress route Traefik terminates
      # (git.k3s.thehellings.lan, matrix.k3s.thehellings.lan, immich, etc).
      # This is the layer HAProxy on linode forwards :80 traffic to, so
      # having request-level logs here is essential for tracing bandwidth
      # spikes back to a specific host/path/client rather than just a
      # backend-level byte count.
      - "--accesslog=true"
      - "--accesslog.format=json"
      - "--accesslog.fields.headers.defaultmode=keep"
    ports:
      postgres:
        expose:
          default: true
        port: 5432
        exposedPort: 5432
        protocol: TCP
      traefik:
        expose:
          default: true