baremetal.yaml

# ── Bare-metal k3s — DaemonSet + hostPorts ────────────────────────────────────
# Traffic arrives directly on each node's port 80/443. No load balancer needed.
# Real client IP is preserved natively.
#
# TLS is configured per Ingress via spec.tls — see cert-manager.yaml for how to
# provision certificates, or certmagic.yaml for CertMagic-based issuance.
#
# Usage:
#   helm install caddy ingress-caddy/caddy -n caddy --create-namespace -f baremetal.yaml

k8sIngress:
  ingressClass: caddy

workloadType: DaemonSet
hostPorts:
  enabled: true
  http: 80
  https: 443

# ── Config hot-reload ─────────────────────────────────────────────────────────
# Built-in — no Stakater Reloader needed. Watches the Caddyfile ConfigMap and
# calls POST /load on Caddy's admin API when it changes. Zero pod restarts.

configReloader:
  enabled: true

# ── Real IP ───────────────────────────────────────────────────────────────────

realIP:
  trustedProxies:
    - 10.42.0.0/16   # k3s default pod CIDR
    - 127.0.0.1/32