From 94420fb7102f713f7c1a518253e8bb363c4b2541 Mon Sep 17 00:00:00 2001
From: Timo Behrendt <t.behrendt@t00n.de>
Date: Sun, 28 Dec 2025 09:48:46 +0100
Subject: [PATCH] adjust cicd

---
 .gitea/workflows/deploy.yaml | 81 ++++++++++++++++++++++++++++++++++++
 1 file changed, 81 insertions(+)

diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml
index 0de5a1b..6d25707 100644
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@@ -11,6 +11,8 @@ jobs:
     outputs:
       node-labels: ${{ steps.filter.outputs.node-labels }}
       coredns: ${{ steps.filter.outputs.coredns }}
+      traefik: ${{ steps.filter.outputs.traefik }}
+      crowdsec: ${{ steps.filter.outputs.crowdsec }}
     steps:
       - uses: actions/checkout@v5
         with:
@@ -23,6 +25,10 @@ jobs:
               - 'node-labels/**'
             coredns:
               - 'coredns/**'
+            traefik:
+              - 'traefik/**'
+            crowdsec:
+              - 'crowdsec/**'
 
   deploy-node-labels:
     runs-on: ubuntu-latest
@@ -56,3 +62,78 @@ jobs:
       - name: Restart coredns
         run: |
           kubectl -n kube-system rollout restart deployment coredns
+
+  deploy-traefik:
+    runs-on: ubuntu-latest
+    needs: check-changes
+    if: ${{ needs.check-changes.outputs.traefik == 'true' }}
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: azure/setup-kubectl@776406bce94f63e41d621b960d78ee25c8b76ede # v4
+      - uses: azure/k8s-set-context@ae59a723ba9abe7a9655538854a025448dbab4aa # v4
+        with:
+          method: kubeconfig
+          kubeconfig: ${{ secrets.KUBECONFIG }}
+      - name: Set ionos api credentials
+        uses: azure/k8s-create-secret@6e0ba8047235646753f2a3a3b359b4d0006ff218 # v5
+        with:
+          namespace: kube-system
+          secret-name: ionos-api-credentials
+          secret-type: generic
+          data: |
+            {
+              "apiKey": "${{ secrets.IONOS_API_KEY }}"
+            }
+      - name: Set admin basic auth credentials
+        uses: azure/k8s-create-secret@6e0ba8047235646753f2a3a3b359b4d0006ff218 # v5
+        with:
+          namespace: kube-system
+          secret-name: admin-basic-auth-credentials
+          secret-type: generic
+          data: |
+            {
+              "username": "bmV0YWRtaW4=",
+              "password": "${{ secrets.ADMIN_BASIC_AUTH_PASSWORD }}"
+            }
+      - name: Set crowdsec bouncer api key
+        uses: azure/k8s-create-secret@6e0ba8047235646753f2a3a3b359b4d0006ff218 # v5
+        with:
+          namespace: kube-system
+          secret-name: crowdsec-bouncer-api-key
+          secret-type: generic
+          data: |
+            {
+              "api-key": "${{ secrets.CROWDSEC_BOUNCER_API_KEY }}"
+            }
+      - name: Deploy
+        uses: azure/k8s-deploy@6f7c489cecd8da05646259d9fa3daae92e095c7b # v5.0.4
+        with:
+          action: deploy
+          manifests: "traefik/"
+          strategy: basic
+          namespace: kube-system
+
+  deploy-crowdsec:
+    runs-on: ubuntu-latest
+    needs: check-changes
+    if: ${{ needs.check-changes.outputs.crowdsec == 'true' }}
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: https://gitea.t000-n.de/t.behrendt/k_deploy_workflows/.gitea/actions/extract-namespace-from-repo-name@v0
+        id: namespace
+        with:
+          repo: ${{ github.repository }}
+      - uses: azure/setup-kubectl@776406bce94f63e41d621b960d78ee25c8b76ede # v4
+      - uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
+        with:
+          version: "3.15.0"
+      - uses: azure/k8s-set-context@ae59a723ba9abe7a9655538854a025448dbab4aa # v4
+        with:
+          method: kubeconfig
+          kubeconfig: ${{ secrets.KUBECONFIG }}
+      - name: Deploy helm
+        uses: helmfile/helmfile-action@f64d5db9f8660aae0205b5fcfc56577d44acefab # v2.1.0
+        with:
+          helmfile-args: apply
+          helm-plugins: https://github.com/databus23/helm-diff@v3.12.0
+          helmfile-workdirectory: "crowdsec"