From d8204c85725ab0231db7cf938a23a262819ff90a Mon Sep 17 00:00:00 2001
From: zyc <1439655764@qq.com>
Date: Mon, 13 Apr 2026 14:50:06 +0800
Subject: [PATCH] =?UTF-8?q?feat:=20HTTP=E2=86=92HTTPS=20=E8=87=AA=E5=8A=A8?=
 =?UTF-8?q?=E8=B7=B3=E8=BD=AC?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 新增 redirect-https-middleware.yaml（Traefik Middleware）
- Ingress 加 traefik.ingress.kubernetes.io/router.middlewares annotation
- CI 流水线在 Ingress 之前 apply middleware

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .gitea/workflows/deploy.yaml       | 1 +
 k8s/backend-ingress.yaml           | 1 +
 k8s/redirect-https-middleware.yaml | 8 ++++++++
 k8s/web-ingress.yaml               | 1 +
 4 files changed, 11 insertions(+)
 create mode 100644 k8s/redirect-https-middleware.yaml

diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml
index 4f97449..ecca690 100644
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@@ -112,6 +112,7 @@ jobs:
                 --dry-run=client -o yaml | kubectl apply -f -
 
               kubectl apply -f k8s/cert-manager-issuer.yaml
+              kubectl apply -f k8s/redirect-https-middleware.yaml
               kubectl apply -f k8s/backend-deployment.yaml
               kubectl apply -f k8s/backend-ingress.yaml
               kubectl apply -f k8s/web-deployment.yaml
diff --git a/k8s/backend-ingress.yaml b/k8s/backend-ingress.yaml
index f252591..b14d8a9 100644
--- a/k8s/backend-ingress.yaml
+++ b/k8s/backend-ingress.yaml
@@ -5,6 +5,7 @@ metadata:
   annotations:
     kubernetes.io/ingress.class: "traefik"
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    traefik.ingress.kubernetes.io/router.middlewares: "default-redirect-https@kubernetescrd"
 spec:
   tls:
   - hosts:
diff --git a/k8s/redirect-https-middleware.yaml b/k8s/redirect-https-middleware.yaml
new file mode 100644
index 0000000..e5eedb9
--- /dev/null
+++ b/k8s/redirect-https-middleware.yaml
@@ -0,0 +1,8 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: redirect-https
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true
diff --git a/k8s/web-ingress.yaml b/k8s/web-ingress.yaml
index 0b7436b..b91fa67 100644
--- a/k8s/web-ingress.yaml
+++ b/k8s/web-ingress.yaml
@@ -5,6 +5,7 @@ metadata:
   annotations:
     kubernetes.io/ingress.class: "traefik"
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    traefik.ingress.kubernetes.io/router.middlewares: "default-redirect-https@kubernetescrd"
 spec:
   tls:
   - hosts: