# infrastructure/traefik/traefik-service-lan.yaml
apiVersion: v1
kind: Service
metadata:
  name: traefik-lan
  namespace: traefik
  annotations:
    metallb.universe.tf/address-pool: lan-ai-pool
spec:
  type: LoadBalancer
  loadBalancerClass: metallb
  loadBalancerIP: 192.168.22.50
  # The shared public Service masks source addresses. Keep the LAN path
  # separate so ingress allowlists see the actual client, not a node IP.
  externalTrafficPolicy: Local
  loadBalancerSourceRanges:
    - 192.168.22.0/24
  ports:
    - name: websecure
      port: 443
      targetPort: websecure
      protocol: TCP
  selector:
    app: traefik