devops: migrate from nginx-ingress to Traefik

[mxschmitt]

Summary

• Delete custom nginx-ingress manifest (642 lines)
• Switch ingress to use k3s built-in Traefik
• Remove --disable traefik from k3s install

Background

Why nginx-ingress was added (March 2021, #173):

• At the time, bare-metal k3s deployments commonly used nginx-ingress
• Used hostNetwork: true to bind nginx directly to host ports 80/443
• Traefik (k3s default) was less mature and nginx was more familiar

Why this became a problem:

• hostNetwork: true exposes ALL container ports to the host, including port 8443 (admission webhook)
• BSI (German Federal Office for Information Security) flagged exposed port 8443 as a security risk
• CVE-2025-1974 "IngressNightmare" allows unauthenticated RCE via exposed admission webhooks
• While we updated to patched nginx v1.14.1 (security: update Ingress-NGINX to v1.14.1 to fix CVE-2025-1974 #294), the webhook should never be internet-accessible

Why Traefik is better now:

• Built into k3s, no custom manifest to maintain
• Auto-updates with k3s upgrades
• Doesn't expose admission webhooks externally
• Traefik v3 (in k3s 1.32+) is mature and feature-complete

Deployment notes

On the production server:

# Remove old nginx-ingress resources
kubectl delete namespace ingress-nginx

# Apply updated manifests
kubectl apply -f k8/

Traefik is already running (k3s default) and will pick up the ingress.

🤖 Generated with Claude Code