extraDeploy:
  - apiVersion: traefik.io/v1alpha1
    # https://doc.traefik.io/traefik/v3.1/routing/providers/kubernetes-crd/#kind-ingressroute
    kind: IngressRoute
    metadata:
      name: forgejo-crawler
      annotations:
        kubernetes.io/ingress.class: traefik
    spec:
      entryPoints:
        - web
        - websecure
      routes:
        # https://doc.traefik.io/traefik/v3.1/routing/routers/#rule
        - match: Host(`next.forgejo.org`) && HeaderRegexp(`user-agent`, `DataForSeoBot`)
          kind: Rule
          priority: 1000
          services:
            - name: noop@internal
              kind: TraefikService
          middlewares:
            - name: forgejo-crawler-blocker
      tls:
        secretName: tls-forgejo-next-ingress-http
  - apiVersion: traefik.io/v1alpha1
    kind: Middleware
    metadata:
      name: forgejo-crawler-blocker
    spec:
      ipAllowList:
        sourceRange:
          - 127.0.0.1/32