Domain redirects

Central place for redirecting entire domains — parked domains, old brands, moved sites. All redirects live in a single values file:

k8s/app/system/domain-redirects/helm/values.yaml

The domain-redirects ArgoCD Application renders the domain-redirects chart (k8s/helm/charts/domain-redirects) into the domain-redirects namespace. The chart is consumed directly from the repo by ArgoCD, so changes take effect on sync without a chart version bump or publish.

Adding a redirect

Add an entry to the redirects list and merge to main. Whole-domain redirect:

redirects:
  - name: oldbrand
    hosts: [oldbrand.nl, www.oldbrand.nl]
    to: https://www.newbrand.nl

An entry groups one set of hosts, no matter how many rules it contains. Certificates are deduplicated automatically across the whole list: each domain is issued exactly once, by the first entry that mentions it. Entries whose hosts are all already covered get no certificate of their own — Traefik picks the right certificate by SNI from the ones already issued.

Entry field	Required	Default	Meaning
name	yes	—	Resource name, unique within the list
hosts	yes	—	Domains to redirect away from (point their DNS at the cluster)
rules	no	—	List of path rules (see below); omit it and set to directly for a whole-domain redirect

Rule fields (also valid directly on the entry when rules is omitted):

Rule field	Required	Default	Meaning
to	yes	—	Target URL, no trailing slash
path	no	—	Path prefix to match (/shop matches /shop and /shop/..., not /shopping); omit for the whole domain
preservePath	no	true	Append the remainder after the matched path (and the query string) to to
permanent	no	true	true = 301, false = 302

Path redirects

Multiple rules on one host group — more specific paths automatically win over the catch-all (Traefik ranks routers by rule length):

redirects:
  - name: legacy-site
    hosts: [legacy.nl, www.legacy.nl]
    rules:
      - path: /shop
        to: https://shop.newbrand.nl
      - to: https://www.newbrand.nl

With preservePath: true, https://legacy.nl/shop/item?x=1 becomes https://shop.newbrand.nl/item?x=1 — the matched prefix is stripped, the remainder and query string carried over.

Path redirects also work on a domain that is served by a live app — the path-specific router outranks the app's catch-all ingress:

redirects:
  - name: oym-oldpage
    hosts: [www.onyourmarks.agency]
    rules:
      - path: /old-page
        to: https://www.onyourmarks.agency/new-page
        preservePath: false

What gets rendered

Each entry renders:

• at most one cert-manager Certificate (Let's Encrypt production) for the hosts no earlier entry already covers, so the redirecting domains serve valid TLS;
• a Traefik redirectRegex Middleware per rule;
• two IngressRoutes (web and websecure) routing to Traefik's built-in noop@internal service — the middleware answers the request, no backend pod involved. Plain-HTTP visitors are redirected straight to the HTTPS target in one hop.

When not to use this

www/non-www canonicalization of a live site stays with the app itself: those hosts are already on the app's ingress, so keep using the shared middlewares (traefik-redirect-to-www / traefik-redirect-to-non-www) in component-traefik-ingress.annotations. This app is for domains whose only job is to redirect somewhere else.