How to offload TLS termination to load balancer

[timvdh]

I am trying get the Hetzner load balancer to do the TLS termination and have Traefik use only port 80 in the cluster. I can't get this to work, I typically end up with an unhealthy load balancer. Does someone have a working Traefik configuration from their kube.tf maybe? I append my current (fruitless) attempt.

    traefik_values = <<EOT
deployment:
  replicas: 3
service:
  enabled: true
  type: LoadBalancer
  externalTrafficPolicy: Local
  annotations:
    "load-balancer.hetzner.cloud/name": "k3s"
    "load-balancer.hetzner.cloud/use-private-ip": "true"
    "load-balancer.hetzner.cloud/disable-private-ingress": "true"
    "load-balancer.hetzner.cloud/location": "fsn1"
    "load-balancer.hetzner.cloud/type": "lb11"
    "load-balancer.hetzner.cloud/uses-proxyprotocol": "true"  

entryPoints:
  web:
    address: ":80"
  websecure:
    address: ":443"
    enabled: false

ports:
  web:
    port: 80
    exposedPort: 80
    protocol: TCP
    proxyProtocol:
      trustedIPs:
        - 127.0.0.1/32
        - 10.0.0.0/8
    forwardedHeaders:
      trustedIPs:
        - 127.0.0.1/32
        - 10.0.0.0/8
  EOT