From 3f3ffd279f255962371a410de4378978528b0feb Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 9 Aug 2026 23:37:08 +0200 Subject: [PATCH] Use websecure-only ingress for coulomb-social HTTP-01 Leave port 80 free for cert-manager solvers (forgejo pattern) so ACME challenges are not contended by the app router. --- manifests/coulomb-social-ingress.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/manifests/coulomb-social-ingress.yaml b/manifests/coulomb-social-ingress.yaml index 9fe3d81..3b9cb46 100644 --- a/manifests/coulomb-social-ingress.yaml +++ b/manifests/coulomb-social-ingress.yaml @@ -8,7 +8,9 @@ metadata: namespace: coulomb-social annotations: cert-manager.io/cluster-issuer: letsencrypt-prod - traefik.ingress.kubernetes.io/router.entrypoints: web,websecure + # websecure only (forgejo pattern): leave HTTP free for cert-manager HTTP-01 + # solvers. TLS app traffic stays on 443; ACME challenge uses solver ingress on 80. + traefik.ingress.kubernetes.io/router.entrypoints: websecure traefik.ingress.kubernetes.io/router.tls: "true" spec: ingressClassName: traefik