Record deployed Vergabe pilot chart and company sign-in evidence

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

helm/vergabe-demo-company-ingress.yaml

@@ -0,0 +1,116 @@
+# Exact product hostname and isolated company path. Private media stays in Django.
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: vergabe-security
+  namespace: vergabe-demo-company
+spec:
+  chain:
+    middlewares:
+    - name: vergabe-rate-limit
+    - name: vergabe-headers
+    - name: vergabe-canonical-path
+    - name: vergabe-strip-tenant
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: vergabe-rate-limit
+  namespace: vergabe-demo-company
+spec:
+  rateLimit:
+    average: 60
+    period: 1m
+    burst: 20
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: vergabe-headers
+  namespace: vergabe-demo-company
+spec:
+  headers:
+    stsSeconds: 31536000
+    contentTypeNosniff: true
+    frameDeny: true
+    referrerPolicy: same-origin
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: vergabe-canonical-path
+  namespace: vergabe-demo-company
+spec:
+  redirectRegex:
+    regex: ^(https?://vergabe-teilnahme\.coulomb\.social/demo-company)(\?.*)?$
+    replacement: ${1}/${2}
+    permanent: false
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: vergabe-strip-tenant
+  namespace: vergabe-demo-company
+spec:
+  stripPrefix:
+    prefixes:
+    - /demo-company
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: vergabe-https
+  namespace: vergabe-demo-company
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: vergabe-demo-company
+  namespace: vergabe-demo-company
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: 'true'
+    traefik.ingress.kubernetes.io/router.middlewares: vergabe-demo-company-vergabe-security@kubernetescrd
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: vergabe-teilnahme.coulomb.social
+    http:
+      paths:
+      - path: /demo-company
+        pathType: Prefix
+        backend:
+          service:
+            name: vergabe-teilnahme
+            port:
+              number: 80
+  tls:
+  - secretName: vergabe-demo-tls
+    hosts:
+    - vergabe-teilnahme.coulomb.social
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+    traefik.ingress.kubernetes.io/router.middlewares: vergabe-demo-company-vergabe-https@kubernetescrd
+  name: vergabe-demo-company-http
+  namespace: vergabe-demo-company
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: vergabe-teilnahme.coulomb.social
+    http:
+      paths:
+      - backend:
+          service:
+            name: vergabe-teilnahme
+            port:
+              number: 80
+        path: /demo-company
+        pathType: Prefix