# HTTP -> HTTPS redirect for decisions.coulomb.social.
#
# manifests/informed-decision-ingress.yaml is websecure-only (forgejo pattern),
# which leaves port 80 unrouted for this host: plain http:// returned Traefik's
# default 404 rather than redirecting. This adds the redirect, following the
# reuse-surface pattern (reuse/reuse-surface-http-redirect + a redirectScheme
# Middleware).
#
# ROUTER PRIORITY IS LOAD-BEARING. cert-manager solves HTTP-01 by creating a
# temporary solver Ingress on this same host and this same `web` entrypoint,
# serving /.well-known/acme-challenge/<token>. A catch-all `/` redirect on the
# same entrypoint competes with it. Traefik would normally resolve that by rule
# length -- the solver's Path rule is far longer than PathPrefix(`/`) -- but
# reuse-surface reported on 2026-07-07 that relying on implicit precedence is
# exactly how a specific rule ends up swallowed by a catch-all, and there the
# symptom was a 404 someone noticed. Here the symptom would be a silently failed
# renewal roughly 60 days out, i.e. an expired certificate on the origin backing
# an OIDC redirect URI.
#
# So priority is pinned explicitly and low. Traefik gives the highest-priority
# matching router the request; any cert-manager solver (which uses the default
# computed priority, an order of magnitude larger) outbids this one. Verified by
# probe on 2026-09-10 -- see docs/informed-decision-origin.md.
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: informed-decision-redirect-https
  namespace: informed-decision
  labels:
    app.kubernetes.io/name: informed-decision
    app.kubernetes.io/component: redirect
spec:
  redirectScheme:
    scheme: https
    permanent: true
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: informed-decision-http-redirect
  namespace: informed-decision
  labels:
    app.kubernetes.io/name: informed-decision
    app.kubernetes.io/component: redirect
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: web
    traefik.ingress.kubernetes.io/router.middlewares: informed-decision-informed-decision-redirect-https@kubernetescrd
    # Deliberately low: ACME solver routers must win on this entrypoint.
    traefik.ingress.kubernetes.io/router.priority: "1"
spec:
  ingressClassName: traefik
  rules:
    - host: decisions.coulomb.social
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: informed-decision
                port:
                  number: 80