tegwick
3f3ffd279f
Leave port 80 free for cert-manager solvers (forgejo pattern) so ACME challenges are not contended by the app router.
30 lines
1 KiB
YAML
30 lines
1 KiB
YAML
# Ingress for the Railiance rebuild on app.coulomb.social.
|
|
# Apex coulomb.social stays on Bubble until content + self-registration cutover.
|
|
# Requires cert-manager ClusterIssuer and DNS app.coulomb.social → cluster IP.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: coulomb-social
|
|
namespace: coulomb-social
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
# websecure only (forgejo pattern): leave HTTP free for cert-manager HTTP-01
|
|
# solvers. TLS app traffic stays on 443; ACME challenge uses solver ingress on 80.
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
|
spec:
|
|
ingressClassName: traefik
|
|
tls:
|
|
- hosts: [app.coulomb.social]
|
|
secretName: coulomb-social-tls
|
|
rules:
|
|
- host: app.coulomb.social
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: coulomb-social
|
|
port:
|
|
number: 80
|