Add cert-manager with Cloudflare DNS-01 ClusterIssuers

apps/demo/ingress.yaml

@@ -7,14 +7,28 @@
 # yourself" convenience Longhorn gives PVCs that don't name a
 # storageClassName.
 #
-# No TLS yet — see docs/12-cert-manager.md for adding a real HTTPS
-# certificate for this exact hostname.
+# cert-manager.io/cluster-issuer triggers cert-manager's "ingress-shim": it
+# notices this annotation, creates a Certificate resource for the
+# hostname(s) in tls.hosts below, and keeps it renewed automatically
+# forever. Deliberately pointed at letsencrypt-staging first — see
+# docs/12-cert-manager.md for why, and switch to letsencrypt-prod only
+# after confirming staging actually works for this hostname.
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: demo
   namespace: demo
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-staging
 spec:
+  tls:
+    - hosts:
+        - demo.ahmza.com
+      # cert-manager creates and keeps this Secret updated automatically —
+      # nothing to create by hand, and nothing to encrypt with sops; a TLS
+      # certificate isn't a credential you chose, it's issued fresh by
+      # Let's Encrypt and safe to regenerate at any time.
+      secretName: demo-tls
   rules:
     - host: demo.ahmza.com
       http: