# Routes requests for demo.ahmza.com through ingress-nginx (docs/11-ingress.md)
# to the demo Service's ClusterIP, on ingress-nginx's one shared address
# (10.10.60.12) instead of this app having its own dedicated MetalLB address.
#
# No ingressClassName is set here because apps/ingress-nginx/values.yaml
# marks its IngressClass as this cluster's default — the same "don't repeat
# yourself" convenience Longhorn gives PVCs that don't name a
# storageClassName.
#
# cert-manager.io/cluster-issuer triggers cert-manager's "ingress-shim": it
# notices this annotation, creates a Certificate resource for the
# hostname(s) in tls.hosts below, and keeps it renewed automatically
# forever. Deliberately pointed at letsencrypt-staging first — see
# docs/12-cert-manager.md for why, and switch to letsencrypt-prod only
# after confirming staging actually works for this hostname.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: demo
  namespace: demo
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-staging
spec:
  tls:
    - hosts:
        - demo.ahmza.com
      # cert-manager creates and keeps this Secret updated automatically —
      # nothing to create by hand, and nothing to encrypt with sops; a TLS
      # certificate isn't a credential you chose, it's issued fresh by
      # Let's Encrypt and safe to regenerate at any time.
      secretName: demo-tls
  rules:
    - host: demo.ahmza.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: demo
                port:
                  number: 80