# Let's Encrypt's real, publicly-trusted production environment. Switch an
# Ingress to this one only after confirming the same hostname worked
# against letsencrypt-staging (see clusterissuer-staging.yaml) — production
# has much stricter rate limits, and a repeated mistake here can lock you
# out of requesting real certificates for that hostname for a while.
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
  annotations:
    argocd.argoproj.io/sync-wave: "1"
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: certs@ahmza.com
    privateKeySecretRef:
      name: letsencrypt-prod-account-key
    solvers:
      - dns01:
          cloudflare:
            apiTokenSecretRef:
              name: cloudflare-api-token
              key: api-token