From da1043e6f308319f73702208edfc3fa035d628e3 Mon Sep 17 00:00:00 2001
From: Brad Rodgers <brodgers@bluecapstrategies.com>
Date: Fri, 23 Oct 2026 11:56:15 -0400
Subject: [PATCH] k8s: make www canonical; 301 the apex to www

Adds a Traefik redirectRegex middleware and a dedicated apex ingress
that reuses bluecap-website-tls, and drops the apex from the main
ingress rules.
---
 k8s/ingress.yaml | 48 +++++++++++++++++++++++++++++++++++-------------
 1 file changed, 35 insertions(+), 13 deletions(-)

diff --git a/k8s/ingress.yaml b/k8s/ingress.yaml
index 4e0aef8..caead01 100644
--- a/k8s/ingress.yaml
+++ b/k8s/ingress.yaml
@@ -4,17 +4,11 @@
 #      10.66.15.30) with a real Let's Encrypt cert. This is how the rebuild is reviewed before
 #      launch. Safe: it is not reachable from the internet and does not touch the real domain.
 #
-#   2. www.bluecapstrategies.com / bluecapstrategies.com — PRODUCTION. Listed as routes so the
-#      cluster is ready, but deliberately NOT in the tls block yet: the live WordPress site still
-#      serves these names and must keep doing so until cutover. Requesting a cert for them is a
-#      launch step, not a prerequisite.
+#   2. www.bluecapstrategies.com — PRODUCTION (live since 2026-10-23, via Pangolin). The apex
+#      bluecapstrategies.com only 301s to www (separate ingress at the bottom of this file).
 #
-# TLS: ClusterIssuer is `letsencrypt-prod` (NOTE: not "letsencrypt-production" — an earlier comment
-# here had the name wrong). It solves via DNS-01 against Cloudflare, which means a cert can be
-# issued BEFORE any DNS points at this cluster. At cutover, add the two production hosts to the
-# tls block and let the cert issue first, then move DNS — no insecure window, no HTTP-01
-# chicken-and-egg. That requires bluecapstrategies.com to be in the Cloudflare account the
-# cert-manager API token can reach; verify that before relying on it.
+# TLS: ClusterIssuer is `letsencrypt-prod` (NOTE: not "letsencrypt-production"). It solves via
+# DNS-01 against Cloudflare, so certs for these names issue independently of where DNS points.
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -38,9 +32,9 @@ spec:
     # CANNOT be pre-issued; it is obtained on the first request after DNS moves. See
     # docs/launch-checklist.md section 1.1.
     #
-    # Both names are listed because the canonical-host decision (section 1.6) is still open;
-    # holding a cert for each keeps either choice available. The redirect is configured
-    # separately and does not depend on this.
+    # Both names stay on this one cert. www is canonical; the apex is served by the
+    # redirect ingress below, which reuses this secret (no cert-manager annotation there, so
+    # the two ingresses never compete over the Certificate).
     - hosts:
         - www.bluecapstrategies.com
         - bluecapstrategies.com
@@ -66,6 +60,34 @@ spec:
                 name: bluecap-website
                 port:
                   name: http
+---
+# Canonical host is www (2026-10-23). The apex answers only with a permanent redirect to the
+# same path on www, so search engines consolidate on one host.
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: redirect-apex-to-www
+  namespace: bluecap-strategies
+spec:
+  redirectRegex:
+    regex: ^https?://bluecapstrategies\.com/(.*)
+    replacement: https://www.bluecapstrategies.com/${1}
+    permanent: true
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: bluecap-website-apex-redirect
+  namespace: bluecap-strategies
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.middlewares: bluecap-strategies-redirect-apex-to-www@kubernetescrd
+spec:
+  tls:
+    - hosts:
+        - bluecapstrategies.com
+      secretName: bluecap-website-tls
+  rules:
     - host: bluecapstrategies.com
       http:
         paths: