# Two audiences, deliberately separated:
#
#   1. bcs.int.7tl-homelab.com  — STAGING. LAN-only (*.int resolves to the internal traefik LB at
#      10.66.15.30) with a real Let's Encrypt cert. This is how the rebuild is reviewed before
#      launch. Safe: it is not reachable from the internet and does not touch the real domain.
#
#   2. www.bluecapstrategies.com / bluecapstrategies.com — PRODUCTION. Listed as routes so the
#      cluster is ready, but deliberately NOT in the tls block yet: the live WordPress site still
#      serves these names and must keep doing so until cutover. Requesting a cert for them is a
#      launch step, not a prerequisite.
#
# TLS: ClusterIssuer is `letsencrypt-prod` (NOTE: not "letsencrypt-production" — an earlier comment
# here had the name wrong). It solves via DNS-01 against Cloudflare, which means a cert can be
# issued BEFORE any DNS points at this cluster. At cutover, add the two production hosts to the
# tls block and let the cert issue first, then move DNS — no insecure window, no HTTP-01
# chicken-and-egg. That requires bluecapstrategies.com to be in the Cloudflare account the
# cert-manager API token can reach; verify that before relying on it.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: bluecap-website
  namespace: bluecap-strategies
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  tls:
    # Staging only, for now. Production hosts join this list at cutover (see header).
    - hosts:
        - bcs.int.7tl-homelab.com
      secretName: bcs-int-tls
  rules:
    - host: bcs.int.7tl-homelab.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: bluecap-website
                port:
                  name: http
    - host: www.bluecapstrategies.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: bluecap-website
                port:
                  name: http
    - host: bluecapstrategies.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: bluecap-website
                port:
                  name: http