# Two audiences, deliberately separated:
#
#   1. bcs.int.7tl-homelab.com  — STAGING. LAN-only (*.int resolves to the internal traefik LB at
#      10.66.15.30) with a real Let's Encrypt cert. This is how the rebuild is reviewed before
#      launch. Safe: it is not reachable from the internet and does not touch the real domain.
#
#   2. www.bluecapstrategies.com — PRODUCTION (live since 2026-10-23, via Pangolin). The apex
#      bluecapstrategies.com only 301s to www (separate ingress at the bottom of this file).
#
# TLS: ClusterIssuer is `letsencrypt-prod` (NOTE: not "letsencrypt-production"). It solves via
# DNS-01 against Cloudflare, so certs for these names issue independently of where DNS points.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: bluecap-website
  namespace: bluecap-strategies
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  tls:
    - hosts:
        - bcs.int.7tl-homelab.com
      secretName: bcs-int-tls
    # Production hostnames. This is the INTERNAL hop only: public traffic terminates TLS at the
    # Pangolin VPS, which then proxies to these nodes over https:443 (the pattern every other
    # k3s-backed Pangolin resource uses), so the cluster needs its own valid cert for these names.
    #
    # Safe to issue before cutover and deliberately done so: letsencrypt-prod solves DNS-01 via
    # Cloudflare, which only needs a temporary TXT record in the zone — no A record has to point
    # here, and the live WordPress site is unaffected. Pangolin's own edge cert is HTTP-01 and
    # CANNOT be pre-issued; it is obtained on the first request after DNS moves. See
    # docs/launch-checklist.md section 1.1.
    #
    # Both names stay on this one cert. www is canonical; the apex is served by the
    # redirect ingress below, which reuses this secret (no cert-manager annotation there, so
    # the two ingresses never compete over the Certificate).
    - hosts:
        - www.bluecapstrategies.com
        - bluecapstrategies.com
      secretName: bluecap-website-tls
  rules:
    - host: bcs.int.7tl-homelab.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: bluecap-website
                port:
                  name: http
    - host: www.bluecapstrategies.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: bluecap-website
                port:
                  name: http
---
# Canonical host is www (2026-10-23). The apex answers only with a permanent redirect to the
# same path on www, so search engines consolidate on one host.
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: redirect-apex-to-www
  namespace: bluecap-strategies
spec:
  redirectRegex:
    regex: ^https?://bluecapstrategies\.com/(.*)
    replacement: https://www.bluecapstrategies.com/${1}
    permanent: true
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: bluecap-website-apex-redirect
  namespace: bluecap-strategies
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    traefik.ingress.kubernetes.io/router.middlewares: bluecap-strategies-redirect-apex-to-www@kubernetescrd
spec:
  tls:
    - hosts:
        - bluecapstrategies.com
      secretName: bluecap-website-tls
  rules:
    - host: bluecapstrategies.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: bluecap-website
                port:
                  name: http