bmr_bluecap
da1043e6f3
Adds a Traefik redirectRegex middleware and a dedicated apex ingress that reuses bluecap-website-tls, and drops the apex from the main ingress rules.
101 lines
3.6 KiB
YAML
101 lines
3.6 KiB
YAML
# Two audiences, deliberately separated:
|
|
#
|
|
# 1. bcs.int.7tl-homelab.com — STAGING. LAN-only (*.int resolves to the internal traefik LB at
|
|
# 10.66.15.30) with a real Let's Encrypt cert. This is how the rebuild is reviewed before
|
|
# launch. Safe: it is not reachable from the internet and does not touch the real domain.
|
|
#
|
|
# 2. www.bluecapstrategies.com — PRODUCTION (live since 2026-10-23, via Pangolin). The apex
|
|
# bluecapstrategies.com only 301s to www (separate ingress at the bottom of this file).
|
|
#
|
|
# TLS: ClusterIssuer is `letsencrypt-prod` (NOTE: not "letsencrypt-production"). It solves via
|
|
# DNS-01 against Cloudflare, so certs for these names issue independently of where DNS points.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: bluecap-website
|
|
namespace: bluecap-strategies
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
spec:
|
|
tls:
|
|
- hosts:
|
|
- bcs.int.7tl-homelab.com
|
|
secretName: bcs-int-tls
|
|
# Production hostnames. This is the INTERNAL hop only: public traffic terminates TLS at the
|
|
# Pangolin VPS, which then proxies to these nodes over https:443 (the pattern every other
|
|
# k3s-backed Pangolin resource uses), so the cluster needs its own valid cert for these names.
|
|
#
|
|
# Safe to issue before cutover and deliberately done so: letsencrypt-prod solves DNS-01 via
|
|
# Cloudflare, which only needs a temporary TXT record in the zone — no A record has to point
|
|
# here, and the live WordPress site is unaffected. Pangolin's own edge cert is HTTP-01 and
|
|
# CANNOT be pre-issued; it is obtained on the first request after DNS moves. See
|
|
# docs/launch-checklist.md section 1.1.
|
|
#
|
|
# Both names stay on this one cert. www is canonical; the apex is served by the
|
|
# redirect ingress below, which reuses this secret (no cert-manager annotation there, so
|
|
# the two ingresses never compete over the Certificate).
|
|
- hosts:
|
|
- www.bluecapstrategies.com
|
|
- bluecapstrategies.com
|
|
secretName: bluecap-website-tls
|
|
rules:
|
|
- host: bcs.int.7tl-homelab.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: bluecap-website
|
|
port:
|
|
name: http
|
|
- host: www.bluecapstrategies.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: bluecap-website
|
|
port:
|
|
name: http
|
|
---
|
|
# Canonical host is www (2026-10-23). The apex answers only with a permanent redirect to the
|
|
# same path on www, so search engines consolidate on one host.
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: redirect-apex-to-www
|
|
namespace: bluecap-strategies
|
|
spec:
|
|
redirectRegex:
|
|
regex: ^https?://bluecapstrategies\.com/(.*)
|
|
replacement: https://www.bluecapstrategies.com/${1}
|
|
permanent: true
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: bluecap-website-apex-redirect
|
|
namespace: bluecap-strategies
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
traefik.ingress.kubernetes.io/router.middlewares: bluecap-strategies-redirect-apex-to-www@kubernetescrd
|
|
spec:
|
|
tls:
|
|
- hosts:
|
|
- bluecapstrategies.com
|
|
secretName: bluecap-website-tls
|
|
rules:
|
|
- host: bluecapstrategies.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: bluecap-website
|
|
port:
|
|
name: http
|