a73x

deploy/server/certificate.yaml

Ref:   Size: 682 B   History 

# The console and the MCP host share one certificate. The gate and sync names
# are deliberately absent: SSH and QUIC carry their own pinned credentials and
# never present a web certificate.
#
# The issuer solves DNS-01 through Cloudflare, so this issues before any route
# answers and regardless of whether the origin is reachable — which is why the
# certificate applies in the same pass as everything else rather than after it.
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: ${TLS_SECRET}
  namespace: ${NAMESPACE}
spec:
  secretName: ${TLS_SECRET}
  dnsNames: [${CONSOLE_HOST}, ${API_HOST}]
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer