# k8s/bootstrap/ingress/riotpiao-com-cert.yaml
# Public wildcard cert for *.riotpiao.com, signed by Let's Encrypt (DNS-01 via
# Cloudflare, see ../cert-manager/letsencrypt-issuer.yaml).
#
# nginx serves this secret as its default-ssl-certificate
# (../ingress/nginx-values.yaml), so every Ingress that omits a tls: block uses
# it. Do not add per-host tls: blocks for *.riotpiao.com hosts: they create a
# second, single-host certificate and split the wildcard coverage.
#
# Renewal is automatic and does not drop traffic:
#   - cert-manager starts a new order 30 days before expiry (renewBefore).
#   - cert-manager writes the renewed pair into the same secret.
#   - ingress-nginx watches the secret and hot-reloads. No pod restart.
#   - The old pair stays valid until the new one is written, so no gap exists.
#
# The DNS-01 self-check must reach the public resolvers directly. Without the
# --dns01-recursive-nameservers flags in ../../cert-manager/cert-manager-values.yaml
# the self-check never sees the TXT record and renewal stalls until expiry.
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: riotpiao-com-tls
  namespace: ingress-nginx
spec:
  secretName: riotpiao-com-tls
  dnsNames:
    - "*.riotpiao.com"
    - "riotpiao.com"
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  duration: 2160h     # 90 days (LE max)
  renewBefore: 720h   # renew 30 days before expiry