23 lines
800 B
YAML
23 lines
800 B
YAML
|
# k8s/ingress/wildcard-cert.yaml
|
||
|
|
# Single wildcard TLS certificate for all *.riotpiao.homelab.com services.
|
||
|
|
# Lives in the ingress-nginx namespace and is set as nginx's default-ssl-certificate,
|
||
|
|
# so every ingress host gets it automatically — no per-service TLS blocks needed.
|
||
|
|
#
|
||
|
|
# Renewal: cert-manager auto-renews 30 days before expiry (renewBefore: 720h).
|
||
|
|
# nginx detects the secret update via its K8s watch and hot-reloads — no pod restart.
|
||
|
|
apiVersion: cert-manager.io/v1
|
||
|
|
kind: Certificate
|
||
|
|
metadata:
|
||
|
|
name: homelab-tls
|
||
|
|
namespace: ingress-nginx
|
||
|
|
spec:
|
||
|
|
secretName: homelab-tls
|
||
|
|
dnsNames:
|
||
|
|
- "*.riotpiao.homelab.com"
|
||
|
|
- "riotpiao.homelab.com"
|
||
|
|
issuerRef:
|
||
|
|
name: homelab-ca
|
||
|
|
kind: ClusterIssuer
|
||
|
|
duration: 8760h # 1 year
|
||
|
|
renewBefore: 720h # renew 30 days before expiry
|