refactor(k8s): Reorganize into 5-layer structure with production kustomizations

2026-08-18 15:08:01 -07:00
parent 563f720d09
commit 0f30d77288
214 changed files with 405 additions and 885 deletions
@@ -0,0 +1,22 @@
+# k8s/ingress/wildcard-cert.yaml
+# Single wildcard TLS certificate for all *.riotpiao.homelab.com services.
+# Lives in the ingress-nginx namespace and is set as nginx's default-ssl-certificate,
+# so every ingress host gets it automatically — no per-service TLS blocks needed.
+#
+# Renewal: cert-manager auto-renews 30 days before expiry (renewBefore: 720h).
+# nginx detects the secret update via its K8s watch and hot-reloads — no pod restart.
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: homelab-tls
+  namespace: ingress-nginx
+spec:
+  secretName: homelab-tls
+  dnsNames:
+    - "*.riotpiao.homelab.com"
+    - "riotpiao.homelab.com"
+  issuerRef:
+    name: homelab-ca
+    kind: ClusterIssuer
+  duration: 8760h      # 1 year
+  renewBefore: 720h    # renew 30 days before expiry