From 2845ded626e443aa8030a37d6f175ef8ae361736 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Tue, 21 Jul 2026 11:10:22 -0700
Subject: [PATCH] fix(ingress): switch riotpiao-com-tls to letsencrypt-prod
 issuer

Wildcard cert was left on letsencrypt-staging; staging root is not
browser-trusted so HTTPS to *.riotpiao.com fails cert validation.
Switch issuerRef to letsencrypt-prod to issue a trusted wildcard.
---
 k8s/bootstrap/ingress/riotpiao-com-cert.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/k8s/bootstrap/ingress/riotpiao-com-cert.yaml b/k8s/bootstrap/ingress/riotpiao-com-cert.yaml
index 66eb48e..4b0fdbd 100644
--- a/k8s/bootstrap/ingress/riotpiao-com-cert.yaml
+++ b/k8s/bootstrap/ingress/riotpiao-com-cert.yaml
@@ -19,7 +19,7 @@ spec:
     - "*.riotpiao.com"
     - "riotpiao.com"
   issuerRef:
-    name: letsencrypt-staging
+    name: letsencrypt-prod
     kind: ClusterIssuer
   duration: 2160h     # 90 days (LE max)
   renewBefore: 720h   # renew 30 days before expiry