---
# ClusterIssuer: selfsigned-bootstrap (initial issuer for homelab-ca cert)
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: selfsigned-bootstrap
spec:
  selfSigned: {}

---
# ClusterIssuer: homelab-ca (uses generated homelab-ca cert)
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: homelab-ca
spec:
  ca:
    secretName: homelab-ca-secret

---
# Self-signed CA certificate (10 year lifetime)
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: homelab-ca
  namespace: cert-manager
spec:
  commonName: homelab-ca
  duration: 87600h
  isCA: true
  issuerRef:
    kind: ClusterIssuer
    name: selfsigned-bootstrap
  privateKey:
    algorithm: ECDSA
    size: 256
  renewBefore: 720h
  secretName: homelab-ca-secret

---
# Wildcard TLS certificate for *.riotpiao.homelab.com
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: homelab-tls
  namespace: ingress-nginx
spec:
  commonName: "*.riotpiao.homelab.com"
  dnsNames:
    - "*.riotpiao.homelab.com"
  duration: 2160h
  issuerRef:
    kind: ClusterIssuer
    name: homelab-ca
  renewBefore: 720h
  secretName: homelab-tls

---
# ArgoCD namespace
apiVersion: v1
kind: Namespace
metadata:
  name: argocd
  labels:
    pod-security.kubernetes.io/enforce: baseline
    pod-security.kubernetes.io/enforce-version: latest

---
# dev-tools namespace
apiVersion: v1
kind: Namespace
metadata:
  name: dev-tools
  labels:
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/audit-version: latest
    pod-security.kubernetes.io/enforce: baseline
    pod-security.kubernetes.io/enforce-version: latest
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/warn-version: latest