# k8s/bootstrap/cert-manager/homelab-ca-issuer.yaml
# Self-signed internal CA, for services that only need to trust each other
# on the homelab LAN (not exposed to the internet, no public ACME needed).
# Root cert+key live in homelab-ca-secrets.enc.yaml (cert-manager namespace).
# The public cert is separately distributed via homelab-ca-configmap.yaml so
# non-cert-manager pods (Authentik, forgejo-runner, etc.) can trust it too.
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: homelab-ca
spec:
  ca:
    secretName: homelab-ca-keypair