# k8s/bootstrap/ingress/riotpiao-com-cert.yaml
# Public wildcard cert for *.riotpiao.com, signed by Let's Encrypt (DNS-01 via
# Cloudflare, see ../cert-manager/letsencrypt-issuer.yaml). Distinct from
# homelab-tls (self-signed homelab-ca, internal *.riotpiao.com) —
# reference riotpiao-com-tls explicitly on ingresses that expose riotpiao.com
# hosts to the internet; it is not nginx's default-ssl-certificate.
#
# issuerRef starts on letsencrypt-staging. Switch to letsencrypt-prod once the
# staging cert issues cleanly, then delete this Certificate's Secret to force
# a re-issue against prod (staging certs aren't browser-trusted).
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: riotpiao-com-tls
  namespace: ingress-nginx
spec:
  secretName: riotpiao-com-tls
  dnsNames:
    - "*.riotpiao.com"
    - "riotpiao.com"
  issuerRef:
    name: letsencrypt-staging
    kind: ClusterIssuer
  duration: 2160h     # 90 days (LE max)
  renewBefore: 720h   # renew 30 days before expiry