# k8s/bootstrap/cert-manager/letsencrypt-issuer.yaml
# Let's Encrypt ClusterIssuers for *.riotpiao.com, DNS-01 via Cloudflare
# (wildcard certs require DNS-01 — HTTP-01 can't prove ownership of a wildcard name).
#
# Prereq (apply manually, not in git — token is a secret):
#   kubectl create secret generic cloudflare-api-token-secret \
#     --namespace cert-manager \
#     --from-literal=api-token=<CLOUDFLARE_API_TOKEN>
# Token scope: Zone:DNS:Edit for the riotpiao.com zone.
#
# Start with letsencrypt-staging to validate the solver, then point
# Certificate.issuerRef at letsencrypt-prod once staging issues cleanly.
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: locartrock@gmail.com
    privateKeySecretRef:
      name: letsencrypt-staging-account-key
    solvers:
      - dns01:
          cloudflare:
            apiTokenSecretRef:
              name: cloudflare-api-token-secret
              key: api-token
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: locartrock@gmail.com
    privateKeySecretRef:
      name: letsencrypt-prod-account-key
    solvers:
      - dns01:
          cloudflare:
            apiTokenSecretRef:
              name: cloudflare-api-token-secret
              key: api-token