zeekayandHanzo Dev
774f93e998
exchange/markets on lux-dev and lux-test, and the mpc-api hosts, all served Traefik's self-signed default and were unreachable over HTTPS (curl 000) while their backends ran. lux-devnet/lux-exchange was 2/2 the whole time, serving traffic nobody could reach. Root cause: their IngressRoutes ask for `certResolver: letsencrypt`, and that resolver does not exist. hanzo-ingress carries NO --certificatesresolvers.* argument at all -- TLS issuance was migrated to cert-manager (88 Certificates on this cluster) and the certResolver lines are un-migrated residue. Traefik cannot resolve a named resolver that was never configured, so it falls back to its default certificate. That the resolver's absence is deliberate, not decay, is worth stating: acme.json is frozen at 2026-07-14 and CF_API_* env linger from the old DNS-01 setup. Every host that WORKS today is covered by a cert-manager Certificate and renews normally -- I checked before concluding otherwise. Proof it was only ever the missing Certificate: each issued in ~100 seconds. ACME validation was never the problem. mpc-api is a SEPARATE route, not a tls change on lux-mpc, because that route matches six hosts on one tls block and three of them already work with their own Certificates. A single secretName there would have served all six from a cert covering only the mpc-api names. Verified after: devnet trio 200 with a real cert; mpc-api.lux/pars 200; mpc.lux.network unchanged at 200 with its own cert. The testnet trio now presents a valid cert and returns 503 -- its backend is scaled 0/0, which is a separate decision, but TLS is no longer the blocker. mpc-api.zoo.network is untouched: its DNS points at the ZOO load balancer, and zoo-k8s has zoo-mpc/mpc-node 5/5 but no Ingress or IngressRoute for mpc at all. That is a routing question, not a certificate one. Co-authored-by: Hanzo Dev <[email protected]>
28 lines
1.0 KiB
YAML
28 lines
1.0 KiB
YAML
###############################################################################
|
|
# IngressRoute: devnet hosts — canonical scheme matching the live explorers
|
|
# <svc>.lux-dev.network + <svc>-dev.lux.network
|
|
# (DNS exchange.lux-dev.network already A->LB; exchange-dev.lux.network added)
|
|
###############################################################################
|
|
apiVersion: hanzo.ai/v1alpha1
|
|
kind: IngressRoute
|
|
metadata:
|
|
name: exchange
|
|
labels:
|
|
app: exchange
|
|
spec:
|
|
entryPoints:
|
|
- websecure
|
|
routes:
|
|
- kind: Rule
|
|
match: Host(`exchange.lux-dev.network`) || Host(`exchange-dev.lux.network`) || Host(`markets.lux-dev.network`)
|
|
middlewares:
|
|
- name: exchange-security-headers
|
|
services:
|
|
- name: exchange
|
|
port: 3000
|
|
# secretName, NOT certResolver: issuance moved to cert-manager and the
|
|
# letsencrypt resolver no longer exists in hanzo-ingress. Leaving the old
|
|
# line here is what made these hosts serve INGRESS DEFAULT CERT.
|
|
tls:
|
|
secretName: exchange-devnet-tls
|