universe/k8s/lux-bridge/bridge-ui-envs.yaml

---
###############################################################################
# Per-env Bridge UI (testnet + devnet) — frontend layer.
#
# The bridge FRONTEND (Next.js, ghcr.io/luxfi/bridge-ui) is deployed per env
# pointed at that env's chain. Cross-chain bridging additionally needs a
# per-env BACKEND (bridge-server + MPC cluster + bridge contracts) — those run
# only for mainnet today (bridge-api.lux.network → mainnet MPC mpc.lux.network).
# So testnet/devnet bridge UIs load + connect wallets to the testnet/devnet
# chains, but cross-chain transfers require the per-env backend to be stood up.
#
# Hosts (canonical scheme, matching explorers):
#   bridge.lux-test.network  (testnet)   bridge.lux-dev.network (devnet)
###############################################################################
apiVersion: apps/v1
kind: Deployment
metadata:
  name: bridge-ui-testnet
  namespace: lux-bridge
  labels: { app: bridge-ui-testnet, env: testnet }
spec:
  replicas: 1
  selector:
    matchLabels: { app: bridge-ui-testnet }
  template:
    metadata:
      labels: { app: bridge-ui-testnet, env: testnet }
    spec:
      containers:
      - name: bridge-ui
        image: ghcr.io/luxfi/bridge-ui@sha256:71e0bbe79a37613887748eae2fec3a0c0caae50cded0eec29439a32c12e6f9d4
        imagePullPolicy: IfNotPresent
        ports: [{ containerPort: 3000, name: http }]
        env:
        - { name: NEXT_PUBLIC_NETWORK_NAME, value: "testnet" }
        # Per-env bridge backend not yet deployed — points at mainnet API as a
        # placeholder so the UI renders; cross-chain calls require a testnet
        # bridge-server. TODO: stand up bridge-api.lux-test.network.
        - { name: NEXT_PUBLIC_BRIDGE_API,   value: "https://bridge-api.lux.network" }
        - { name: NEXT_PUBLIC_BACKEND_API,  value: "https://bridge-api.lux.network" }
        - { name: NEXT_PUBLIC_IDENTITY_API, value: "https://bridge-api.lux.network" }
        - { name: NEXT_PUBLIC_EXPLORER_API, value: "https://api-explore.lux-test.network" }
        resources:
          requests: { cpu: "100m", memory: "128Mi" }
          limits:   { cpu: "500m", memory: "512Mi" }
---
apiVersion: v1
kind: Service
metadata:
  name: bridge-ui-testnet
  namespace: lux-bridge
  labels: { app: bridge-ui-testnet }
spec:
  type: ClusterIP
  selector: { app: bridge-ui-testnet }
  ports: [{ name: http, port: 3000, targetPort: http }]
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: bridge-ui-devnet
  namespace: lux-bridge
  labels: { app: bridge-ui-devnet, env: devnet }
spec:
  replicas: 1
  selector:
    matchLabels: { app: bridge-ui-devnet }
  template:
    metadata:
      labels: { app: bridge-ui-devnet, env: devnet }
    spec:
      containers:
      - name: bridge-ui
        image: ghcr.io/luxfi/bridge-ui@sha256:71e0bbe79a37613887748eae2fec3a0c0caae50cded0eec29439a32c12e6f9d4
        imagePullPolicy: IfNotPresent
        ports: [{ containerPort: 3000, name: http }]
        env:
        - { name: NEXT_PUBLIC_NETWORK_NAME, value: "devnet" }
        - { name: NEXT_PUBLIC_BRIDGE_API,   value: "https://bridge-api.lux.network" }
        - { name: NEXT_PUBLIC_BACKEND_API,  value: "https://bridge-api.lux.network" }
        - { name: NEXT_PUBLIC_IDENTITY_API, value: "https://bridge-api.lux.network" }
        - { name: NEXT_PUBLIC_EXPLORER_API, value: "https://api-explore.lux-dev.network" }
        resources:
          requests: { cpu: "100m", memory: "128Mi" }
          limits:   { cpu: "500m", memory: "512Mi" }
---
apiVersion: v1
kind: Service
metadata:
  name: bridge-ui-devnet
  namespace: lux-bridge
  labels: { app: bridge-ui-devnet }
spec:
  type: ClusterIP
  selector: { app: bridge-ui-devnet }
  ports: [{ name: http, port: 3000, targetPort: http }]
---
# TLS. `certResolver: letsencrypt` was a NO-OP here and served every one of
# these four hosts the self-signed "INGRESS DEFAULT CERT" — the lux-system
# hanzo-ingress DaemonSet is started with no --certificatesresolvers.* args at
# all, so the named resolver does not exist. Every host on this cluster that
# actually presents a real certificate gets it from cert-manager. So do these:
# one Certificate per env, referenced by the route's tls.secretName.
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: bridge-testnet-tls
  namespace: lux-bridge
spec:
  secretName: bridge-testnet-tls
  issuerRef: { group: cert-manager.io, kind: ClusterIssuer, name: letsencrypt-prod }
  dnsNames:
  - bridge.lux-test.network
  - bridge-test.lux.network
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: bridge-devnet-tls
  namespace: lux-bridge
spec:
  secretName: bridge-devnet-tls
  issuerRef: { group: cert-manager.io, kind: ClusterIssuer, name: letsencrypt-prod }
  dnsNames:
  - bridge.lux-dev.network
  - bridge-dev.lux.network
---
# Per-env IngressRoutes (separate from the mainnet lux-bridge route).
apiVersion: hanzo.ai/v1alpha1
kind: IngressRoute
metadata:
  name: bridge-testnet
  namespace: lux-bridge
  labels: { app: bridge-ui-testnet }
spec:
  entryPoints: [websecure]
  routes:
  - kind: Rule
    match: Host(`bridge.lux-test.network`) || Host(`bridge-test.lux.network`)
    services:
    - name: bridge-ui-testnet
      port: 3000
  tls:
    secretName: bridge-testnet-tls
---
apiVersion: hanzo.ai/v1alpha1
kind: IngressRoute
metadata:
  name: bridge-devnet
  namespace: lux-bridge
  labels: { app: bridge-ui-devnet }
spec:
  entryPoints: [websecure]
  routes:
  - kind: Rule
    match: Host(`bridge.lux-dev.network`) || Host(`bridge-dev.lux.network`)
    services:
    - name: bridge-ui-devnet
      port: 3000
  tls:
    secretName: bridge-devnet-tls