zeekayandHanzo Dev
ba5ac4ba1e
It failed the TLS handshake outright, which reads like an outage but was structural: the name is four labels deep and Cloudflare Universal SSL covers only the apex plus one level, so the edge had no certificate to present and never got as far as our ingress. Buying an Advanced Certificate to redirect a www of an already-retired redirect host earns nothing — vote.lux.network is itself just a 301 to lux.vote. Removed the rule, the TLS SAN and the DNS record; one redirect host, no broken handshake. Co-authored-by: Hanzo Dev <[email protected]>
34 lines
1.1 KiB
YAML
34 lines
1.1 KiB
YAML
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: lux-vote
|
|
namespace: hanzo
|
|
labels:
|
|
app.kubernetes.io/managed-by: lux-universe
|
|
app.kubernetes.io/part-of: lux-vote
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
# Permanent redirect vote.lux.network -> lux.vote (retired app). See middleware.yaml.
|
|
# www.vote.lux.network is deliberately absent: it is four labels deep, and
|
|
# Cloudflare Universal SSL covers only the apex + one level, so the edge
|
|
# could never present a cert for it (TLS handshake failure, not a 5xx). A
|
|
# www of an already-retired redirect host earns nothing; one redirect host.
|
|
ingress.kubernetes.io/router.middlewares: hanzo-vote-redirect-luxvote@kubernetescrd
|
|
spec:
|
|
ingressClassName: ingress
|
|
tls:
|
|
- hosts:
|
|
- vote.lux.network
|
|
secretName: lux-vote-tls
|
|
rules:
|
|
- host: vote.lux.network
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: lux-vote
|
|
port:
|
|
number: 80
|