zeekayandHanzo Dev
3ebbca1336
B4: explore-spc.lux.network 404'd — its ingress pointed at explorer-unified:8090 which has no SPC tenant. Add a dedicated explore-fe-spc (SPC chain 36911), mirroring explore-fe-lux; ingress repointed to explore-fe-spc:80. B9: explore-zoo.lux.network served CN=INGRESS DEFAULT CERT (Traefik built-in ACME on the IngressRoute never issued) → ERR_CERT_AUTHORITY_INVALID. Add a standard cert-manager Ingress (letsencrypt-prod) for the host, backend explore-fe-zoo:80, so Traefik serves a real LE cert. Co-authored-by: Hanzo Dev <[email protected]>
34 lines
1.2 KiB
YAML
34 lines
1.2 KiB
YAML
# explore-zoo.lux.network — cert-manager TLS (letsencrypt-prod), mirroring the
|
|
# working explore-hanzo/explore-lux-network standard Ingresses. The pre-existing
|
|
# Traefik IngressRoute (lux-explorer-zoo) used Traefik's built-in ACME
|
|
# (certResolver), which never issued a cert for this host (its path-scoped match
|
|
# didn't serve the HTTP-01 challenge) → Traefik served CN=INGRESS DEFAULT CERT →
|
|
# ERR_CERT_AUTHORITY_INVALID. This standard Ingress routes the same working
|
|
# backend (explore-fe-zoo:80) and lets cert-manager issue a real LE cert that
|
|
# Traefik serves for the SNI. Only explore-zoo.lux.network resolves to this
|
|
# cluster (the .zoo.network/.zoo.ngo aliases are on Cloudflare).
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: explore-zoo
|
|
namespace: lux-mainnet
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
spec:
|
|
ingressClassName: ingress
|
|
tls:
|
|
- hosts:
|
|
- explore-zoo.lux.network
|
|
secretName: explore-zoo-tls
|
|
rules:
|
|
- host: explore-zoo.lux.network
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: explore-fe-zoo
|
|
port:
|
|
number: 80
|