# ========== 5. Ingress 配置 ==========
# 使用 cert-manager 自动管理 Let's Encrypt 证书
# 如未安装 cert-manager: kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.14.0/cert-manager.yaml
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: authentik
  namespace: auth
  annotations:
    kubernetes.io/ingress.class: "nginx"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    nginx.ingress.kubernetes.io/proxy-body-size: "50m"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
spec:
  tls:
    - hosts:
        - auth.violin-work.online
      secretName: authentik-tls
  rules:
    - host: auth.violin-work.online
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: authentik-server
                port:
                  number: 80

---
# 如果没有 cert-manager，用这个 ClusterIssuer（先安装 cert-manager）
# apiVersion: cert-manager.io/v1
# kind: ClusterIssuer
# metadata:
#   name: letsencrypt-prod
# spec:
#   acme:
#     server: https://acme-v02.api.letsencrypt.org/directory
#     email: YOUR_EMAIL@domain.com   # ⚠️ 改成你的邮箱
#     privateKeySecretRef:
#       name: letsencrypt-prod
#     solvers:
#       - http01:
#           ingress:
#             class: nginx