---
# Public-ish access to the VPS Vault standby, replacing the old
# "reachable over Netbird only" model with a stable, permanent hostname
# (vault.vps.huskypup.net) that doesn't depend on home being up at all -
# see the vps.huskypup.net subdomain design note in
# infrastructure/vps-standby/cert-manager/manifests/cluster-issuer.yaml.
#
# https-redirect Middleware: found live 2026-08-21 that this Ingress's
# tls: block makes HTTPS available but does NOT stop Traefik from ALSO
# serving plain HTTP on the same host - a browser landing on
# http://vault.vps.huskypup.net (no redirect) gets a Vault UI that
# computes its OIDC callback URL using window.location.origin, i.e.
# http://..., which doesn't match the https:// entry registered in
# allowed_redirect_uris (auth/oidc/role/default) - Vault silently returns
# an empty auth_url ("Missing auth_url" in the UI) rather than an
# obviously-DNS/config-looking error. Applies to every VPS-standby app on
# this same Traefik, not just Vault (same fix needed and applied in each
# of infrastructure/vps-standby/{gitea,n8n,nextcloud,authentik}/manifests/
# ingress.yaml too).
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: https-redirect
  namespace: vault
spec:
  redirectScheme:
    scheme: https
    permanent: true
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: vps-vault
  namespace: vault
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-production
    traefik.ingress.kubernetes.io/router.middlewares: vault-https-redirect@kubernetescrd
spec:
  ingressClassName: traefik
  tls:
    - hosts:
        - vault.vps.huskypup.net
      secretName: vps-vault-tls
  rules:
    - host: vault.vps.huskypup.net
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: vps-vault-ui
                port:
                  number: 8200