---
# Public-ish access to the VPS Vault standby, replacing the old
# "reachable over Netbird only" model with a stable, permanent hostname
# (vault.vps.huskypup.net) that doesn't depend on home being up at all -
# see the vps.huskypup.net subdomain design note in
# infrastructure/vps-standby/cert-manager/manifests/cluster-issuer.yaml.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: vps-vault
  namespace: vault
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-production
spec:
  ingressClassName: traefik
  tls:
    - hosts:
        - vault.vps.huskypup.net
      secretName: vps-vault-tls
  rules:
    - host: vault.vps.huskypup.net
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: vps-vault-ui
                port:
                  number: 8200