Use the traefik-internal ingress class

Both IngressRoutes (server and Grafana) now use traefik-internal, like
the rest of *.k8s.stinnesbeck.com, instead of the traefik-external
placeholder. README and SPECS updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

SPECS.md

@@ -41,8 +41,7 @@ car ──live telemetry───▶ car.k8s.stinnesbeck.com (Go) ──▶ ABRP
 - [x] Car app 2.4.0 (pairing by QR): unit tests pass; **not yet tried on the car**.
 - [x] Image `mg4-server:2.1.0` (with pairing) pushed to git.stinnesbeck.com (public; pinned by
       digest `sha256:e5f6e2d2…` in `k8s/kustomization.yaml`).
-- [ ] Check in `k8s/ingress.yaml`: the Traefik ingress class (placeholder `traefik-external`) and
+- [ ] Check Grafana's host in `k8s/ingress.yaml` (placeholder `car-grafana.k8s.stinnesbeck.com`).
-      Grafana's host (placeholder `car-grafana.k8s.stinnesbeck.com`).
 - [ ] First pairing and drive with 2.4.0: telemetry arrives in InfluxDB, Grafana and ABRP.
 
 ## To do

k8s/README.md

@@ -17,8 +17,8 @@ is applied automatically. Apply them yourself.
 
 ## Before the first apply
 
-1. **Check `ingress.yaml`:** the ingress class (placeholder `traefik-external` for the public
+1. **Check `ingress.yaml`:** Grafana's host (placeholder `car-grafana.k8s.stinnesbeck.com`).
-   Traefik) and Grafana's host (placeholder `car-grafana.k8s.stinnesbeck.com`). Both hosts must be
+   Both routes use the `traefik-internal` class, and both hosts must be
    covered by Traefik's default certificate.
 2. **Create the Secrets.** `cp k8s/secrets.example.yaml k8s/secrets.yaml` (gitignored), replace
    every `CHANGE-ME` there (`openssl rand -hex 32`): `influxdb-auth`, `mg4-server` (ingest token,

k8s/ingress.yaml

@@ -1,14 +1,12 @@
-# Public routes. TLS uses Traefik's default certificate, so there is no per-host
+# Routes on the traefik-internal class, like the rest of *.k8s.stinnesbeck.com. TLS uses
-# Certificate here.
+# Traefik's default certificate, so there is no per-host Certificate here.
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
   name: mg4-server
   namespace: mg4
   annotations:
-    # CHECK: the class of your public-facing Traefik. Your internal example uses
+    kubernetes.io/ingress.class: traefik-internal
-    # "traefik-internal"; these hosts must be served by the external one.
-    kubernetes.io/ingress.class: traefik-external
 spec:
   entryPoints:
     - websecure
@@ -28,7 +26,7 @@ metadata:
   name: grafana
   namespace: mg4
   annotations:
-    kubernetes.io/ingress.class: traefik-external # CHECK, as above
+    kubernetes.io/ingress.class: traefik-internal
 spec:
   entryPoints:
     - websecure