# Public routes. TLS uses Traefik's default certificate, so there is no per-host
# Certificate here.
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: mg4-server
  namespace: mg4
  annotations:
    # CHECK: the class of your public-facing Traefik. Your internal example uses
    # "traefik-internal"; these hosts must be served by the external one.
    kubernetes.io/ingress.class: traefik-external
spec:
  entryPoints:
    - websecure
  routes:
    - kind: Rule
      match: Host(`car.stinnesbeck.com`)
      services:
        - kind: Service
          name: mg4-server
          namespace: mg4
          port: 80
  tls: {}
---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: grafana
  namespace: mg4
  annotations:
    kubernetes.io/ingress.class: traefik-external # CHECK, as above
spec:
  entryPoints:
    - websecure
  routes:
    - kind: Rule
      # CHECK: placeholder host. It must be covered by Traefik's default certificate.
      match: Host(`car-grafana.stinnesbeck.com`)
      services:
        - kind: Service
          name: grafana
          namespace: mg4
          port: 80
  tls: {}