# TLS certificate from cert-manager. cert-manager does not watch Traefik IngressRoutes, so the
# certificate is requested explicitly and the IngressRoute references its Secret.
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: car-stinnesbeck-com
  namespace: mg4
spec:
  secretName: car-stinnesbeck-com-tls
  dnsNames:
    - car.stinnesbeck.com
  issuerRef:
    kind: ClusterIssuer
    name: letsencrypt-prod
---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: mg4-server
  namespace: mg4
  annotations:
    # CHECK: the class of your public-facing Traefik. Your internal example uses
    # "traefik-internal"; this host must be served by the external one.
    kubernetes.io/ingress.class: traefik-external
spec:
  entryPoints:
    - websecure
  routes:
    - kind: Rule
      match: Host(`car.stinnesbeck.com`)
      services:
        - kind: Service
          name: mg4-server
          namespace: mg4
          port: 80
  tls:
    secretName: car-stinnesbeck-com-tls