feat(tls): migrate public ingress TLS from Traefik ACME to cert-manager

All prod IngressRoutes switch tls.certResolver to tls.secretName backed by per-router Certificates (HTTP-01, letsencrypt-prod). adguard-prod reuses the shared adguard-certs secret (also feeds DoT :853); sync CronJob removed as redundant. Traefik certificatesResolvers removed: its internal acme-http@internal router hijacks HTTP-01 for every host while enabled, blocking external solvers. Dormant files (kener, downtify) converted for consistency but not applied; n8n untouched per live-only rule.
2026-09-23 14:12:36 +02:00
1 parent aa81f1bf8a
commit ef325cd3b1
@@ -1,92 +0,0 @@
-# Least-privilege RBAC for the adguard TLS cert sync CronJob (see cert-sync.yaml).
-#
-# The job runs as ServiceAccount `adguard-cert-sync` (namespace adguard) and needs:
-#   * namespace traefik: list/get pods (locate the running Traefik pod by label)
-#     and create pods/exec (read-only `cat` of /data/letsencrypt/acme.json).
-#     It never writes anything in namespace traefik.
-#   * namespace adguard: get/update/patch Secret `adguard-certs` (the only
-#     secret it may touch) and get/list/watch/patch Deployment
-#     `adguard-deployment` (`rollout restart` issues a patch,
-#     `rollout status` needs list+watch).
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: adguard-cert-sync
-  namespace: adguard
-  labels:
-    app: adguard
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: adguard-cert-sync
-  namespace: adguard
-  labels:
-    app: adguard
-rules:
-  - apiGroups: [""]
-    resources: ["secrets"]
-    resourceNames: ["adguard-certs"]
-    verbs: ["get", "update", "patch"]
-  - apiGroups: ["apps"]
-    resources: ["deployments"]
-    resourceNames: ["adguard-deployment"]
-    verbs: ["get", "patch"]
-  # NOTE: list/watch cannot be combined with resourceNames (the API ignores
-  # the name filter for collection verbs, so the grant would be void).
-  # This rule is namespace-scoped to adguard, which holds a single
-  # Deployment; `rollout status` needs it to watch the rollout.
-  - apiGroups: ["apps"]
-    resources: ["deployments"]
-    verbs: ["list", "watch"]
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: adguard-cert-sync
-  namespace: adguard
-  labels:
-    app: adguard
-subjects:
-  - kind: ServiceAccount
-    name: adguard-cert-sync
-    namespace: adguard
-roleRef:
-  kind: Role
-  name: adguard-cert-sync
-  apiGroup: rbac.authorization.k8s.io
---
-# Read-only access to the Traefik pod (acme.json lives on its /data volume).
-# The RoleBinding references a ServiceAccount from namespace adguard,
-# which is allowed: the binding lives in namespace traefik and only
-# grants rights inside namespace traefik.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: adguard-cert-sync
-  namespace: traefik
-  labels:
-    app: adguard
-rules:
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["get", "list"]
-  - apiGroups: [""]
-    resources: ["pods/exec"]
-    verbs: ["create"]
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: adguard-cert-sync
-  namespace: traefik
-  labels:
-    app: adguard
-subjects:
-  - kind: ServiceAccount
-    name: adguard-cert-sync
-    namespace: adguard
-roleRef:
-  kind: Role
-  name: adguard-cert-sync
-  apiGroup: rbac.authorization.k8s.io
@@ -1,135 +0,0 @@
-# AdGuard TLS cert sync: copy Traefik's public certificate for dns.forust.xyz
-# (used by DNS-over-TLS on :853) from Traefik's acme.json into Secret
-# `adguard-certs`, restarting the AdGuard Deployment only when it changed.
-#
-# Why this exists: cert-manager Certificate objects cannot be used here.
-# Traefik's acme-http@internal router hijacks every HTTP-01 challenge path,
-# so the prod ClusterIssuer can never complete an order for this host.
-# Traefik itself keeps renewing the cert via its own ACME stack; this job
-# mirrors the resulting public cert/key into the secret AdGuard mounts.
-#
-# Safety properties (all enforced by the script, not by convention):
-#   * selects the PROD resolver entry only (`.letsencrypt`), never staging;
-#   * matches by main domain OR SAN list (Traefik stores the bundled cert
-#     under the router's first domain, e.g. adguard.forust.xyz);
-#   * compares sha256 hashes and patches the Secret ONLY on change;
-#   * restarts the Deployment ONLY when the Secret was patched;
-#   * exits non-zero and touches nothing when Traefik has no cert yet,
-#     when the Secret is missing, or when the payload fails PEM checks.
-#
-# Manual apply:
-#   kubectl apply -f adguardhome/k8s/cert-sync-rbac.yaml
-#   kubectl apply -f adguardhome/k8s/cert-sync.yaml
-# Force a run (safe: idempotent, read-only when already in sync):
-#   kubectl create job -n adguard --from=cronjob/adguard-cert-sync sync-now
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: adguard-cert-sync
-  namespace: adguard
-  labels:
-    app: adguard
-spec:
-  schedule: "17 3 * * *"
-  concurrencyPolicy: Forbid
-  successfulJobsHistoryLimit: 2
-  failedJobsHistoryLimit: 3
-  jobTemplate:
-    spec:
-      activeDeadlineSeconds: 300
-      template:
-        metadata:
-          labels:
-            app: adguard
-        spec:
-          serviceAccountName: adguard-cert-sync
-          restartPolicy: OnFailure
-          containers:
-            - name: cert-sync
-              image: dtzar/helm-kubectl:3.19.1
-              imagePullPolicy: IfNotPresent
-              resources:
-                requests:
-                  cpu: "50m"
-                  memory: "64Mi"
-                limits:
-                  cpu: "200m"
-                  memory: "256Mi"
-              env:
-                - name: SYNC_DOMAIN
-                  value: "dns.forust.xyz"
-                - name: SYNC_RESOLVER
-                  value: "letsencrypt"
-              command:
-                - /bin/sh
-                - -c
-                - |
-                  set -eu
-                  DOMAIN="${SYNC_DOMAIN:?}"
-                  RESOLVER="${SYNC_RESOLVER:?}"
-                  NS="adguard"
-                  SECRET="adguard-certs"
-                  DEPLOY="adguard-deployment"
-
-                  echo "== 1. locate running traefik pod =="
-                  POD="$(kubectl get pods -n traefik -l app.kubernetes.io/name=traefik \
-                    --field-selector=status.phase=Running -o jsonpath='{.items[0].metadata.name}')"
-                  if [ -z "${POD:-}" ]; then
-                    echo "ERROR: no running traefik pod found, leaving secret untouched"
-                    exit 1
-                  fi
-                  echo "traefik pod: $POD"
-
-                  echo "== 2. fetch ${DOMAIN} cert/key from acme.json (resolver ${RESOLVER}) =="
-                  TMP="$(mktemp -d)"
-                  trap 'rm -rf "$TMP"' EXIT INT TERM
-                  kubectl exec -n traefik "$POD" -- cat /data/letsencrypt/acme.json > "$TMP/acme.json"
-                  jq -r --arg r "$RESOLVER" --arg d "$DOMAIN" \
-                    '.[$r].Certificates // [] | map(select(.domain.main == $d or ((.domain.sans // []) | index($d))))' \
-                    "$TMP/acme.json" \
-                    | jq -r '.[0] // empty | .certificate // empty' > "$TMP/new.crt.b64"
-                  jq -r --arg r "$RESOLVER" --arg d "$DOMAIN" \
-                    '.[$r].Certificates // [] | map(select(.domain.main == $d or ((.domain.sans // []) | index($d))))' \
-                    "$TMP/acme.json" \
-                    | jq -r '.[0] // empty | .key // empty' > "$TMP/new.key.b64"
-                  if [ ! -s "$TMP/new.crt.b64" ] || [ ! -s "$TMP/new.key.b64" ]; then
-                    echo "ERROR: no certificate for ${DOMAIN} under resolver ${RESOLVER} in acme.json."
-                    echo "HINT: Traefik has not issued it (check HTTP-01 reachability and DNS records)."
-                    echo "Leaving secret ${SECRET} untouched."
-                    exit 1
-                  fi
-                  base64 -d "$TMP/new.crt.b64" > "$TMP/new.crt"
-                  base64 -d "$TMP/new.key.b64" > "$TMP/new.key"
-                  grep -q "BEGIN CERTIFICATE" "$TMP/new.crt" || { echo "ERROR: payload is not a PEM certificate"; exit 1; }
-                  grep -q "BEGIN .*PRIVATE KEY" "$TMP/new.key" || { echo "ERROR: payload is not a PEM private key"; exit 1; }
-                  echo "fetched PEM cert/key for ${DOMAIN} (sanity checks passed)"
-
-                  echo "== 3. compare with live secret ${SECRET} =="
-                  if ! kubectl -n "$NS" get secret "$SECRET" >/dev/null 2>&1; then
-                    echo "ERROR: secret $NS/${SECRET} does not exist, refusing to create it implicitly."
-                    echo "HINT: bootstrap it once, then re-run this job."
-                    exit 1
-                  fi
-                  kubectl -n "$NS" get secret "$SECRET" -o jsonpath='{.data.tls\.crt}' \
-                    | base64 -d > "$TMP/live.crt"
-                  kubectl -n "$NS" get secret "$SECRET" -o jsonpath='{.data.tls\.key}' \
-                    | base64 -d > "$TMP/live.key"
-                  # Compare content digests only (never filenames: identical
-                  # content under different paths must hash equal).
-                  NEW_HASH="$(sha256sum "$TMP/new.crt" | cut -d' ' -f1)$(sha256sum "$TMP/new.key" | cut -d' ' -f1)"
-                  LIVE_HASH="$(sha256sum "$TMP/live.crt" | cut -d' ' -f1)$(sha256sum "$TMP/live.key" | cut -d' ' -f1)"
-                  if [ "$NEW_HASH" = "$LIVE_HASH" ]; then
-                    echo "secret ${SECRET} already holds the current ${DOMAIN} cert, nothing to do"
-                    exit 0
-                  fi
-                  echo "cert differs, patching secret ${SECRET}"
-
-                  echo "== 4. update secret and restart ${DEPLOY} =="
-                  CRT_B64="$(base64 "$TMP/new.crt" | tr -d '\n')"
-                  KEY_B64="$(base64 "$TMP/new.key" | tr -d '\n')"
-                  kubectl -n "$NS" patch secret "$SECRET" --type=merge \
-                    -p '{"data":{"tls.crt":"'"$CRT_B64"'","tls.key":"'"$KEY_B64"'"}}'
-                  echo "secret patched, restarting deployment"
-                  kubectl -n "$NS" rollout restart "deploy/${DEPLOY}"
-                  kubectl -n "$NS" rollout status "deploy/${DEPLOY}" --timeout=180s
-                  echo "sync complete"
@@ -0,0 +1,12 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: adguard-certs
+  namespace: adguard
+spec:
+  secretName: adguard-certs
+  dnsNames:
+    - dns.forust.xyz
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
@@ -21,7 +21,7 @@ spec:
        - name: adguard-service
          port: 3000
  tls:
-    certResolver: letsencrypt
+    secretName: adguard-certs
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
@@ -0,0 +1,12 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: authentik-prod-tls
+  namespace: authentik
+spec:
+  secretName: authentik-prod-tls
+  dnsNames:
+    - auth.forust.xyz
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
@@ -16,7 +16,7 @@ spec:
        - name: authentik-server-service
          port: 9000
  tls:
-    certResolver: letsencrypt
+    secretName: authentik-prod-tls
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
@@ -0,0 +1,12 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: checkmk-prod-tls
+  namespace: checkmk
+spec:
+  secretName: checkmk-prod-tls
+  dnsNames:
+    - cmk.forust.xyz
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
@@ -16,7 +16,7 @@ spec:
        - name: checkmk-service
          port: 5000
  tls:
-    certResolver: letsencrypt
+    secretName: checkmk-prod-tls
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRouteTCP
@@ -0,0 +1,26 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: convertx-prod-tls
+  namespace: converters
+spec:
+  secretName: convertx-prod-tls
+  dnsNames:
+    - forust.xyz
+    - www.forust.xyz
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: bentopdf-prod-tls
+  namespace: converters
+spec:
+  secretName: bentopdf-prod-tls
+  dnsNames:
+    - pdf.forust.xyz
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
@@ -14,7 +14,7 @@ spec:
        - name: convertx-service
          port: 3000
  tls:
-    certResolver: letsencrypt
+    secretName: convertx-prod-tls
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
@@ -47,7 +47,7 @@ spec:
        - name: bentopdf-service
          port: 8080
  tls:
-    certResolver: letsencrypt
+    secretName: bentopdf-prod-tls
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
@@ -0,0 +1,12 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: dockmon-prod-tls
+  namespace: dockmon
+spec:
+  secretName: dockmon-prod-tls
+  dnsNames:
+    - dockmon.forust.xyz
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
@@ -26,7 +26,7 @@ spec:
          port: 443
          serversTransport: dockmon-transport
  tls:
-    certResolver: letsencrypt
+    secretName: dockmon-prod-tls
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
@@ -17,7 +17,7 @@ spec:
        - name: downtify-service
          port: 8000
  tls:
-    certResolver: letsencrypt
+    secretName: downtify-prod-tls
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
@@ -0,0 +1,13 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: gitea-prod-tls
+  namespace: gitea
+spec:
+  secretName: gitea-prod-tls
+  dnsNames:
+    - gcr.forust.xyz
+    - gitea.forust.xyz
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
@@ -24,7 +24,7 @@ spec:
        - name: gitea-service
          port: 3000
  tls:
-    certResolver: letsencrypt
+    secretName: gitea-prod-tls
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
@@ -0,0 +1,13 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: glance-prod-tls
+  namespace: glance
+spec:
+  secretName: glance-prod-tls
+  dnsNames:
+    - forust.xyz
+    - www.forust.xyz
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
@@ -16,7 +16,7 @@ spec:
        - name: glance-service
          port: 8080
  tls:
-    certResolver: letsencrypt
+    secretName: glance-prod-tls
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
@@ -0,0 +1,25 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: headscale-prod-tls
+  namespace: headscale
+spec:
+  secretName: headscale-prod-tls
+  dnsNames:
+    - hs.forust.xyz
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: headplane-prod-tls
+  namespace: headscale
+spec:
+  secretName: headplane-prod-tls
+  dnsNames:
+    - hp.forust.xyz
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
@@ -38,7 +38,7 @@ spec:
        - name: headscale-server-external
          port: 9090
  tls:
-    certResolver: letsencrypt
+    secretName: headscale-prod-tls
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
@@ -64,7 +64,7 @@ spec:
        - name: headplane-external
          port: 3000
  tls:
-    certResolver: letsencrypt
+    secretName: headplane-prod-tls
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
@@ -0,0 +1,26 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: forust-homepage-prod-tls
+  namespace: homepages
+spec:
+  secretName: forust-homepage-prod-tls
+  dnsNames:
+    - forust.xyz
+    - www.forust.xyz
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: xdfnx-homepage-prod-tls
+  namespace: homepages
+spec:
+  secretName: xdfnx-homepage-prod-tls
+  dnsNames:
+    - xdfnx.cfd
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
@@ -17,7 +17,7 @@ spec:
        - name: forust-homepage-service
          port: 80
  tls:
-    certResolver: letsencrypt
+    secretName: forust-homepage-prod-tls
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
@@ -53,7 +53,7 @@ spec:
        - name: xdfnx-homepage-service
          port: 80
  tls:
-    certResolver: letsencrypt
+    secretName: xdfnx-homepage-prod-tls
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
@@ -16,7 +16,7 @@ spec:
        - name: kener-service
          port: 3000
  tls:
-    certResolver: letsencrypt
+    secretName: kener-prod-tls
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
@@ -0,0 +1,12 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: metube-prod-tls
+  namespace: metube
+spec:
+  secretName: metube-prod-tls
+  dnsNames:
+    - metube.forust.xyz
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
@@ -15,7 +15,7 @@ spec:
        - name: metube-service
          port: 8081
  tls:
-    certResolver: letsencrypt
+    secretName: metube-prod-tls
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
@@ -0,0 +1,12 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: netronome-prod-tls
+  namespace: netronome
+spec:
+  secretName: netronome-prod-tls
+  dnsNames:
+    - nm.forust.xyz
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
@@ -16,7 +16,7 @@ spec:
        - name: netronome-service
          port: 7575
  tls:
-    certResolver: letsencrypt
+    secretName: netronome-prod-tls
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
@@ -0,0 +1,12 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: nextcloud-prod-tls
+  namespace: nextcloud
+spec:
+  secretName: nextcloud-prod-tls
+  dnsNames:
+    - nextcloud.forust.xyz
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
@@ -18,7 +18,7 @@ spec:
        - name: nextcloud-apache
          port: 11000
  tls:
-    certResolver: letsencrypt
+    secretName: nextcloud-prod-tls
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
@@ -0,0 +1,12 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: portainer-prod-tls
+  namespace: portainer
+spec:
+  secretName: portainer-prod-tls
+  dnsNames:
+    - portainer.forust.xyz
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
@@ -16,7 +16,7 @@ spec:
        - name: portainer-service
          port: 9000
  tls:
-    certResolver: letsencrypt
+    secretName: portainer-prod-tls
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
@@ -0,0 +1,12 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: grafana-prod-tls
+  namespace: prometheus
+spec:
+  secretName: grafana-prod-tls
+  dnsNames:
+    - grafana.forust.xyz
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
@@ -16,9 +16,7 @@ spec:
        - name: prometheus-stack-grafana
          port: 80
  tls:
-    certResolver: letsencrypt
-    domains:
-      - main: grafana.forust.xyz
+    secretName: grafana-prod-tls
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
@@ -0,0 +1,13 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: searxng-prod-tls
+  namespace: searxng
+spec:
+  secretName: searxng-prod-tls
+  dnsNames:
+    - s.forust.xyz
+    - search.forust.xyz
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
@@ -16,7 +16,7 @@ spec:
        - name: searxng-service
          port: 8080
  tls:
-    certResolver: letsencrypt
+    secretName: searxng-prod-tls
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
@@ -0,0 +1,12 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: termix-prod-tls
+  namespace: termix
+spec:
+  secretName: termix-prod-tls
+  dnsNames:
+    - termix.forust.xyz
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
@@ -16,7 +16,7 @@ spec:
        - name: termix-service
          port: 8080
  tls:
-    certResolver: letsencrypt
+    secretName: termix-prod-tls
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
@@ -0,0 +1,12 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: dashboard-prod-tls
+  namespace: traefik
+spec:
+  secretName: dashboard-prod-tls
+  dnsNames:
+    - traefik.forust.xyz
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
@@ -17,7 +17,7 @@ spec:
        - name: api@internal
          kind: TraefikService
  tls:
-    certResolver: letsencrypt
+    secretName: dashboard-prod-tls
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
@@ -121,14 +121,11 @@ persistence:
  size: 100Mi
  path: /data

-certificatesResolvers:
-  letsencrypt:
-    acme:
-      email: bobrovod@national.shitposting.agency
-      storage: /data/letsencrypt/acme.json
-      caServer: https://acme-v02.api.letsencrypt.org/directory
-      httpChallenge:
-        entryPoint: web
+# NOTE: no certificatesResolvers — public TLS is issued by cert-manager
+# (see cert-manager/k8s/clusterissuer.yaml and per-service certificates.yaml).
+# Traefik must not run its own ACME httpChallenge: its internal
+# acme-http@internal router hijacks /.well-known/acme-challenge/ for every
+# host and breaks external HTTP-01 solvers.

 volumes:
  - name: traefik-dynamic
@@ -0,0 +1,12 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: uptime-kuma-prod-tls
+  namespace: uptime-kuma
+spec:
+  secretName: uptime-kuma-prod-tls
+  dnsNames:
+    - uptime.forust.xyz
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
@@ -16,7 +16,7 @@ spec:
        - name: uptime-kuma-service
          port: 3001
  tls:
-    certResolver: letsencrypt
+    secretName: uptime-kuma-prod-tls
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
@@ -0,0 +1,12 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: vaultwarden-prod-tls
+  namespace: vaultwarden
+spec:
+  secretName: vaultwarden-prod-tls
+  dnsNames:
+    - vw.forust.xyz
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
@@ -13,7 +13,7 @@ spec:
        - name: vaultwarden-service
          port: 80
  tls:
-    certResolver: letsencrypt
+    secretName: vaultwarden-prod-tls
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
@@ -0,0 +1,12 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: xray-prod-tls
+  namespace: xui
+spec:
+  secretName: xray-prod-tls
+  dnsNames:
+    - xray.forust.xyz
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
@@ -58,7 +58,7 @@ spec:
        - name: xui-service
          port: 10000
  tls:
-    certResolver: letsencrypt
+    secretName: xray-prod-tls
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute