# ============================================================================
# cert-manager Installation and Configuration
# ============================================================================
# Install cert-manager via Helm first:
#
# helm repo add jetstack https://charts.jetstack.io
# helm repo update
# helm install cert-manager jetstack/cert-manager \
#   --namespace cert-manager \
#   --create-namespace \
#   --set installCRDs=true \
#   --set prometheus.enabled=true \
#   --set prometheus.servicemonitor.enabled=true
#
# Then apply this file for ClusterIssuers
# ============================================================================

---
# Let's Encrypt Staging (for testing - higher rate limits)
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    # Staging server for testing
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: admin@undateable.me
    privateKeySecretRef:
      name: letsencrypt-staging-key
    solvers:
      - http01:
          ingress:
            class: nginx
---
# Let's Encrypt Production (use after testing with staging)
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    # Production server
    server: https://acme-v02.api.letsencrypt.org/directory
    email: admin@undateable.me
    privateKeySecretRef:
      name: letsencrypt-prod-key
    solvers:
      - http01:
          ingress:
            class: nginx
---
# Certificate for undateable.me
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: undateable-tls
  namespace: undateable
spec:
  secretName: undateable-tls-secret
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  commonName: undateable.me
  dnsNames:
    - undateable.me
    - www.undateable.me
---
# Certificate for burnyourex.games
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: burnyourex-tls
  namespace: undateable
spec:
  secretName: burnyourex-tls-secret
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  commonName: burnyourex.games
  dnsNames:
    - burnyourex.games
    - www.burnyourex.games
---
# Certificate for nerdycupid.ai
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: nerdycupid-ai-tls
  namespace: undateable
spec:
  secretName: nerdycupid-ai-tls-secret
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  commonName: nerdycupid.ai
  dnsNames:
    - nerdycupid.ai
    - www.nerdycupid.ai
---
# Certificate for nerdycupid.io
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: nerdycupid-io-tls
  namespace: undateable
spec:
  secretName: nerdycupid-io-tls-secret
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  commonName: nerdycupid.io
  dnsNames:
    - nerdycupid.io
    - www.nerdycupid.io
