From 611ae0624efb4182ecb0a28bc58d6248b2b483f8 Mon Sep 17 00:00:00 2001
From: Stefan Saenger <stefan.saenger@vnc.biz>
Date: Thu, 6 Aug 2026 09:50:13 +0200
Subject: [PATCH] fix(deploy): switch dev to letsencrypt-prod and add
 HTTP->HTTPS redirect

---
 deploy/k8s/base/ingress.yaml               |  1 +
 deploy/k8s/overlays/dev/patch-ingress.yaml | 10 ++++------
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/deploy/k8s/base/ingress.yaml b/deploy/k8s/base/ingress.yaml
index 24dbb55e..c3c00482 100644
--- a/deploy/k8s/base/ingress.yaml
+++ b/deploy/k8s/base/ingress.yaml
@@ -15,6 +15,7 @@ metadata:
   name: vncmail-plus
   annotations:
     cert-manager.io/cluster-issuer: CHANGEME
+    traefik.ingress.kubernetes.io/router.middlewares: traefik-redirect-to-https@kubernetescrd
 spec:
   ingressClassName: traefik
   tls:
diff --git a/deploy/k8s/overlays/dev/patch-ingress.yaml b/deploy/k8s/overlays/dev/patch-ingress.yaml
index f9efd41a..ff268a5f 100644
--- a/deploy/k8s/overlays/dev/patch-ingress.yaml
+++ b/deploy/k8s/overlays/dev/patch-ingress.yaml
@@ -1,14 +1,12 @@
-# dev-k8s cluster confirmed to have a `letsencrypt-staging` ClusterIssuer
-# already (no `letsencrypt-prod` exists there) - staging avoids burning
-# Let's Encrypt's real rate limits while this is still being stood up.
-# vncmail.sandbox.vnc.de DNS does not point here yet either - this is the
-# intended host, not a live one (see VNCMAIL-SETUP.md for what's still open).
+# Dev now uses letsencrypt-prod so the sandbox certificate is trusted by
+# browsers. Both letsencrypt-staging and letsencrypt-prod ClusterIssuers
+# exist on the dev-k8s cluster (see VNCiAC-dev-cluster-runbook.md §7).
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: vncmail-plus
   annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-staging
+    cert-manager.io/cluster-issuer: letsencrypt-prod
 spec:
   tls:
     - hosts: