# PLACEHOLDER — the real production hostname has not been decided yet (see
# VNCMAIL-SETUP.md / the pipeline plan). vncmail.CHANGEME.invalid is
# deliberately unresolvable: applying this overlay as committed will not
# issue a cert or route traffic anywhere. Replace both occurrences below,
# and the matching TLS secretName, before Phase D (first real prod deploy).
#
# Targets node1-3 (the HA "prod" cluster). Deliberately does NOT override
# base's `cert-manager.io/cluster-issuer: CHANGEME` — node1-3 has ZERO
# ClusterIssuers configured today (confirmed via direct access). A human
# needs to create a real one there (ACME account, DNS-01 or HTTP-01 solver)
# before this can be anything but a placeholder.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: vncmail-plus
spec:
  tls:
    - hosts:
        - vncmail.CHANGEME.invalid
      secretName: vncmail-plus-prod-tls
  rules:
    - host: vncmail.CHANGEME.invalid
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: vncmail-plus
                port:
                  number: 80