# PUBLIC surface of the CA — revocation checking ONLY.
#
# Two prefixes are routed and nothing else. Not the admin web, not the REST API,
# not the public enrolment pages (/ejbca/ra/, /ejbca/enrol/). Anything else at
# this host 404s because no rule matches it.
#
# WHY THIS MUST BE PUBLIC AT ALL: every certificate this CA issues carries the
# CRL Distribution Point and OCSP responder URL *inside* it, and those URLs are
# fetched by whoever is validating the certificate. For internal-only S/MIME that
# could stay private — but the moment a signed message leaves the building, the
# recipient's mail client resolves these URLs from the outside. They also become
# permanent: certificates already issued keep pointing here for their full year,
# so this hostname cannot be changed casually. Fix the hostname before the first
# real issuance, not after.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: vnc-ca-public
  namespace: vnc-ca
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    # Revocation data is public by design and must be cacheable — an OCSP
    # responder that is slow or down makes every client either hang or
    # soft-fail open, and soft-fail-open is the same as no revocation at all.
    nginx.ingress.kubernetes.io/proxy-read-timeout: "20"
spec:
  ingressClassName: public
  tls:
    - hosts:
        - ca.sandbox.vnc.de
      secretName: vnc-ca-public-tls
  rules:
    - host: ca.sandbox.vnc.de
      http:
        paths:
          # CRL download — http://ca.sandbox.vnc.de/ejbca/publicweb/crls/...
          - path: /ejbca/publicweb/crls
            pathType: Prefix
            backend:
              service:
                name: ejbca
                port:
                  number: 8080
          # OCSP responder — POST target for status queries.
          - path: /ejbca/publicweb/status/ocsp
            pathType: Prefix
            backend:
              service:
                name: ejbca
                port:
                  number: 8080