From f3cfaf1ebe155ce91309c3d46931847582dc31c3 Mon Sep 17 00:00:00 2001
From: Karan Parashar <whyredfire@gmail.com>
Date: Wed, 17 Dec 2025 15:55:52 +0530
Subject: [PATCH] infra(cert-manager): Add cluster issuer

- Issue certificate for scriptscribe
---
 infra/cert-manager/kustomization.yaml      |  1 +
 infra/cert-manager/letsencrypt-issuer.yaml | 14 ++++++++++++++
 manifests/scriptscribe/ingress.yaml        | 10 ++++++++--
 3 files changed, 23 insertions(+), 2 deletions(-)
 create mode 100644 infra/cert-manager/letsencrypt-issuer.yaml

diff --git a/infra/cert-manager/kustomization.yaml b/infra/cert-manager/kustomization.yaml
index 1a1408b..d5ef1d5 100644
--- a/infra/cert-manager/kustomization.yaml
+++ b/infra/cert-manager/kustomization.yaml
@@ -3,3 +3,4 @@ kind: Kustomization
 
 resources:
   - https://github.com/cert-manager/cert-manager/releases/download/v1.19.2/cert-manager.yaml
+  - letsencrypt-issuer.yaml
diff --git a/infra/cert-manager/letsencrypt-issuer.yaml b/infra/cert-manager/letsencrypt-issuer.yaml
new file mode 100644
index 0000000..a410456
--- /dev/null
+++ b/infra/cert-manager/letsencrypt-issuer.yaml
@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: whyredfire@gmail.com
+    privateKeySecretRef:
+      name: letsencrypt-prod
+    solvers:
+      - http01:
+          ingress:
+            class: traefik
diff --git a/manifests/scriptscribe/ingress.yaml b/manifests/scriptscribe/ingress.yaml
index 5a69ef2..5261cbb 100644
--- a/manifests/scriptscribe/ingress.yaml
+++ b/manifests/scriptscribe/ingress.yaml
@@ -3,10 +3,16 @@ kind: Ingress
 metadata:
   name: ingress-rules
   annotations:
-    traefik.ingress.kubernetes.io/router.entrypoints: web
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
+  tls:
+    - hosts:
+      - scriptscribe-k3s.whyredfire.tech
+      secretName: scriptscribe-k3s-tls
   rules:
-    - host: scriptscribe.whyredfire.tech
+    - host: scriptscribe-k3s.whyredfire.tech
       http:
         paths:
           - path: /api