From 81d795955d19d73f36e80da34229b7443f3fde39 Mon Sep 17 00:00:00 2001
From: scott <scottyah@gmail.com>
Date: Sat, 1 Aug 2026 22:30:47 -0700
Subject: [PATCH] Let cert-manager issue the certificate

The ingress pointed at scottyah-tls, a secret hand-copied between
namespaces and absent from this one, so Traefik fell back to a
self-signed certificate. That is invisible behind Cloudflare until the
SSL mode is set to Full (strict), which then fails with a 526.

Issue into the namespace over DNS-01 instead. Nothing to copy, and the
renewal is no longer a thing anyone has to remember.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 README.md | 9 +++++++--
 k8s.yaml  | 9 ++++++++-
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index dfda80b..3e31020 100644
--- a/README.md
+++ b/README.md
@@ -81,8 +81,13 @@ kubectl create secret generic fit-basic-auth -n fit --from-file=users=/tmp/users
 rm /tmp/users
 ```
 
-Point `fit.scottyah.com` at the cluster and Traefik terminates TLS with the
-existing `scottyah-tls` secret.
+Point `fit.scottyah.com` at the cluster. The certificate is issued by
+cert-manager through the `letsencrypt-prod-cloudflare` cluster issuer, which
+solves a DNS-01 challenge at Cloudflare and writes `fit-tls` into this
+namespace. Nothing is copied in and nothing is renewed by hand.
+
+Cloudflare's SSL mode should be Full (strict). Flexible carries the basic-auth
+password to the origin in the clear, and it rides on every request.
 
 To pull a copy of the log without the browser:
 
diff --git a/k8s.yaml b/k8s.yaml
index f4c11f3..284c4f6 100644
--- a/k8s.yaml
+++ b/k8s.yaml
@@ -137,12 +137,19 @@ metadata:
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
     traefik.ingress.kubernetes.io/router.middlewares: fit-fit-basic-auth@kubernetescrd
+    # cert-manager watches the tls block below and issues into this namespace,
+    # over DNS-01 at Cloudflare. A TLS secret cannot be shared across
+    # namespaces, and hand-copying one leaves a certificate nothing renews.
+    cert-manager.io/cluster-issuer: letsencrypt-prod-cloudflare
 spec:
   ingressClassName: traefik
   tls:
     - hosts:
         - fit.scottyah.com
-      secretName: scottyah-tls
+      # Created and renewed by cert-manager. It does not exist until the
+      # first issue succeeds, and the site does not serve a valid cert
+      # until then.
+      secretName: fit-tls
   rules:
     - host: fit.scottyah.com
       http: