Let cert-manager issue the certificate

The ingress pointed at scottyah-tls, a secret hand-copied between
namespaces and absent from this one, so Traefik fell back to a
self-signed certificate. That is invisible behind Cloudflare until the
SSL mode is set to Full (strict), which then fails with a 526.

Issue into the namespace over DNS-01 instead. Nothing to copy, and the
renewal is no longer a thing anyone has to remember.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -81,8 +81,13 @@ kubectl create secret generic fit-basic-auth -n fit --from-file=users=/tmp/users
 rm /tmp/users
 ```
 
-Point `fit.scottyah.com` at the cluster and Traefik terminates TLS with the
+Point `fit.scottyah.com` at the cluster. The certificate is issued by
-existing `scottyah-tls` secret.
+cert-manager through the `letsencrypt-prod-cloudflare` cluster issuer, which
+solves a DNS-01 challenge at Cloudflare and writes `fit-tls` into this
+namespace. Nothing is copied in and nothing is renewed by hand.
+
+Cloudflare's SSL mode should be Full (strict). Flexible carries the basic-auth
+password to the origin in the clear, and it rides on every request.
 
 To pull a copy of the log without the browser:
 

k8s.yaml

@@ -137,12 +137,19 @@ metadata:
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
     traefik.ingress.kubernetes.io/router.middlewares: fit-fit-basic-auth@kubernetescrd
+    # cert-manager watches the tls block below and issues into this namespace,
+    # over DNS-01 at Cloudflare. A TLS secret cannot be shared across
+    # namespaces, and hand-copying one leaves a certificate nothing renews.
+    cert-manager.io/cluster-issuer: letsencrypt-prod-cloudflare
 spec:
   ingressClassName: traefik
   tls:
     - hosts:
         - fit.scottyah.com
-      secretName: scottyah-tls
+      # Created and renewed by cert-manager. It does not exist until the
+      # first issue succeeds, and the site does not serve a valid cert
+      # until then.
+      secretName: fit-tls
   rules:
     - host: fit.scottyah.com
       http: