# Requires cert-manager to already be installed (see docs/DEPLOYMENT.md Phase 3).
# k3s ships Traefik as its ingress controller by default, which is what the
# http01 solver below targets. If you disabled Traefik at k3s install time,
# swap `class: traefik` for whatever ingress controller you're running.
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    # CHANGE ME if you'd rather Let's Encrypt expiry/abuse notices go elsewhere.
    email: hello@albertabril.com
    privateKeySecretRef:
      name: letsencrypt-prod-key
    solvers:
      - http01:
          ingress:
            class: traefik
---
# Optional but recommended while testing: Let's Encrypt's staging environment
# has much higher rate limits and issues untrusted (but structurally identical)
# certs, so you can validate the whole chain without risking the production
# rate limit (5 certs/domain/week). Point an Ingress at this issuer first,
# confirm it works, then switch to letsencrypt-prod.
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: hello@albertabril.com
    privateKeySecretRef:
      name: letsencrypt-staging-key
    solvers:
      - http01:
          ingress:
            class: traefik