# Accès public HTTPS — auth.funklab.online (cert Let's Encrypt auto).
# S'ajoute à la route interne auth.lab.local (non destructif).
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: authentik-public
  namespace: auth
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`auth.funklab.online`)
      kind: Rule
      services:
        - name: authentik
          port: 9000
  tls:
    certResolver: letsencrypt