# Accès public HTTPS — n8n.funklab.online (cert Let's Encrypt auto).
# n8n garde son propre login (pas d'OIDC en édition communautaire).
# Route interne n8n.lab.local conservée (utilisée par le webhook AlertManager).
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: n8n-public
  namespace: ai
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`n8n.funklab.online`)
      kind: Rule
      middlewares:
        - name: security-headers
          namespace: infra
        - name: ratelimit
          namespace: infra
      services:
        - name: n8n
          port: 5678
  tls:
    certResolver: letsencrypt