# Accès public HTTPS — argocd.funklab.online (cert Let's Encrypt auto).
# ArgoCD n'est pas auto-synchronisé : appliquer à la main
#   kubectl apply -f k8s/argocd-bootstrap/ingressroute-public.yaml
# Route interne argocd.lab.local conservée (Ingress du chart).
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: argocd-public
  namespace: argocd
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`argocd.funklab.online`)
      kind: Rule
      middlewares:
        - name: security-headers
          namespace: infra
        - name: ratelimit
          namespace: infra
      services:
        - name: argocd-server
          port: 80
  tls:
    certResolver: letsencrypt