# ------------------------------------------------------------------------------
# cert-manager ClusterIssuer — Let's Encrypt via Cloudflare DNS-01
#
# The cloudflare-api-token secret is populated by ESO from 1Password.
# See externalsecret.yaml for the ESO resource that creates it.
# ------------------------------------------------------------------------------

# Staging issuer — use this first to avoid LE rate limits during testing
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: ryan.blundon@protonmail.com
    privateKeySecretRef:
      name: letsencrypt-staging-key
    solvers:
      - dns01:
          cloudflare:
            apiTokenSecretRef:
              name: cloudflare-api-token
              key: api-token
        selector:
          dnsZones:
            - mk-labs.cloud

---
# Production issuer — switch to this once staging certs are working
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: ryan.blundon@protonmail.com
    privateKeySecretRef:
      name: letsencrypt-prod-key
    solvers:
      - dns01:
          cloudflare:
            apiTokenSecretRef:
              name: cloudflare-api-token
              key: api-token
        selector:
          dnsZones:
            - mk-labs.cloud