git: Replace the cgit Ingress with a standalone Certificate.
The cgit IngressRoute only needed the Ingress for cert-manager's
ingress-shim. HTTP-01 challenges are served by Traefik's ingress-nginx
compat provider (verified 2026-11-05).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Change-Id: Ia3c66912a2a19f8a5eb54a1f2648abfc832838a5
diff --git a/git/git.yaml b/git/git.yaml
index 884ba9b..e9f83b4 100644
--- a/git/git.yaml
+++ b/git/git.yaml
@@ -162,47 +162,25 @@
storage: 50Mi
storageClassName: local-path
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
+# TLS certificate for the cgit IngressRoute below. It used to be created
+# by cert-manager's ingress-shim from an nginx Ingress, which has been
+# removed; the HTTP-01 solver still goes through Traefik's nginx-class
+# compat provider (see the letsencrypt-prod ClusterIssuer).
+apiVersion: cert-manager.io/v1
+kind: Certificate
metadata:
- name: git-cgit-cgi
+ name: git-cgit-cgi-tls
namespace: mulk
- annotations:
- cert-manager.io/cluster-issuer: letsencrypt-prod
- kubernetes.io/ingress.class: nginx
- nginx.ingress.kubernetes.io/rewrite-target: /cgit/cgit.cgi/$1$2
- # Cap cgit at 5 r/s in total (zone defined in ingress-nginx/config.yaml).
- # A limit_req at location level replaces the inherited server-level one,
- # so the bot limit is repeated here.
- nginx.ingress.kubernetes.io/configuration-snippet: |
- limit_req zone=bots burst=20 nodelay;
- limit_req zone=perhost burst=20 nodelay;
spec:
- rules:
- - host: git.benkard.de
- http:
- paths:
- - backend:
- service:
- name: git-cgit
- port:
- number: 80
- path: /(.*)[.]git(/.*)?$
- pathType: ImplementationSpecific
- - backend:
- service:
- name: git-cgit
- port:
- number: 80
- path: /(.*)(.*)?$
- pathType: ImplementationSpecific
- tls:
- - hosts:
- - git.benkard.de
- secretName: git-cgit-cgi-tls
+ secretName: git-cgit-cgi-tls
+ dnsNames:
+ - git.benkard.de
+ issuerRef:
+ kind: ClusterIssuer
+ name: letsencrypt-prod
---
-# Traefik route for cgit. Traefik's ingress-nginx provider rejects the
-# Ingress above because of its snippet, and it has no global per-host rate
+# Traefik route for cgit. Traefik's ingress-nginx provider does not
+# support nginx snippet annotations, and it has no global per-host rate
# limit, so cgit gets a native IngressRoute instead.
#
# A crawler botnet with thousands of rotating IPs and browser user agents