Fix default ingress.

ADDING-APPS.md

@@ -645,19 +645,47 @@ This means individual resources can use simple, component-specific selectors lik
 
 Resource files in this repository are **templates** that get compiled when users add apps via the web app, CLI, or API. Only variables defined in the manifest file's 'defaultConfig' section are available to the resource templates. Use gomplate syntax to reference configuration:
 
-### External DNS
+### Ingress
 
-Ingress resources should include external-dns annotations for automatic DNS management:
+Use this as the standard ingress template for all apps:
 
 ```yaml
-annotations:
-  external-dns.alpha.kubernetes.io/target: {{ .domain }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: myapp
+  annotations:
+    external-dns.alpha.kubernetes.io/target: {{ .externalDnsDomain }}
     external-dns.alpha.kubernetes.io/cloudflare-proxied: "false"
+    external-dns.alpha.kubernetes.io/ttl: "60"
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: {{ .domain }}
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: myapp
+            port:
+              number: 80
+  tls:
+  - hosts:
+    - {{ .domain }}
+    secretName: {{ .tlsSecretName }}
 ```
 
-Note: 'domain' must be defined in the app manifest's 'defaultConfig' section.
+**Rules:**
+- Always use `spec.ingressClassName: traefik` — do NOT use the `kubernetes.io/ingress.class` annotation (deprecated)
+- Do NOT add `cert-manager.io/cluster-issuer` — the wildcard TLS cert is pre-distributed to app namespaces and managed centrally; adding this annotation causes cert-manager to issue a wrong per-app cert that overwrites the wildcard secret
+- Do NOT add Traefik redirect annotations — HTTPS redirect is handled globally by Traefik
+- `externalDnsDomain`, `domain`, and `tlsSecretName` must be defined in `defaultConfig`
 
-This creates a CNAME from the app subdomain to the cluster domain (e.g., `myapp.cloud.example.com` → `cloud.example.com`).
+### External DNS
+
+The `external-dns.alpha.kubernetes.io/target` annotation creates a CNAME from the app subdomain to the cluster domain (e.g., `myapp.cloud.example.com` → `cloud.example.com`). Always set `cloudflare-proxied: "false"` since Wild Cloud manages its own TLS.
 
 ## App Dependencies and Reference Mapping
 

example-app/versions/1/ingress.yaml

@@ -5,15 +5,12 @@ metadata:
   name: example-app
   annotations:
     external-dns.alpha.kubernetes.io/target: "{{ .cloud.externalDnsTarget }}"
-    external-dns.alpha.kubernetes.io/cloudflare-proxied: false
-
-    # Optional: Enable HTTPS redirection
-    traefik.ingress.kubernetes.io/redirect-entry-point: https
-
+    external-dns.alpha.kubernetes.io/cloudflare-proxied: "false"
     # Optional: Enable basic auth
     # traefik.ingress.kubernetes.io/auth-type: basic
     # traefik.ingress.kubernetes.io/auth-secret: basic-auth
 spec:
+  ingressClassName: traefik
   rules:
     - host: "{{ .host }}"
       http:

ghost/versions/5/ingress.yaml

@@ -4,13 +4,11 @@ metadata:
   name: ghost
   namespace: ghost
   annotations:
-    kubernetes.io/ingress.class: "traefik"
-    cert-manager.io/cluster-issuer: "letsencrypt-prod"
     external-dns.alpha.kubernetes.io/cloudflare-proxied: "false"
     external-dns.alpha.kubernetes.io/target: {{ .externalDnsDomain }}
     external-dns.alpha.kubernetes.io/ttl: "60"
-    traefik.ingress.kubernetes.io/redirect-entry-point: https
 spec:
+  ingressClassName: traefik
   rules:
     - host: {{ .domain }}
       http:

lemmy/versions/0/ingress.yaml

@@ -4,9 +4,6 @@ metadata:
   name: lemmy-ingress
   namespace: {{ .namespace }}
   annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-prod
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
-    traefik.ingress.kubernetes.io/router.tls: "true"
     external-dns.alpha.kubernetes.io/target: {{ .externalDnsDomain }}
     external-dns.alpha.kubernetes.io/cloudflare-proxied: "false"
 spec: