add scuderia fe+be (path-based routing)

apps/scuderia-be.yaml

@@ -13,7 +13,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: scuderia
+  name: scuderia-fe
   namespace: argocd
 spec:
   project: default
@@ -26,7 +26,7 @@ spec:
       path: charts/app
       helm:
         valueFiles:
-          - $values/scuderia/dev/values.yaml
+          - $values/scuderia-be/dev/values.yaml
   destination:
     server: https://kubernetes.default.svc
     namespace: dev

apps/scuderia-fe.yaml

@@ -0,0 +1,38 @@
+# gitops-demo child Application — now Helm-based, using the shared chart.
+#
+# MULTI-SOURCE explained: ArgoCD lets an Application pull from more than one
+# source. We use two, BOTH pointing at this same manifest repo:
+#   1. ref: values  — exposes the repo as "$values" so we can reference a file
+#                     from it (the per-service values.yaml).
+#   2. path: charts/app  — the generic chart, rendered with that values file.
+# This keeps the chart shared and each service's values in its own clean file,
+# instead of duplicating manifests or inlining values here.
+#
+# NOTE: replace REPLACE_WITH_MANIFEST_REPO_URL in BOTH sources with the real
+# repo URL (same as before — ArgoCD reads these straight from git).
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: scuderia-fe
+  namespace: argocd
+spec:
+  project: default
+  sources:
+    - repoURL: https://gitea.lgkentang.com/darren.maverick/k3s-manifests.git
+      targetRevision: HEAD
+      ref: values
+    - repoURL: https://gitea.lgkentang.com/darren.maverick/k3s-manifests.git
+      targetRevision: HEAD
+      path: charts/app
+      helm:
+        valueFiles:
+          - $values/scuderia-fe/dev/values.yaml
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: dev
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

charts/app/templates/ingress.yaml

@@ -8,21 +8,26 @@ metadata:
   name: {{ include "app.name" . }}
   labels:
     {{- include "app.labels" . | nindent 4 }}
+  {{- if .Values.ingress.tls }}
   annotations:
     # Phase 1: cert-manager issues the cert. Phase 2: external-dns reads the
-    # host below and creates the DNS record. Both driven off this one Ingress.
+    # host below and creates the DNS record. When tls is false (a secondary
+    # path on a shared host), this Ingress owns neither — it just adds a route.
     cert-manager.io/cluster-issuer: {{ .Values.ingress.clusterIssuer }}
+  {{- end }}
 spec:
   ingressClassName: {{ .Values.ingress.className }}
+  {{- if .Values.ingress.tls }}
   tls:
     - hosts:
         - {{ .Values.ingress.host }}
       secretName: {{ .Values.ingress.tlsSecretName | default (printf "%s-tls" (include "app.name" .)) }}
+  {{- end }}
   rules:
     - host: {{ .Values.ingress.host }}
       http:
         paths:
-          - path: /
+          - path: {{ .Values.ingress.path }}
             pathType: Prefix
             backend:
               service:

charts/app/values.yaml

@@ -31,6 +31,17 @@ ingress:
   # REQUIRED when enabled, e.g. myapp.dev.lgkentang.com. external-dns turns
   # this into a DNS record and cert-manager into a cert (Phases 1-2).
   host: ""
+  # URL path this Ingress routes. Default "/" (catch-all). For path-based
+  # routing where components share a host, give each a distinct path — e.g. the
+  # frontend keeps "/" and the backend uses "/api/v1". Traefik routes the
+  # longest-matching prefix, so "/api/v1/*" beats "/" automatically.
+  path: /
+  # Whether THIS Ingress requests a TLS cert for the host. Set false when
+  # another Ingress already owns the host's cert (path-based routing on a shared
+  # host: only ONE component — usually the frontend at "/" — should carry TLS +
+  # the cert-manager annotation; the others just add a path rule and are served
+  # over that same host cert). Avoids two Certificates fighting over one host.
+  tls: true
   clusterIssuer: letsencrypt-prod
   # tlsSecretName defaults to "<name>-tls" if left unset.
   tlsSecretName: ""

scuderia-be/dev/values.yaml

@@ -0,0 +1,10 @@
+name: scuderia-be
+image:
+  repository: mybitlab/scuderia
+  tag: be-dev
+replicas: 1
+containerPort: 3000               # whatever port your API listens on
+ingress:
+  host: scuderia.dev.lgkentang.com
+  path: /api/v1                   # API traffic → backend
+  tls: false                      # ← no second cert; served over FE's cert

scuderia-fe/dev/values.yaml

@@ -0,0 +1,13 @@
+name: scuderia-fe
+image:
+  repository: mybitlab/scuderia
+  tag: fe-dev
+replicas: 1
+ingress:
+  host: scuderia.dev.lgkentang.com
+  path: /                         # catch-all → frontend
+  tls: true                       # ← FE issues the cert for this host
+  clusterIssuer: letsencrypt-prod
+env:
+  # same-domain API, so a relative base path (no scheme/host needed)
+  API_BASE_URL: /api/v1

scuderia/dev/values.yaml

@@ -1,8 +0,0 @@
-name: myapp
-image:
-  repository: mybitlab/scuderia
-  tag: fe-dev
-replicas: 1
-ingress:
-  host: scuderia.dev.lgkentang.com
-  clusterIssuer: letsencrypt-prod