add scuderia fe+be (path-based routing)

charts/app/templates/ingress.yaml

@@ -8,21 +8,26 @@ metadata:
   name: {{ include "app.name" . }}
   labels:
     {{- include "app.labels" . | nindent 4 }}
+  {{- if .Values.ingress.tls }}
   annotations:
     # Phase 1: cert-manager issues the cert. Phase 2: external-dns reads the
-    # host below and creates the DNS record. Both driven off this one Ingress.
+    # host below and creates the DNS record. When tls is false (a secondary
+    # path on a shared host), this Ingress owns neither — it just adds a route.
     cert-manager.io/cluster-issuer: {{ .Values.ingress.clusterIssuer }}
+  {{- end }}
 spec:
   ingressClassName: {{ .Values.ingress.className }}
+  {{- if .Values.ingress.tls }}
   tls:
     - hosts:
         - {{ .Values.ingress.host }}
       secretName: {{ .Values.ingress.tlsSecretName | default (printf "%s-tls" (include "app.name" .)) }}
+  {{- end }}
   rules:
     - host: {{ .Values.ingress.host }}
       http:
         paths:
-          - path: /
+          - path: {{ .Values.ingress.path }}
             pathType: Prefix
             backend:
               service:

charts/app/values.yaml

@@ -31,6 +31,17 @@ ingress:
   # REQUIRED when enabled, e.g. myapp.dev.lgkentang.com. external-dns turns
   # this into a DNS record and cert-manager into a cert (Phases 1-2).
   host: ""
+  # URL path this Ingress routes. Default "/" (catch-all). For path-based
+  # routing where components share a host, give each a distinct path — e.g. the
+  # frontend keeps "/" and the backend uses "/api/v1". Traefik routes the
+  # longest-matching prefix, so "/api/v1/*" beats "/" automatically.
+  path: /
+  # Whether THIS Ingress requests a TLS cert for the host. Set false when
+  # another Ingress already owns the host's cert (path-based routing on a shared
+  # host: only ONE component — usually the frontend at "/" — should carry TLS +
+  # the cert-manager annotation; the others just add a path rule and are served
+  # over that same host cert). Avoids two Certificates fighting over one host.
+  tls: true
   clusterIssuer: letsencrypt-prod
   # tlsSecretName defaults to "<name>-tls" if left unset.
   tlsSecretName: ""