add scuderia fe+be (path-based routing)

charts/app/values.yaml

@@ -31,6 +31,17 @@ ingress:
   # REQUIRED when enabled, e.g. myapp.dev.lgkentang.com. external-dns turns
   # this into a DNS record and cert-manager into a cert (Phases 1-2).
   host: ""
+  # URL path this Ingress routes. Default "/" (catch-all). For path-based
+  # routing where components share a host, give each a distinct path — e.g. the
+  # frontend keeps "/" and the backend uses "/api/v1". Traefik routes the
+  # longest-matching prefix, so "/api/v1/*" beats "/" automatically.
+  path: /
+  # Whether THIS Ingress requests a TLS cert for the host. Set false when
+  # another Ingress already owns the host's cert (path-based routing on a shared
+  # host: only ONE component — usually the frontend at "/" — should carry TLS +
+  # the cert-manager annotation; the others just add a path rule and are served
+  # over that same host cert). Avoids two Certificates fighting over one host.
+  tls: true
   clusterIssuer: letsencrypt-prod
   # tlsSecretName defaults to "<name>-tls" if left unset.
   tlsSecretName: ""