From 6ff5eaafa28363a60d81f3d36426acb174f52bfb Mon Sep 17 00:00:00 2001
From: nick-gorse <nick@olb42.com>
Date: Sun, 14 Jun 2026 02:11:42 +0100
Subject: [PATCH] add second ingressroute

---
 .../vmcp-servers/kustomization.yaml           |  1 +
 .../state-docs-ngorse-ingress.yaml            | 24 +++++++++++++++++++
 .../vmcp-servers/state-docs-vmcp-ingress.yaml |  9 -------
 3 files changed, 25 insertions(+), 9 deletions(-)
 create mode 100644 manifest/overlays/production/vmcp-servers/state-docs-ngorse-ingress.yaml

diff --git a/manifest/overlays/production/vmcp-servers/kustomization.yaml b/manifest/overlays/production/vmcp-servers/kustomization.yaml
index 4541b7f..8513129 100644
--- a/manifest/overlays/production/vmcp-servers/kustomization.yaml
+++ b/manifest/overlays/production/vmcp-servers/kustomization.yaml
@@ -12,3 +12,4 @@ resources:
   - ops-safe-vmcp-ingress.yaml
   - state-docs-vmcp.yaml
   - state-docs-vmcp-ingress.yaml
+  - state-docs-ngorse-ingress.yaml
diff --git a/manifest/overlays/production/vmcp-servers/state-docs-ngorse-ingress.yaml b/manifest/overlays/production/vmcp-servers/state-docs-ngorse-ingress.yaml
new file mode 100644
index 0000000..08c109b
--- /dev/null
+++ b/manifest/overlays/production/vmcp-servers/state-docs-ngorse-ingress.yaml
@@ -0,0 +1,24 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: state-docs-vmcp-ngorse-ingress
+  namespace: toolhive-system
+  labels:
+    app.kubernetes.io/name: state-docs-vmcp
+  annotations:
+    dns.internal: 'true'
+    dns.internal.hostname: state-docs.ngorse.com
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - kind: Rule
+      match: Host(`state-docs.ngorse.com`)
+      services:
+        - name: state-docs-vmcp
+          namespace: toolhive-system
+          port: 4483
+  # No default TLSStore in this cluster, so reference the wildcard cert
+  # explicitly. olb42-wildcard-tls is auto-reflected into every namespace.
+  tls:
+    secretName: olb42-wildcard-tls
\ No newline at end of file
diff --git a/manifest/overlays/production/vmcp-servers/state-docs-vmcp-ingress.yaml b/manifest/overlays/production/vmcp-servers/state-docs-vmcp-ingress.yaml
index 509cd75..d035037 100644
--- a/manifest/overlays/production/vmcp-servers/state-docs-vmcp-ingress.yaml
+++ b/manifest/overlays/production/vmcp-servers/state-docs-vmcp-ingress.yaml
@@ -5,9 +5,6 @@ metadata:
   namespace: toolhive-system
   labels:
     app.kubernetes.io/name: state-docs-vmcp
-  annotations:
-    dns.internal: 'true'
-    dns.internal.hostname: state-docs.ngorse.com
 spec:
   entryPoints:
     - websecure
@@ -18,12 +15,6 @@ spec:
         - name: state-docs-vmcp
           namespace: toolhive-system
           port: 4483
-    - kind: Rule
-      match: Host(`state-docs.ngorse.com`)
-      services:
-        - name: state-docs-vmcp
-          namespace: toolhive-system
-          port: 4483
   # No default TLSStore in this cluster, so reference the wildcard cert
   # explicitly. olb42-wildcard-tls is auto-reflected into every namespace.
   tls: