From 95fcbb54412eb946dfd703ca0f840b0d99f20433 Mon Sep 17 00:00:00 2001
From: nick-gorse <nick@olb42.com>
Date: Wed, 17 Jun 2026 15:27:40 +0100
Subject: [PATCH] seperate ingress

---
 .../vmcp-servers/full-vmcp-ingress.yaml       |  6 -----
 .../full-vmcp-ngorse-ingress.yaml             | 24 +++++++++++++++++++
 2 files changed, 24 insertions(+), 6 deletions(-)
 create mode 100644 manifest/overlays/production/vmcp-servers/full-vmcp-ngorse-ingress.yaml

diff --git a/manifest/overlays/production/vmcp-servers/full-vmcp-ingress.yaml b/manifest/overlays/production/vmcp-servers/full-vmcp-ingress.yaml
index d8c307e..d48a0b0 100644
--- a/manifest/overlays/production/vmcp-servers/full-vmcp-ingress.yaml
+++ b/manifest/overlays/production/vmcp-servers/full-vmcp-ingress.yaml
@@ -19,12 +19,6 @@ spec:
         - name: vmcp-full-vmcp
           namespace: toolhive-system
           port: 4483
-    - kind: Rule
-      match: Host(`full-vmcp.ngorse.com`)
-      services:
-        - name: vmcp-full-vmcp
-          namespace: toolhive-system
-          port: 4483
   # No default TLSStore in this cluster, so reference the wildcard cert
   # explicitly. olb42-wildcard-tls is auto-reflected into every namespace.
   tls:
diff --git a/manifest/overlays/production/vmcp-servers/full-vmcp-ngorse-ingress.yaml b/manifest/overlays/production/vmcp-servers/full-vmcp-ngorse-ingress.yaml
new file mode 100644
index 0000000..575b464
--- /dev/null
+++ b/manifest/overlays/production/vmcp-servers/full-vmcp-ngorse-ingress.yaml
@@ -0,0 +1,24 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: full-vmcp-ngorse-ingress
+  namespace: toolhive-system
+  labels:
+    app.kubernetes.io/name: full-vmcp
+  annotations:
+    dns.internal: 'true'
+    dns.internal.hostname: full-vmcp.ngorse.com
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - kind: Rule
+      match: Host(`full-vmcp.ngorse.com`)
+      services:
+        - name: vmcp-full-vmcp
+          namespace: toolhive-system
+          port: 4483
+  # No default TLSStore in this cluster, so reference the wildcard cert
+  # explicitly. olb42-wildcard-tls is auto-reflected into every namespace.
+  tls:
+    secretName: ngorse-wildcard-tls
\ No newline at end of file