apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: vmcp-ops-safe-ingress
  namespace: toolhive-system
  labels:
    app.kubernetes.io/name: ops-safe-vmcp
  annotations:
    dns.public: 'true'
    dns.public.access.policy: bypass
    dns.public.hostname: ops-safe.olb42.com

spec:
  entryPoints:
    - websecure
  routes:
    - kind: Rule
      match: Host(`ops-safe.olb42.com`)
      services:
        - name: vmcp-ops-safe-vmcp
          namespace: toolhive-system
          port: 4483
  # No default TLSStore in this cluster, so reference the wildcard cert
  # explicitly. olb42-wildcard-tls is auto-reflected into every namespace.
  tls:
    secretName: olb42-wildcard-tls