apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: full-vmcp-ingress
  namespace: toolhive-system
  labels:
    app.kubernetes.io/name: full-vmcp
  # annotations:
    # dns.public: 'false'
    # dns.public.access.policy: google-ws
    # dns.public.hostname: full-vmcp.olb42.com
spec:
  entryPoints:
    - websecure
  routes:
    - kind: Rule
      match: Host(`full-vmcp.olb42.com`)
      services:
        - name: vmcp-full-vmcp
          namespace: toolhive-system
          port: 4483
    - kind: Rule
      match: Host(`full-vmcp.ngorse.com`)
      services:
        - name: vmcp-full-vmcp
          namespace: toolhive-system
          port: 4483
  # No default TLSStore in this cluster, so reference the wildcard cert
  # explicitly. olb42-wildcard-tls is auto-reflected into every namespace.
  tls:
    secretName: olb42-wildcard-tls