apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: state-docs-vmcp-ngorse-ingress
  namespace: toolhive-system
  labels:
    app.kubernetes.io/name: state-docs-vmcp
  annotations:
    dns.internal: 'true'
    dns.internal.hostname: state-docs.ngorse.com
spec:
  entryPoints:
    - websecure
  routes:
    - kind: Rule
      match: Host(`state-docs.ngorse.com`)
      services:
        - name: state-docs-vmcp
          namespace: toolhive-system
          port: 4483
  # No default TLSStore in this cluster, so reference the wildcard cert
  # explicitly. olb42-wildcard-tls is auto-reflected into every namespace.
  tls:
    secretName: ngorse-wildcard-tls