apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: vmcp-dev-safe-ingress
  namespace: toolhive-system
  labels:
    app.kubernetes.io/name: dev-safe-vmcp
spec:
  entryPoints:
    - websecure
  routes:
    - kind: Rule
      match: Host(`dev-safe.olb42.com`)
      services:
        - name: vmcp-dev-safe-vmcp
          namespace: toolhive-system
          port: 4483
  # No default TLSStore in this cluster, so reference the wildcard cert
  # explicitly. olb42-wildcard-tls is auto-reflected into every namespace.
  tls:
    secretName: olb42-wildcard-tls