# HTTP→HTTPS redirect for the authentik ingress (auth.dezky.eu), in the
# dezky-auth namespace so it can be referenced by the Helm-rendered ingress.
#
# Replaces the former global Traefik entrypoint redirect, which broke ACME
# HTTP-01 (see ../traefik/helmchartconfig.yaml). Attached to the authentik
# router via values.yaml ingress.annotations so the cert-manager solver can
# still answer the challenge on :80 at renewal.
#
# Referenced from the Ingress as: dezky-auth-redirect-https@kubernetescrd
#
# NOTE: applied out-of-band (kubectl apply -f), not part of the authentik Helm
# release — the chart only renders the Deployment/Service/Ingress.
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: redirect-https
  namespace: dezky-auth
spec:
  redirectScheme:
    scheme: https
    permanent: true
