apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: ha-gateway-tls
  namespace: home-services
spec:
  secretName: ha-gateway-tls
  issuerRef:
    name: internal-ca-issuer
    kind: ClusterIssuer
  commonName: ha-gateway
  dnsNames:
    - ha-gateway.home-services.svc.cluster.local
    - ha-gateway
  usages:
    - server auth
    - digital signature
    - key encipherment
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: discord-bot-tls
  namespace: home-services
spec:
  secretName: discord-bot-tls
  issuerRef:
    name: internal-ca-issuer
    kind: ClusterIssuer
  commonName: discord-bot
  usages:
    - client auth
    - digital signature
    - key encipherment
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: ai-gateway-tls
  namespace: home-services
spec:
  secretName: ai-gateway-tls
  issuerRef:
    name: internal-ca-issuer
    kind: ClusterIssuer
  commonName: ai-gateway
  dnsNames:
    - ai-gateway.home-services.svc.cluster.local
    - ai-gateway
  usages:
    - server auth
    - client auth
    - digital signature
    - key encipherment
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: tts-gateway-tls
  namespace: home-services
spec:
  secretName: tts-gateway-tls
  issuerRef:
    name: internal-ca-issuer
    kind: ClusterIssuer
  commonName: tts-gateway
  dnsNames:
    - tts-gateway.home-services.svc.cluster.local
    - tts-gateway
  usages:
    - server auth
    - digital signature
    - key encipherment
---
# Client-only cert for alexa-bridge's mTLS call to ha-gateway - modeled on
# discord-bot-tls above, not ai-gateway-tls, since alexa-bridge (like
# discord-bot) only dials out over mTLS and doesn't itself serve mTLS gRPC.
# This is a distinct cert/issuer from alexa-bridge's public HTTPS ingress
# cert (see alexa-bridge-public-ingress.yaml) - that one is letsencrypt-prod
# for the internet-facing Alexa endpoint; this one is the internal CA for
# the ha-gateway leg. Do not conflate the two.
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: alexa-bridge-tls
  namespace: home-services
spec:
  secretName: alexa-bridge-tls
  issuerRef:
    name: internal-ca-issuer
    kind: ClusterIssuer
  commonName: alexa-bridge
  usages:
    - client auth
    - digital signature
    - key encipherment