From 95defaf0fbfcdbcfdb639c80fb4953b3486b3e12 Mon Sep 17 00:00:00 2001
From: zai-agent <agent@djg-oracle-sl>
Date: Wed, 16 Sep 2026 05:26:20 +0000
Subject: [PATCH] Buzz relay bridge: Traefik ingress + cert for
 buzz.bestdadjokes.lol (wss verified)

---
 buzz/k8s/buzz-relay.yaml | 55 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 55 insertions(+)
 create mode 100644 buzz/k8s/buzz-relay.yaml

diff --git a/buzz/k8s/buzz-relay.yaml b/buzz/k8s/buzz-relay.yaml
new file mode 100644
index 0000000..1467d4f
--- /dev/null
+++ b/buzz/k8s/buzz-relay.yaml
@@ -0,0 +1,55 @@
+# Buzz relay (docker compose on host, bound to 10.0.0.215:3000) bridged into the
+# cluster so Traefik can serve it at buzz.bestdadjokes.lol with a cluster cert.
+# Service has no selector; Endpoints pin the host IP + docker-published port.
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: buzz-relay
+spec:
+  ports:
+    - port: 80
+      targetPort: 3000
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: buzz-relay
+subsets:
+  - addresses:
+      - ip: 10.0.0.215
+    ports:
+      - port: 3000
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: buzz-relay
+spec:
+  rules:
+    - host: buzz.bestdadjokes.lol
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: buzz-relay
+                port:
+                  number: 80
+  tls:
+    - hosts:
+        - buzz.bestdadjokes.lol
+      secretName: buzz-bestdadjokes-tls
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: buzz-bestdadjokes
+spec:
+  secretName: buzz-bestdadjokes-tls
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+    - buzz.bestdadjokes.lol