Buzz relay bridge: Traefik ingress + cert for buzz.bestdadjokes.lol (wss verified)

buzz/k8s/buzz-relay.yaml

@@ -0,0 +1,55 @@
+# Buzz relay (docker compose on host, bound to 10.0.0.215:3000) bridged into the
+# cluster so Traefik can serve it at buzz.bestdadjokes.lol with a cluster cert.
+# Service has no selector; Endpoints pin the host IP + docker-published port.
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: buzz-relay
+spec:
+  ports:
+    - port: 80
+      targetPort: 3000
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: buzz-relay
+subsets:
+  - addresses:
+      - ip: 10.0.0.215
+    ports:
+      - port: 3000
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: buzz-relay
+spec:
+  rules:
+    - host: buzz.bestdadjokes.lol
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: buzz-relay
+                port:
+                  number: 80
+  tls:
+    - hosts:
+        - buzz.bestdadjokes.lol
+      secretName: buzz-bestdadjokes-tls
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: buzz-bestdadjokes
+spec:
+  secretName: buzz-bestdadjokes-tls
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+    - buzz.bestdadjokes.lol