ondemand-tls.yaml

# ── On-Demand TLS with CertMagic ──────────────────────────────────────────────
# Issue certificates dynamically on first request. Caddy obtains a cert when a
# client connects to a hostname — no need to pre-create Certificate resources.
#
# Two ways to use on-demand TLS:
#
# A) Global default (this file) — all certmagic Ingresses use on-demand issuance.
#    Rate limits and ask URL are configured here and apply to all routes.
#
# B) Per-Ingress annotation — enable on-demand for specific Ingresses only:
#
#    annotations:
#      caddy.ingress/tls: certmagic
#      caddy.ingress/tls-ondemand: "true"
#
#    The global ask URL and rate limits (configured below) still apply.
#
# Ingresses must have spec.tls to be routed to the HTTPS server (port 443).
# Leave secretName empty — CertMagic issues the cert on first connection.
#
# Usage (global):
#   helm install caddy ingress-caddy/caddy -n caddy --create-namespace \
#     -f examples/caddy/baremetal.yaml \
#     -f examples/caddy/ondemand-tls.yaml
#
# WARNING: Always set 'ask' URL in production to prevent certificate abuse!
# Without validation, anyone could trigger cert issuance for any domain.

tls:
  acme:
    enabled: true
    email: admin@example.com
    # Use staging CA for testing to avoid rate limits:
    # ca: "https://acme-staging-v02.api.letsencrypt.org/directory"
    challenge: http
    storage: kubernetes

    onDemand:
      enabled: true

      # IMPORTANT: Validation endpoint — must return 200 OK to allow cert issuance.
      # Deploy a service that checks the domain against your allowlist.
      # Without this, on-demand TLS is unrestricted and dangerous in production.
      ask: "http://domain-validator.caddy.svc.cluster.local/check"

      rateLimit:
        burst: 5      # max certs to issue in the interval
        interval: 2m  # time window

# ── Ingress example ───────────────────────────────────────────────────────────
# spec.tls is required for HTTPS. caddy.ingress/tls: certmagic tells caddy-k8s
# that CertMagic owns the cert — on-demand TLS issues it on first connection.
#
# ---
# apiVersion: networking.k8s.io/v1
# kind: Ingress
# metadata:
#   name: myapp
#   namespace: myapp
#   annotations:
#     caddy.ingress/tls: certmagic
# spec:
#   ingressClassName: caddy
#   tls:
#     - hosts:
#         - app.example.com
#   rules:
#     - host: app.example.com
#       http:
#         paths:
#           - path: /
#             pathType: Prefix
#             backend:
#               service:
#                 name: myapp
#                 port:
#                   number: 8080