---
# cert-manager — issues trusted Let's Encrypt certs via ACME DNS-01 (ADR-0006). Phase 0 STUB.
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: cert-manager
  namespace: cert-manager
spec:
  interval: 30m
  chart:
    spec:
      chart: cert-manager
      version: ">=1.17.0 <1.18.0"   # TODO(WS-SEC): pin at bring-up; Renovate maintains
      sourceRef:
        kind: HelmRepository
        name: jetstack
        namespace: cert-manager
  install:
    remediation:
      retries: 3
  upgrade:
    remediation:
      retries: 3
  values:
    crds:
      enabled: true      # install CRDs with the chart
    # DNS-01 self-check via PUBLIC resolvers. The k3s-dev cluster is NAT'd and its DNS can't resolve
    # the public _acme-challenge TXT that cert-manager creates in Cloudflare (VERIFIED: the record IS
    # publicly resolvable via 1.1.1.1/8.8.8.8, but the in-cluster self-check timed out — "not yet
    # propagated"). Point the propagation check straight at public resolvers so it never relies on
    # cluster/split-horizon DNS (docs/09 split-horizon note; realises the TODO that was here).
    dns01RecursiveNameservers: "1.1.1.1:53,8.8.8.8:53"
    dns01RecursiveNameserversOnly: true