apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: signalledger
  namespace: openclaw-private
  labels:
    app.kubernetes.io/name: signalledger
    app.kubernetes.io/component: frontend
    app.kubernetes.io/part-of: signalledger
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/configuration-snippet: |
      more_set_headers "Strict-Transport-Security: max-age=31536000; includeSubDomains; preload";
      more_set_headers "X-Frame-Options: DENY";
      more_set_headers "X-Content-Type-Options: nosniff";
      more_set_headers "Referrer-Policy: strict-origin-when-cross-origin";
      more_set_headers "Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://pagead2.googlesyndication.com https://partner.googleadservices.com https://tpc.googlesyndication.com; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; font-src 'self'; connect-src 'self'; frame-src https://googleads.g.doubleclick.net; object-src 'none'; base-uri 'self'; form-action 'self';";
      more_set_headers "X-XSS-Protection: 1; mode=block";
      more_set_headers "Permissions-Policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()";
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - signalledger.nl
        - www.signalledger.nl
      secretName: signalledger-tls
  rules:
    - host: signalledger.nl
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: signalledger
                port:
                  number: 80
    - host: www.signalledger.nl
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: signalledger
                port:
                  number: 80