# ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: immich-local-ingress
  namespace: immich
  annotations:
    # AUTOMATED TLS FIX: Triggers cert-manager to provision the certificate
    cert-manager.io/cluster-issuer: "letsencrypt-production"
    # THE 502 FIX: Instructs NGINX to bridge to the unencrypted pod port 2283
    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
    # THE UPLOAD FIX: Disables NGINX's default 1MB file size boundary block
    nginx.ingress.kubernetes.io/proxy-body-size: "0"
    # Optional but highly recommended: Stops NGINX from buffering heavy media uploads to local node drives first
    nginx.ingress.kubernetes.io/proxy-request-buffering: "off"
spec:
  ingressClassName: nginx
  # AUTOMATED TLS FIX: Instructs NGINX where to mount the generated certificate
  tls:
    - secretName: immich-tls-secret
      hosts:
        - photos.needlestack.boo
  rules:
  - host: photos.needlestack.boo
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: immich-server
            port:
              number: 2283