From 95b4669839229c32730c81a0f1f4854ef1d482d3 Mon Sep 17 00:00:00 2001
From: Will Anderson <will@neuralplatform.ai>
Date: Fri, 24 Apr 2026 15:12:37 -0500
Subject: [PATCH] feat(neuron-prod): add IngressRoute for license API at
 /api/v1/* paths

---
 .../prod/kustomization.yaml                   |  1 +
 .../prod/license-ingressroute.yaml            | 21 +++++++++++++++++++
 2 files changed, 22 insertions(+)
 create mode 100644 servers/legion/k8s/neuron-technologies/prod/license-ingressroute.yaml

diff --git a/servers/legion/k8s/neuron-technologies/prod/kustomization.yaml b/servers/legion/k8s/neuron-technologies/prod/kustomization.yaml
index b82e763..b33f7a6 100644
--- a/servers/legion/k8s/neuron-technologies/prod/kustomization.yaml
+++ b/servers/legion/k8s/neuron-technologies/prod/kustomization.yaml
@@ -9,4 +9,5 @@ resources:
   - license-deployment.yaml
   - services.yaml
   - ingress.yaml
+  - license-ingressroute.yaml
   - backup-cronjob.yaml
diff --git a/servers/legion/k8s/neuron-technologies/prod/license-ingressroute.yaml b/servers/legion/k8s/neuron-technologies/prod/license-ingressroute.yaml
new file mode 100644
index 0000000..21834a0
--- /dev/null
+++ b/servers/legion/k8s/neuron-technologies/prod/license-ingressroute.yaml
@@ -0,0 +1,21 @@
+# Traefik IngressRoute: route /api/v1/licenses/* and /api/v1/keys/* at
+# neurontechnologies.ai to the neuron-license service.
+#
+# The marketing site webhook calls: POST ${NEURON_LICENSE_API_URL}/api/v1/licenses/provision
+# Set NEURON_LICENSE_API_URL = https://neurontechnologies.ai in GCP Cloud Run.
+# (The Legion k8s deployment uses the cluster-internal URL directly.)
+
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: neuron-license-api
+  namespace: neuron-prod
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`neurontechnologies.ai`) && (PathPrefix(`/api/v1/licenses`) || PathPrefix(`/api/v1/keys`) || PathPrefix(`/api/v1/organizations`))
+      kind: Rule
+      services:
+        - name: neuron-license
+          port: 8082