From a6421a5f985fbefa12c6b823c3add56082e844b6 Mon Sep 17 00:00:00 2001
From: Will Anderson <will@neuralplatform.ai>
Date: Sat, 25 Apr 2026 01:25:39 -0500
Subject: [PATCH] feat(api): expose api.neurontechnologies.ai + add Stripe and
 R2 secrets
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Add api.neurontechnologies.ai DNS CNAME → CF tunnel
- Add tunnel ingress rule for api.neurontechnologies.ai → Traefik
- Create rest-ingressroute.yaml: api.neurontechnologies.ai → neuron-rest:8081
- Add STRIPE_SECRET_KEY to neuron-prod ExternalSecret (from marketing-test Vault)
---
 servers/legion/dns-neurontechnologies.tf       |  9 +++++++++
 .../prod/externalsecret.yaml                   |  4 ++++
 .../prod/kustomization.yaml                    |  1 +
 .../prod/rest-ingressroute.yaml                | 18 ++++++++++++++++++
 servers/legion/main.tf                         |  9 +++++++++
 5 files changed, 41 insertions(+)
 create mode 100644 servers/legion/k8s/neuron-technologies/prod/rest-ingressroute.yaml

diff --git a/servers/legion/dns-neurontechnologies.tf b/servers/legion/dns-neurontechnologies.tf
index 2323c90..5040329 100644
--- a/servers/legion/dns-neurontechnologies.tf
+++ b/servers/legion/dns-neurontechnologies.tf
@@ -7,6 +7,15 @@
 # proxied = true enables Cloudflare proxy (CDN, DDoS, SSL termination).
 # ttl = 1 means "auto" when proxied.
 
+resource "cloudflare_record" "nt_tunnel_api" {
+  zone_id = local.zone_neurontechnologies_ai
+  name    = "api"
+  type    = "CNAME"
+  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
+  proxied = true
+  ttl     = 1
+}
+
 resource "cloudflare_record" "nt_tunnel_prod" {
   zone_id = local.zone_neurontechnologies_ai
   name    = "@"
diff --git a/servers/legion/k8s/neuron-technologies/prod/externalsecret.yaml b/servers/legion/k8s/neuron-technologies/prod/externalsecret.yaml
index 2d2e999..a942dc7 100644
--- a/servers/legion/k8s/neuron-technologies/prod/externalsecret.yaml
+++ b/servers/legion/k8s/neuron-technologies/prod/externalsecret.yaml
@@ -48,3 +48,7 @@ spec:
       remoteRef:
         key: secret/data/r2
         property: neuron_bucket
+    - secretKey: STRIPE_SECRET_KEY
+      remoteRef:
+        key: secret/data/neuron-technologies/marketing-test
+        property: stripe_secret_key
diff --git a/servers/legion/k8s/neuron-technologies/prod/kustomization.yaml b/servers/legion/k8s/neuron-technologies/prod/kustomization.yaml
index 15f513d..3d1ae8b 100644
--- a/servers/legion/k8s/neuron-technologies/prod/kustomization.yaml
+++ b/servers/legion/k8s/neuron-technologies/prod/kustomization.yaml
@@ -11,6 +11,7 @@ resources:
   - services.yaml
   - ingress.yaml
   - license-ingressroute.yaml
+  - rest-ingressroute.yaml
   - backup-cronjob.yaml
   - runpod-inference.yaml
   - runpod-lb-configmap.yaml
diff --git a/servers/legion/k8s/neuron-technologies/prod/rest-ingressroute.yaml b/servers/legion/k8s/neuron-technologies/prod/rest-ingressroute.yaml
new file mode 100644
index 0000000..89aeb30
--- /dev/null
+++ b/servers/legion/k8s/neuron-technologies/prod/rest-ingressroute.yaml
@@ -0,0 +1,18 @@
+# Traefik IngressRoute: api.neurontechnologies.ai → neuron-rest service
+# Exposes the Neuron backend REST API externally for CLI and web clients.
+# CLI config: api_url = https://api.neurontechnologies.ai
+
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: neuron-rest-api
+  namespace: neuron-prod
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`api.neurontechnologies.ai`)
+      kind: Rule
+      services:
+        - name: neuron-rest
+          port: 8081
diff --git a/servers/legion/main.tf b/servers/legion/main.tf
index b0f01ec..ccf8aa2 100644
--- a/servers/legion/main.tf
+++ b/servers/legion/main.tf
@@ -207,6 +207,15 @@ resource "cloudflare_zero_trust_tunnel_cloudflared_config" "legion" {
       }
     }
 
+    # api.neurontechnologies.ai — Neuron REST backend (neuron-rest service)
+    ingress_rule {
+      hostname = "api.neurontechnologies.ai"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
     # sign.neurontechnologies.ai — Docuseal e-signature
     ingress_rule {
       hostname = "sign.neurontechnologies.ai"