apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: dharma
  namespace: neuron-prod
  labels:
    app: dharma
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`dharma.neurontechnologies.ai`)
      kind: Rule
      services:
        - name: dharma
          port: 8765
  # TLS terminates at Cloudflare; tunnel reaches Traefik with noTLSVerify.
  # Traefik websecure entrypoint has its own default cert (no resolver
  # configured in this cluster), matching every other neuron-prod IngressRoute.