---
# Certificate for Docker registry (cert-manager — required for IngressRoute)
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: registry-tls
  namespace: registry
spec:
  secretName: registry-tls
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  dnsNames:
    - registry.neuralplatform.ai
---
# Docker registry — IngressRoute with no buffering middleware.
# Traefik streams blob data directly to the registry backend.
# The Buffering middleware was causing 413s on large layer pushes by
# spooling the entire body to disk before forwarding.
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: registry
  namespace: registry
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`registry.neuralplatform.ai`)
      kind: Rule
      services:
        - name: registry
          port: 5000
          responseForwarding:
            flushInterval: "100ms"
  tls:
    secretName: registry-tls
---
# Certificate for Docker registry UI
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: docker-ui-tls
  namespace: registry
spec:
  secretName: docker-ui-tls
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  dnsNames:
    - docker.neuralplatform.ai
---
# Docker registry UI
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: registry-ui
  namespace: registry
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`docker.neuralplatform.ai`)
      kind: Rule
      services:
        - name: registry-ui
          port: 80
  tls:
    secretName: docker-ui-tls