# cert-manager issues this into the `librechat-tls` Secret.
#
# It replaces a hand-made `tls.yaml` that carried the lab CA's own certificate
# and private key, which LibreChat then served as its server certificate — a
# CA:TRUE certificate valid for the whole `*.sttlab.local` wildcard, where a
# leaf for one name is what a server needs.
#
# The key is generated in the cluster, rotated by cert-manager, and never
# reaches a file anyone has to remember not to commit.
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: librechat-tls
  namespace: librechat
spec:
  secretName: librechat-tls
  dnsNames:
    - librechat.sttlab.local
  issuerRef:
    name: sttlab-local-ca
    kind: ClusterIssuer