# cert-manager issues this into the `n8n-tls` Secret.
#
# Deliberately not a certificate copied into the repo: the private key is
# generated in the cluster, rotated by cert-manager, and never reaches git.
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: n8n-tls
  namespace: ${NAMESPACE}
spec:
  secretName: n8n-tls
  dnsNames:
    - ${N8N_HOSTNAME}
  issuerRef:
    name: ${TLS_ISSUER_NAME}
    kind: ${TLS_ISSUER_KIND}