From 11e983f26bc9c0e77520e312010144e2cf78b631 Mon Sep 17 00:00:00 2001
From: Slawomir Koszewski <slawek@koszewscy.waw.pl>
Date: Sun, 26 Jul 2026 21:41:26 +0200
Subject: [PATCH] docs: update Ingress configuration to enable HTTPS and
 preserve client IP for ok-server

---
 README.md               | 29 ++++++++++++++++++++---------
 k3s/expose-ingress.yaml |  3 +++
 2 files changed, 23 insertions(+), 9 deletions(-)

diff --git a/README.md b/README.md
index 33147fb..43bb319 100644
--- a/README.md
+++ b/README.md
@@ -118,27 +118,38 @@ Expose the app with one of the two options below.
 #### Option 1: Traefik Ingress
 
 k3s includes the Traefik ingress controller. The ClusterIP Service and Ingress
-in [k3s/expose-ingress.yaml](k3s/expose-ingress.yaml) expose the app on port 80
-for the host name `ok-server.example.org`. Change the `host` value in the
-Ingress to your own FQDN and point its DNS record at the node's IP address:
+in [k3s/expose-ingress.yaml](k3s/expose-ingress.yaml) expose the app over HTTPS
+on port 443 for the host name `ok-server.example.org`. Change the `host` value
+in the Ingress to your own FQDN and point its DNS record at the node's IP
+address:
 
 ```bash
 kubectl apply -f k3s/expose-ingress.yaml
-curl -si "http://ok-server.example.org/"
+curl -si "https://ok-server.example.org/"
 ```
 
 Without a DNS record you can still test the host rule by mapping the name to
-the node's IP address on the curl command line:
+the node's IP address on the curl command line (`-k` skips certificate
+verification, since no certificate can be issued before DNS works):
 
 ```bash
-curl -si --resolve ok-server.example.org:80:<node-ip> "http://ok-server.example.org/"
+curl -sik --resolve ok-server.example.org:443:<node-ip> "https://ok-server.example.org/"
 ```
 
+The TLS certificate comes from a Traefik certificate resolver named `le`,
+referenced by the `traefik.ingress.kubernetes.io/router.tls.certresolver`
+annotation on the Ingress. Configuring the resolver is out of scope for this
+project; it is expected to already exist in your Traefik installation. If your
+resolver has a different name, change the annotation value accordingly. To
+serve plain HTTP instead, remove the three `traefik.ingress.kubernetes.io`
+annotations from the Ingress.
+
 By default the app sees a cluster-internal address (for example `10.42.0.1`)
 instead of the real client IP, because the Traefik Service runs with
-`externalTrafficPolicy: Cluster`. To preserve the client IP, set
-`externalTrafficPolicy: Local` on the Traefik Service through a
-`HelmChartConfig`, as in [k3s/traefik-config.yaml](k3s/traefik-config.yaml).
+`externalTrafficPolicy: Cluster`. The `HelmChartConfig` in
+[k3s/traefik-config.yaml](k3s/traefik-config.yaml) sets
+`externalTrafficPolicy: Local` on the Traefik Service to preserve the client
+IP.
 
 A cluster can hold only one `HelmChartConfig` named `traefik`, so first check
 whether one already exists:
diff --git a/k3s/expose-ingress.yaml b/k3s/expose-ingress.yaml
index 2f7ff2c..8dd90a8 100644
--- a/k3s/expose-ingress.yaml
+++ b/k3s/expose-ingress.yaml
@@ -13,6 +13,9 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: ok-server
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls.certresolver: le
 spec:
   rules:
     - host: ok-server.example.org