1# ============================================================================= 2# AI Software Factory — Ingress (nginx ingress controller) 3# 4# Host: factory.example.com → web (3000) for "/" 5# /api → api (4000) 6# /ws → realtime (4001, WebSocket upgrade) 7# 8# Assumes cert-manager is installed; the certificate is issued for the host 9# below. Swap the host + TLS secret name for your environment. 10# ============================================================================= 11apiVersion: networking.k8s.io/v1 12kind: Ingress 13metadata: 14 name: factory 15 annotations: 16 # --- TLS: cert-manager issues the certificate into the tls secret --- 17 cert-manager.io/cluster-issuer: "letsencrypt-prod" 18 # --- WebSocket support for /ws --- 19 nginx.ingress.kubernetes.io/proxy-read-timeout: "3600" 20 nginx.ingress.kubernetes.io/proxy-send-timeout: "3600" 21 nginx.ingress.kubernetes.io/proxy-buffering: "off" 22 # --- Large file uploads via the API (multipart / presigned passthrough) --- 23 nginx.ingress.kubernetes.io/proxy-body-size: "512m" 24 # --- Generic hardening --- 25 nginx.ingress.kubernetes.io/force-ssl-redirect: "true" 26 # CORS handled by the API (strict allow-list); no annotation here. 27spec: 28 ingressClassName: nginx 29 tls: 30 - hosts: 31 - factory.example.com 32 secretName: factory-tls 33 rules: 34 - host: factory.example.com 35 http: 36 paths: 37 # REST API 38 - path: /api 39 pathType: Prefix 40 backend: 41 service: 42 name: api 43 port: 44 number: 4000 45 # WebSocket realtime endpoint 46 - path: /ws 47 pathType: Prefix 48 backend: 49 service: 50 name: realtime 51 port: 52 number: 4001 53 # Everything else → Next.js web app 54 - path: / 55 pathType: Prefix 56 backend: 57 service: 58 name: web 59 port: 60 number: 3000 61