remove nersc.org from tls request

AGENTS.md

@@ -0,0 +1,31 @@
+# Repository Guidelines
+
+This guide explains how to contribute to the Spin Helm recipes with minimal friction. Keep changes small, tested, and documented so others can reproduce them.
+
+## Project Structure & Module Organization
+- `nats/`: Helm values and kustomize post-renderer for the NATS chart; `values.yaml` for defaults and `tls-acme-values.yaml` for certificate setup. `kustomize/` patches StatefulSets/Deployments with `SPIN_UID`/`SPIN_GID`.
+- `tls-acme/`: Standalone Helm chart (`Chart.yaml`, `templates/`, `values.yaml`) for ACME-driven TLS issuance and renewals on Spin.
+- `scripts/`: Utility scripts (e.g., `scripts/mdl.sh` for markdownlint autofix).
+- Repo configs: `.pre-commit-config.yaml`, `.yamllint.yml`, `.markdownlint.rb` define lint rules; align contributions to them.
+
+## Build, Test, and Development Commands
+- `pre-commit run --all-files` to run markdownlint, yamllint, and trailing whitespace checks locally.
+- `yamllint .` to validate YAML with the repo config (line length 120, strict indentation).
+- `./scripts/mdl.sh` to autofix Markdown formatting before review.
+- `helm lint tls-acme` to sanity-check the TLS chart; add `-f <values>` as needed.
+- For NATS overlays, render and patch locally: `cd nats/kustomize && helm template nats/nats -f ../values.yaml --post-renderer ./kustomize.sh`.
+
+## Coding Style & Naming Conventions
+- YAML: 2-space indentation, descriptive keys, keep `*-values.yaml` file names and placeholder tokens (`RUN_AS_USER_PLACEHOLDER`, `FS_GROUP_PLACEHOLDER`) intact for scripted substitution.
+- Markdown: respect `.markdownlint.rb` (ordered lists, generous line length). Prefer short headings and actionable steps.
+- Shell: keep scripts POSIX/Bash compatible, check for required env vars (`SPIN_UID`, `SPIN_GID`) before use.
+
+## Testing Guidelines
+- Chart changes: run `helm lint` and, when altering templates, `helm template ... | kubectl kustomize ./nats/kustomize` to verify patches apply cleanly.
+- Functional checks occur on Spin: follow the per-directory READMEs to install/upgrade releases, then validate via `kubectl` execs (e.g., `nats rtt`) or ingress reachability.
+- Add brief notes in PRs on what was verified (commands + namespace/cluster used), especially for TLS issuance runs.
+
+## Commit & Pull Request Guidelines
+- Commits: imperative mood with scope when helpful (e.g., `nats: adjust websocket ingress whitelist`); group related changes.
+- PRs: include a summary of changes, linked issues (if any), values files touched, commands run, and relevant logs or screenshots for install/upgrade attempts.
+- Avoid committing secrets or cluster-specific kubeconfigs; keep sensitive values in local overrides and document placeholders instead.

tls-acme/README.md

@@ -130,8 +130,8 @@ helm install -n <namespace> -f values.yaml acmecron .
 The results of this installation are:
 
 1. A self-generated TLS certificate saved into a secret named `tls-cert`;
-2. A new ingress in the namespace, with rules for each of the domains, including the default Spin domain, pointing to the existing web server and its http port; the ingress will also use the self-generated certificate for all the domains;
-3. A cronjob which runs every two months to reuqest/renew a TLS certificate, and repalce the self-generated TLS certificate with it. The requested certificate will include all the listed domains in the ingress.
+2. A new ingress in the namespace, with rules for each of the domains, including the default Spin domain, pointing to the existing web server and its http port; the default Spin domain is intentionally not listed in the certificate SANs, so accessing it directly will show a certificate warning.
+3. A cronjob which runs every two months to reuqest/renew a TLS certificate, and repalce the self-generated TLS certificate with it. The requested certificate will include only the user-facing domains you list in `values.yaml`.
 
 #### Post installation setup (1)
 
@@ -178,7 +178,7 @@ set `useCase` to `case2`, and then re-run `./prepare-values.sh`:
 Different than _Case 1_, this installation of the chart will result in:
 
 1. A deployment of a simple web server, running on port 8080 internally;
-2. A new ingress in the namespace, pointing all of the domains, including the default Spin domain, to the newly created web server and its port 8080.
+2. A new ingress in the namespace, pointing all of the domains, including the default Spin domain, to the newly created web server and its port 8080. The default Spin domain remains outside the certificate SANs on purpose, so it shows a certificate warning if accessed directly.
 
 #### Post installation setup (2)
 

tls-acme/prepare-values.sh

@@ -12,7 +12,7 @@ nersc_user_group="<your-group-id>"
 service_port="8080"
 ingress_name="adminer" # <ingress_name>.<namespace>.<cluster>.svc.spin.nersc.org
 domain="<your-domain>"
-domain_list="<your-domain>:<your-service-name>.<your-namespace>.<your-cluster-domain>"
+domain_list="<your-domain>"
 email="<your-email>"
 cluster="<your-cluster-domain>"
 use_case="case2"

tls-acme/templates/ingress.yaml

@@ -37,7 +37,6 @@ spec:
         {{- range .hosts }}
         - {{ . | quote }}
         {{- end }}
-        - {{ $fullName }}.{{ $.Release.Namespace }}.{{ $.Values.cluster }}
       secretName: {{ $.Values.cert.secretName }}
     {{- end }}
   {{- end }}

tls-acme/values_template.yaml

@@ -40,18 +40,19 @@ ingress:
   enabled: true
   className: nginx
   hosts:
-    # you can have multiple hosts, all will be added to the same ingress
-    - host: {{domain}} # DNS CNAME record, or <ingress_name>.<namespace>.<cluster>.svc.spin.nersc.org
+    # you can have multiple user-facing hosts; the chart also adds the default Spin host
+    # <ingress_name>.<namespace>.<cluster> as an ingress-only route automatically.
+    - host: {{domain}} # DNS CNAME record that users should access directly
       paths:
         - path: /
           pathType: Prefix
   tls:
-    # you can have multiple hosts, all will be added to the same ingress,
-    # and use the same certificate (with DNS alias in SANs)
+    # List only the user-facing hosts that should be present in the certificate SANs.
+    # The default Spin host is intentionally excluded so it presents a certificate warning.
     - hosts:
         - {{domain}} # same as .ingress.hosts.host
 
-# concatenate the list .ingress.hosts.host into ":" separated string
+# concatenate only the certificate host list into a ":" separated string
 domain: {{domain_list}}
 
 email: {{email}} # email address to be used for the ACME account