---
id: w4/m1/t005
title: Traefik IngressRoutes + cert-manager for Kratos/Hydra public endpoints
worker: worker4
status: done
estimate: 25m
depends_on: [w4/m1/t003, w4/m1/t004]
---

## Objective

Expose the public endpoints — Kratos self-service API and Hydra OAuth2/OIDC — under the base domain via Traefik with cert-manager TLS, following the same pattern as app URLs (`BEX_BASE_DOMAIN`, `BEX_CLUSTER_ISSUER`). Admin APIs stay cluster-internal.

## Context

- Traefik + cert-manager already run as base components (`deploy/gitops/base/traefik.yaml`, `cert-manager.yaml`, `cert-manager-issuers.yaml`); `docs/ADR005-custom-domain.md` shows the routing/cert pattern.
- Proposed hosts: `auth.<base-domain>` → Kratos public, `oauth.<base-domain>` → Hydra public; Hydra's `urls.self.issuer` (t004) must match the final host.
- Local overlay uses the local base domain / issuer equivalents.

## Steps

1. Add IngressRoute (or chart-native ingress values) for Kratos public and Hydra public with cert-manager annotations.
2. Ensure admin Services have no route.
3. Align Hydra issuer URL with the exposed host; re-sync.
4. Verify TLS + routing from outside the cluster on the local mock.

## Files

- `deploy/gitops/base/values/kratos.values.yaml`
- `deploy/gitops/base/values/hydra.values.yaml`
- `deploy/gitops/base/` ingress manifests if not chart-native (new)
- `deploy/gitops/overlays/local/kustomization.yaml`

## Acceptance criteria

- [ ] `https://oauth.<base-domain>/.well-known/openid-configuration` serves the discovery document with the matching issuer.
- [ ] `https://auth.<base-domain>/health/ready` (Kratos public) returns ok.
- [ ] Admin endpoints are not reachable through Traefik.

## Out of scope

- Custom per-tenant auth domains; production DNS records.
