# ClusterIssuer voor Let's Encrypt via Cloudflare DNS-01 (voor labzand.com).
# Vereist een secret in namespace cert-manager (ClusterIssuer mag alleen
# secrets uit de cert-manager namespace lezen), bijv. via sealed-secrets:
#
#   apiVersion: v1
#   kind: Secret
#   metadata:
#     name: cloudflare-api-token
#     namespace: cert-manager
#   stringData:
#     api-token: <CLOUDFLARE_API_TOKEN>
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: cloudflare-dns
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: wulsspaans@gmail.com
    privateKeySecretRef:
      name: cloudflare-dns-account-key
    solvers:
      - dns01:
          cloudflare:
            apiTokenSecretRef:
              name: cloudflare-api-token
              key: api-token