{#
  Managed by Ansible (roles/k3s_cert_manager) — do not edit on the node.

  Plain manifest, not a HelmChart — same pattern as
  roles/k3s_metallb/templates/metallb-config.yaml.j2 and
  roles/k3s_postgres/templates/postgres-cluster.yaml.j2: this references a
  CRD (cert-manager.io) that only exists once the chart alongside it has
  installed, and k3s's deploy controller retries rather than giving up.

  ClusterIssuer rather than Issuer so it's usable from every namespace —
  an app's Ingress just annotates itself with
  `cert-manager.io/cluster-issuer: {{ k3s_cert_manager_issuer_name }}` and
  needs no ACME account or DNS credentials of its own.
-#}
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: {{ k3s_cert_manager_issuer_name }}
spec:
  acme:
    server: {{ k3s_cert_manager_acme_server }}
    email: {{ k3s_cert_manager_acme_email }}
    # Where cert-manager keeps the ACME *account* key it generates on first
    # registration — not any certificate's key. In the cert-manager namespace
    # because a ClusterIssuer's secrets always resolve there, regardless of
    # which namespace the Certificate using it lives in.
    privateKeySecretRef:
      name: {{ k3s_cert_manager_acme_key_secret }}
    solvers:
{{ [k3s_cert_manager_solver] | to_nice_yaml(indent=2) | indent(6, first=true) }}