# services/hermes/agent-certificate.yaml
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: hermes-sites-tls
  namespace: hermes
spec:
  secretName: hermes-sites-tls
  issuerRef:
    kind: ClusterIssuer
    name: letsencrypt
  dnsNames:
    # worker.bstein.dev is the canonical owner-agent host. agent.hermes.bstein.dev
    # stays on the certificate until the old host is retired in a separate change.
    - agent.hermes.bstein.dev
    - chat.bstein.dev
    - triage.bstein.dev
    - worker.bstein.dev