# services/hermes/agent-certificate.yaml
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: hermes-sites-tls
  namespace: hermes
spec:
  secretName: hermes-sites-tls
  issuerRef:
    kind: ClusterIssuer
    name: letsencrypt
  dnsNames:
    - agent.hermes.bstein.dev
    - chat.bstein.dev
    - triage.bstein.dev
    # Legacy hosts stay on the certificate until they are retired on purpose;
    # the rename in #34 must not break links or sessions already in flight.
    - chat.hermes.bstein.dev
    - triage.hermes.bstein.dev
    # worker.bstein.dev is the canonical owner-agent host; the legacy
    # agent.hermes.bstein.dev SAN above stays until it is retired on purpose.
    - worker.bstein.dev