chore: update

deploy/chart-gestion/traefik/templates/_helpers.tpl

@@ -4,9 +4,3 @@ app.kubernetes.io/name: {{ .Chart.Name }}
 app.kubernetes.io/instance: {{ .Release.Name }}
 app.kubernetes.io/managed-by: {{ .Release.Service }}
 {{- end }}
-
-{{- define "gestion-traefik.certResolver" -}}
-{{- if eq .Values.tls.mode "letsencrypt" -}}
-letsencrypt
-{{- end }}
-{{- end }}

deploy/chart-gestion/traefik/templates/ingressroute.yaml

@@ -1,84 +0,0 @@
----
-# HTTP → HTTPS redirect
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: gestion-http
-  namespace: {{ .Release.Namespace }}
-  labels:
-    {{- include "gestion-traefik.labels" . | nindent 4 }}
-spec:
-  entryPoints:
-    - web
-  routes:
-    - match: Host(`{{ .Values.domain }}`)
-      kind: Rule
-      middlewares:
-        - name: redirect-https
-      services:
-        - name: noop@internal
-          kind: TraefikService
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: redirect-https
-  namespace: {{ .Release.Namespace }}
-spec:
-  redirectScheme:
-    scheme: https
-    permanent: true
----
-# HTTPS — routes principales
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: gestion-https
-  namespace: {{ .Release.Namespace }}
-  labels:
-    {{- include "gestion-traefik.labels" . | nindent 4 }}
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    # API backend — WAF + headers + rate limit
-    - match: Host(`{{ .Values.domain }}`) && (PathPrefix(`/api/`) || PathPrefix(`/webhook/`))
-      kind: Rule
-      priority: 20
-      middlewares:
-        - name: waf-chain
-      services:
-        - name: {{ .Values.backend.serviceName }}
-          namespace: {{ .Values.servicesNamespace }}
-          port: {{ .Values.backend.servicePort }}
-
-    # Fichiers uploadés — WAF désactivé dans les règles Coraza pour ce path
-    - match: Host(`{{ .Values.domain }}`) && PathPrefix(`/uploads/`)
-      kind: Rule
-      priority: 15
-      middlewares:
-        - name: security-headers
-      services:
-        - name: {{ .Values.backend.serviceName }}
-          namespace: {{ .Values.servicesNamespace }}
-          port: {{ .Values.backend.servicePort }}
-
-    # Frontend SPA — WAF + headers + rate limit
-    - match: Host(`{{ .Values.domain }}`)
-      kind: Rule
-      priority: 1
-      middlewares:
-        - name: waf-chain
-      services:
-        - name: {{ .Values.frontend.serviceName }}
-          namespace: {{ .Values.servicesNamespace }}
-          port: {{ .Values.frontend.servicePort }}
-
-  tls:
-    {{- if eq .Values.tls.mode "letsencrypt" }}
-    certResolver: letsencrypt
-    {{- else }}
-    secretName: {{ .Values.tls.secretName }}
-    {{- end }}
-    domains:
-      - main: {{ .Values.domain }}

deploy/chart-gestion/traefik/templates/tlsstore.yaml

@@ -1,3 +1,6 @@
+# Certificat par défaut pour TOUTES les IngressRoute (ce namespace et les
+# namespaces de démo) qui ne précisent pas tls.secretName — c'est le wildcard
+# émis par cert-manager (voir deploy/cert-manager/wildcard-certificate.yml).
 apiVersion: traefik.io/v1alpha1
 kind: TLSStore
 metadata:
@@ -6,11 +9,5 @@ metadata:
   labels:
     {{- include "gestion-traefik.labels" . | nindent 4 }}
 spec:
-  {{- if eq .Values.tls.mode "secret" }}
   defaultCertificate:
     secretName: {{ .Values.tls.secretName }}
-  {{- end }}
-  defaultGeneratedCert:
-    resolver: {{ include "gestion-traefik.certResolver" . | default "letsencrypt" }}
-    domain:
-      main: {{ .Values.domain }}