feat(sol): add public edge ingress and tls

environments/sol/public-edge/README.md

@@ -0,0 +1,46 @@
+# sol public edge
+
+Public ingress and TLS edge for the reconstructed `R001` trade surface on `sol`.
+
+## Purpose
+
+- install an ingress controller on `sol`
+- install `cert-manager`
+- define `ClusterIssuer/letsencrypt-prod`
+- publish `trade-r001-canary/trade-frontend` on `trade.mpabi.pl`
+
+## Design
+
+- ingress controller: `Traefik`
+- controller exposure model: `hostPort` on `80` and `443`
+- TLS automation: `cert-manager` with `Let's Encrypt` `HTTP-01`
+- public host in this phase: `trade.mpabi.pl`
+- application auth remains in `trade-frontend`; ingress only terminates traffic
+
+## Operator Flow
+
+1. Prepare the host firewall from `trade-next/trade-host-iac`:
+
+```bash
+./sol/public-edge/scripts/prepare-sol-public-edge.sh
+```
+
+2. Push this repository to `main` and let `deploy-sol-public-edge` apply the cluster-side resources.
+
+The workflow bootstraps `cert-manager` and `Traefik` first, then applies `ClusterIssuer/letsencrypt-prod` only after the cert-manager CRDs are ready.
+
+3. Update the authoritative DNS record:
+
+- `trade.mpabi.pl A 149.50.96.162`
+
+4. Re-run the smoke checks:
+
+```bash
+./environments/sol/public-edge/scripts/check-sol-public-edge.sh
+./environments/sol/trade-r001-canary/scripts/check-sol-canary-smoke.sh
+```
+
+## Notes
+
+- Before DNS cutover, the HTTP ingress can still be verified using `curl --resolve`.
+- `cert-manager` will not be able to complete the `HTTP-01` challenge until the public `A` record points at `149.50.96.162`.

environments/sol/public-edge/cert-manager-helmchart.yaml

@@ -0,0 +1,20 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: cert-manager
+  namespace: kube-system
+spec:
+  repo: https://charts.jetstack.io
+  chart: cert-manager
+  version: v1.20.1
+  targetNamespace: cert-manager
+  createNamespace: true
+  failurePolicy: abort
+  valuesContent: |-
+    crds:
+      enabled: true
+    prometheus:
+      enabled: false
+    global:
+      leaderElection:
+        namespace: cert-manager

environments/sol/public-edge/cert-manager-namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cert-manager

environments/sol/public-edge/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - cert-manager-namespace.yaml
+  - cert-manager-helmchart.yaml
+  - traefik-helmchart.yaml
+  - letsencrypt-prod-clusterissuer.yaml
+  - trade-frontend-public-ingress.yaml

environments/sol/public-edge/letsencrypt-prod-clusterissuer.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    email: u1@rv32i.pl
+    server: https://acme-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: letsencrypt-prod-account-key
+    solvers:
+      - http01:
+          ingress:
+            ingressClassName: traefik

environments/sol/public-edge/scripts/check-sol-public-edge.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+TARGET_HOST="${TARGET_HOST:-mevnode}"
+PUBLIC_IP="${PUBLIC_IP:-149.50.96.162}"
+PUBLIC_HOST="${PUBLIC_HOST:-trade.mpabi.pl}"
+
+ssh_target() {
+  ssh -o StrictHostKeyChecking=no "$TARGET_HOST" "$@"
+}
+
+echo "[1/5] Host listeners"
+ssh_target "sudo ss -ltn '( sport = :80 or sport = :443 )'"
+
+echo
+echo "[2/5] Controller state"
+ssh_target '
+  set -euo pipefail
+  sudo k3s kubectl -n kube-system get ds traefik -o wide
+  sudo k3s kubectl -n cert-manager get deploy -o wide
+'
+
+echo
+echo "[3/5] Issuer and ingress"
+ssh_target '
+  set -euo pipefail
+  sudo k3s kubectl get clusterissuer letsencrypt-prod -o wide
+  sudo k3s kubectl -n trade-r001-canary get ingress trade-frontend-public -o wide
+  sudo k3s kubectl -n trade-r001-canary get certificate,order,challenge 2>/dev/null || true
+'
+
+echo
+echo "[4/5] HTTP health via public IP"
+curl -fsS --resolve "${PUBLIC_HOST}:80:${PUBLIC_IP}" "http://${PUBLIC_HOST}/healthz"
+echo
+
+echo
+echo "[5/5] DNS and TLS state"
+resolved_ip="$(getent ahostsv4 "${PUBLIC_HOST}" | awk 'NR==1 {print $1}')"
+echo "resolved_ip=${resolved_ip:-<none>}"
+if [ "${resolved_ip:-}" = "${PUBLIC_IP}" ]; then
+  curl -fsS --resolve "${PUBLIC_HOST}:443:${PUBLIC_IP}" "https://${PUBLIC_HOST}/healthz"
+  echo
+else
+  echo "TLS check skipped until ${PUBLIC_HOST} resolves to ${PUBLIC_IP}"
+fi
+
+echo
+echo "Public edge check completed for ${PUBLIC_HOST}"

environments/sol/public-edge/trade-frontend-public-ingress.yaml

@@ -0,0 +1,24 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: trade-frontend-public
+  namespace: trade-r001-canary
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - trade.mpabi.pl
+      secretName: trade-mpabi-pl-tls
+  rules:
+    - host: trade.mpabi.pl
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: trade-frontend
+                port:
+                  number: 8081

environments/sol/public-edge/traefik-helmchart.yaml

@@ -0,0 +1,53 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: traefik
+  namespace: kube-system
+spec:
+  repo: https://traefik.github.io/charts
+  chart: traefik
+  version: 39.0.7
+  targetNamespace: kube-system
+  createNamespace: false
+  failurePolicy: abort
+  valuesContent: |-
+    deployment:
+      kind: DaemonSet
+    gateway:
+      enabled: false
+    gatewayClass:
+      enabled: false
+    experimental:
+      kubernetesGateway:
+        enabled: false
+    api:
+      dashboard: false
+    ingressRoute:
+      dashboard:
+        enabled: false
+      healthcheck:
+        enabled: false
+    ports:
+      traefik:
+        expose:
+          default: false
+      web:
+        hostPort: 80
+        allowACMEByPass: true
+        redirections:
+          entryPoint:
+            to: websecure
+            scheme: https
+            permanent: true
+      websecure:
+        hostPort: 443
+    service:
+      spec:
+        type: ClusterIP
+    resources:
+      requests:
+        cpu: 100m
+        memory: 128Mi
+      limits:
+        cpu: 500m
+        memory: 256Mi