---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: mosquitto-selfsigned
  namespace: mosquitto
spec:
  selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: mosquitto-ca
  namespace: mosquitto
spec:
  isCA: true
  commonName: mosquitto-ca
  secretName: mosquitto-ca-secret
  issuerRef:
    name: mosquitto-selfsigned
    kind: Issuer
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: mosquitto-ca-issuer
  namespace: mosquitto
spec:
  ca:
    secretName: mosquitto-ca-secret
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: mosquitto-internal-cert
  namespace: mosquitto
spec:
  secretName: mosquitto-tls
  duration: 8760h # 1 year
  renewBefore: 720h # 30 days before expiration
  subject:
    organizations:
      - internal
  commonName: mosquitto.mosquitto.svc
  dnsNames:
    - mosquitto.infrastructure.helmholz.cloud
    - mosquitto
    - mosquitto.mosquitto
    - mosquitto.mosquitto.svc
    - mosquitto-mqtts
    - mosquitto-mqtts.mosquitto
    - mosquitto-mqtts.mosquitto.svc
    - mosquitto-wss
    - mosquitto-wss.mosquitto
    - mosquitto-wss.mosquitto.svc
  issuerRef:
    name: mosquitto-ca-issuer
    kind: Issuer