the place: bikoret.ch — Ingress hosts, TLS, and the .org redirect

bikoret.ch and www.bikoret.ch served with a Let's Encrypt certificate
through cert-manager (letsencrypt-prod, HTTP-01), ssl-redirect on;
bikoret.org and www redirect permanently to https://bikoret.ch; the
no-host catch-all stays; shorashim.ch still answers over plain HTTP
until its callers have moved. KOHEN Day 8 gives the order: A records,
wait for the name to resolve, then apply — never before. Tamid's names
table updated. Doorpost re-pinned.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

deploy/k8s/service.yaml

@@ -37,18 +37,14 @@ spec:
 # controller sees the caller and hands it on in X-Real-IP; the pipeline
 # believes that header only from TRUSTED_PROXIES (configmap.yaml).
 #
-# Two rules, one backend:
-#   - no host  → the catch-all: http://<ingress-ip>/... works with no DNS
-#   - shorashim.ch → ready for the A record (KOHEN.md Day 8). TLS is NOT
-#     requested here: asking cert-manager for a certificate before the
-#     name resolves only burns Let's Encrypt's failed-validation limit.
-#     When the record exists add:
-#       metadata.annotations:
-#         cert-manager.io/cluster-issuer: letsencrypt-prod
-#         nginx.ingress.kubernetes.io/ssl-redirect: "true"
-#       spec.tls: [{hosts: [shorashim.ch], secretName: shorashim-tls}]
-#     and point callers at https://shorashim.ch — until then the
-#     courtyard keys travel over plain HTTP.
+# Hosts (2026-10-13, the name): bikoret.ch is the place; www.bikoret.ch
+# and the old shorashim.ch are served too; bikoret.org (second Ingress
+# below) only redirects. TLS from Let's Encrypt through cert-manager's
+# letsencrypt-prod ClusterIssuer, HTTP-01 — so apply this ONLY after
+# `dig +short A bikoret.ch` answers 185.19.28.170: a certificate asked
+# for before the name resolves only burns the failed-validation limit.
+# The no-host catch-all stays, so http://<ingress-ip>/... keeps working
+# with no DNS; with ssl-redirect on, named hosts go to https.
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -57,15 +53,21 @@ metadata:
   labels:
     app.kubernetes.io/name: shorashim
   annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
     # A 71-judge Sanhedrin may deliberate for ten minutes (Construction §2.2).
     nginx.ingress.kubernetes.io/proxy-read-timeout: "620"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "620"
     # The bedikah accepts 65,536 bytes of output and 1 MiB of sources;
     # leave room for the envelope.
     nginx.ingress.kubernetes.io/proxy-body-size: "2m"
-    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
 spec:
   ingressClassName: nginx
+  tls:
+    - hosts:
+        - bikoret.ch
+        - www.bikoret.ch
+      secretName: bikoret-tls
   rules:
     - http:
         paths:
@@ -76,6 +78,27 @@ spec:
                 name: shorashim
                 port:
                   number: 80
+    - host: bikoret.ch
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: shorashim
+                port:
+                  number: 80
+    - host: www.bikoret.ch
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: shorashim
+                port:
+                  number: 80
+    # The old name, kept until its callers have moved; no certificate asked for it.
     - host: shorashim.ch
       http:
         paths:
@@ -86,3 +109,44 @@ spec:
                 name: shorashim
                 port:
                   number: 80
+---
+# bikoret.org: the stranger's guess, redirected to the place. No service
+# of its own; nginx answers the redirect itself. Add its A records too.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: bikoret-org
+  namespace: shorashim
+  labels:
+    app.kubernetes.io/name: shorashim
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    nginx.ingress.kubernetes.io/permanent-redirect: https://bikoret.ch$request_uri
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - bikoret.org
+        - www.bikoret.org
+      secretName: bikoret-org-tls
+  rules:
+    - host: bikoret.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: shorashim
+                port:
+                  number: 80
+    - host: www.bikoret.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: shorashim
+                port:
+                  number: 80