> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ale.run/llms.txt
> Use this file to discover all available pages before exploring further.

# TLS & Ingress Configuration

> Guide for applying SSL/TLS certificates using Cert Manager.

<Note>
  TLS certificates are automatically applied to the preview URLs and custom domains of services deployed with `ale`.
</Note>

***

## Cert Generator Install & Issue

<Steps>
  <Step title="Set the values used in the certificate generation script as environment variables.">
    ```bash theme={null}
    export AWS_REGION=<AWS Region>
    export AWS_DOMAIN=<Route53 Domain>
    export AWS_HOSTED_ZONE_ID=<Route53 Hosted Zone ID>
    export ACME_EMAIL=<Certificate Issuance Email>
    ```

    <AccordionGroup>
      <Accordion title="AWS Route53 Hosted Zone ID">
        <Frame>
          <img className="block rounded-md" src="https://files.cloudtype.io/ale-docs/setup/aws-terraform/images/05_01.png" />
        </Frame>

        > You can find the **Hosted Zone ID** in **Route53 > Hosted Zones > Hosted Zone Details**.
      </Accordion>
    </AccordionGroup>
  </Step>

  <Step title="Install the cluster certificate generator using the following command.">
    ```bash theme={null}
    cat <<EOF | kubectl apply -f -
    apiVersion: v1
    kind: Secret
    metadata:
      name: aws-secret-access-key
      namespace: cert-manager
    type: Opaque
    stringData:
      aws-secret-access-key: $AWS_SECRET_ACCESS_KEY
    ---
    apiVersion: cert-manager.io/v1
    kind: ClusterIssuer
    metadata:
      name: ale-issuer
      namespace: cert-manager
    spec:
      acme:
        email: $ACME_EMAIL
        server: https://acme-v02.api.letsencrypt.org/directory
        privateKeySecretRef:
          name: ale-issuer
        solvers:
          - http01:
              ingress:
                class: nginx
          - dns01:
              route53:
                region: $AWS_REGION
                hostedZoneID: $AWS_HOSTED_ZONE_ID
                accessKeyID: $AWS_ACCESS_KEY_ID
                secretAccessKeySecretRef:
                  name: aws-secret-access-key
                  key: aws-secret-access-key
            selector:
              dnsZones:
                - $AWS_DOMAIN
    EOF
    ```
  </Step>

  <Step title="Run the following command to issue a certificate.">
    ```bash theme={null}
    cat <<EOF | kubectl apply -f -
    apiVersion: cert-manager.io/v1
    kind: Certificate
    metadata:
      name: ale-app-tls
      namespace: cert-manager
    spec:
      dnsNames:
        - "*.$AWS_DOMAIN"
      issuerRef:
        kind: ClusterIssuer
        name: ale-issuer
      secretName: ale-app-tls
    EOF
    ```
  </Step>
</Steps>

## Ingress Setup

<Steps>
  <Step title="Create an Ingress to access ale using the following command.">
    ```bash theme={null}
    cat <<EOF | kubectl apply -f -
    apiVersion: networking.k8s.io/v1
    kind: Ingress
    metadata:
      name: ale
      namespace: ale
      annotations:
        nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0
        cert-manager.io/cluster-issuer: ale-issuer
    spec:
      ingressClassName: nginx
      tls:
        - hosts:
            - app.$AWS_DOMAIN
          secretName: ale-controller-tls
      rules:
        - host: app.$AWS_DOMAIN
          http:
            paths:
              - path: /
                pathType: Prefix
                backend:
                  service:
                    name: ale-controller
                    port:
                      number: 9001
    EOF
    ```
  </Step>

  <Step title="Use the following command to verify that the certificates have been created and applied. If created successfully, the STATE field should show as valid.">
    ```bash theme={null}
    kubectl get order -n ale \
      | awk '/ale-/{print $1}' \
      | xargs kubectl get order -n ale
    ```

    ```bash theme={null}
    NAME                              STATE   AGE
    ale-controller-tls-1-1997619857   valid   103s
    ```
  </Step>

  <Step title="If you can access the following URLs, the certificate has been applied successfully. If access fails, check the status of the Cert Manager pod or the Cluster Issuer.">
    ```bash theme={null}
    https://app.[Route53_Domain]
    ```
  </Step>

  <Step title="Create an administrator account and complete the installation.">
    <Frame>
      <img className="block rounded-md" src="https://files.cloudtype.io/ale-docs/setup/ec2/images/en/04_22.png" />
    </Frame>

    <Note>
      Enter the root domain in the preview domain field.
    </Note>
  </Step>
</Steps>

## Cluster Network Configuration

<Frame>
  <img className="block rounded-md" src="https://files.cloudtype.io/ale-docs/setup/ec2/images/en/04_23.png" />
</Frame>

> On the cluster page in the Operations System, navigate to the **Settings** tab and enter the following values in the **Network** section.

* **Preview Domain**: Root domain of Route53
* **Use HTTPS**
  * **Checked**: Internet environment
  * **Unchecked**: Intranet/closed network environment
* **Certificate Secret Name**: ale-app-tls
* **Certificate Secret Namespace**: cert-manager
* **Certificate Issuer**: ale-issuer
* **Ingress Class**: nginx
* **Ingress IP**: Blank (Auto-detected)
* **Load Balancer Type**
  * Load Balancer
  * NodePort
* **Ingress/Egress Bandwidth**: Enter in Mbps

<Info>
  You can access the operations system by clicking the space name in the dashboard.

  <Frame>
    <img className="block rounded-md" src="https://files.cloudtype.io/ale-docs/setup/ec2/images/en/04_24.png" />
  </Frame>
</Info>

<Note>
  The operations system menu is only displayed for accounts with access permissions to the operations system.
</Note>