From 78ef8322ff64b8ecf961c9b8ea90efb099d35606 Mon Sep 17 00:00:00 2001
From: sirily11 <32106111+sirily11@users.noreply.github.com>
Date: Tue, 27 Jan 2026 22:21:45 +0800
Subject: [PATCH] feat: enhance ingress and notes configuration for improved
 accessibility and TLS support

---
 charts/clawdbot/templates/NOTES.txt    | 27 ++++++++++++++++
 charts/clawdbot/templates/ingress.yaml | 43 +++++++++++++++++++-------
 charts/clawdbot/values.yaml            | 37 +++++++++++++++-------
 3 files changed, 84 insertions(+), 23 deletions(-)

diff --git a/charts/clawdbot/templates/NOTES.txt b/charts/clawdbot/templates/NOTES.txt
index ee6420b27..9bf2c1436 100644
--- a/charts/clawdbot/templates/NOTES.txt
+++ b/charts/clawdbot/templates/NOTES.txt
@@ -2,6 +2,23 @@ Thank you for installing {{ .Chart.Name }}!
 
 Your Clawdbot gateway is starting up. This may take 1-2 minutes.
 
+{{- if .Values.ingress.enabled }}
+{{- $domain := .Values.ingress.domain }}
+{{- $tlsEnabled := .Values.ingress.tls.enabled }}
+{{- if $domain }}
+
+==========================================================
+  Clawdbot is accessible at:
+
+{{- if $tlsEnabled }}
+    https://{{ $domain }}
+{{- else }}
+    http://{{ $domain }}
+{{- end }}
+==========================================================
+{{- end }}
+{{- end }}
+
 1. Check the gateway status:
 
    kubectl get statefulset {{ include "clawdbot.fullname" . }} -n {{ .Release.Namespace }}
@@ -10,9 +27,19 @@ Your Clawdbot gateway is starting up. This may take 1-2 minutes.
 2. Access the Control UI:
 
 {{- if .Values.ingress.enabled }}
+{{- $domain := .Values.ingress.domain }}
+{{- $tlsEnabled := .Values.ingress.tls.enabled }}
+{{- if $domain }}
+{{- if $tlsEnabled }}
+   https://{{ $domain }}
+{{- else }}
+   http://{{ $domain }}
+{{- end }}
+{{- else }}
 {{- range .Values.ingress.hosts }}
    https://{{ .host }}
 {{- end }}
+{{- end }}
 {{- else }}
    # Port-forward to access locally:
    kubectl port-forward {{ include "clawdbot.fullname" . }}-0 {{ .Values.gateway.port }}:{{ .Values.gateway.port }} -n {{ .Release.Namespace }}
diff --git a/charts/clawdbot/templates/ingress.yaml b/charts/clawdbot/templates/ingress.yaml
index d406faaf5..a9b3f0084 100644
--- a/charts/clawdbot/templates/ingress.yaml
+++ b/charts/clawdbot/templates/ingress.yaml
@@ -1,29 +1,50 @@
 {{- if .Values.ingress.enabled -}}
+{{- $fullName := include "clawdbot.fullname" . -}}
+{{- $svcPort := .Values.service.port -}}
+{{- $domain := .Values.ingress.domain -}}
+{{- $tlsEnabled := .Values.ingress.tls.enabled -}}
+{{- $tlsSecretName := .Values.ingress.tls.secretName | default (printf "%s-tls" $fullName) -}}
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: {{ include "clawdbot.fullname" . }}
+  name: {{ $fullName }}
   labels:
     {{- include "clawdbot.labels" . | nindent 4 }}
-  {{- with .Values.ingress.annotations }}
   annotations:
+    {{- if and $tlsEnabled .Values.ingress.tls.certManager.enabled }}
+    cert-manager.io/cluster-issuer: {{ .Values.ingress.tls.certManager.issuer | quote }}
+    {{- end }}
+    {{- with .Values.ingress.annotations }}
     {{- toYaml . | nindent 4 }}
-  {{- end }}
+    {{- end }}
 spec:
   {{- if .Values.ingress.className }}
   ingressClassName: {{ .Values.ingress.className }}
   {{- end }}
-  {{- if .Values.ingress.tls }}
+  {{- if $tlsEnabled }}
   tls:
-    {{- range .Values.ingress.tls }}
     - hosts:
-        {{- range .hosts }}
-        - {{ . | quote }}
+        {{- if $domain }}
+        - {{ $domain | quote }}
         {{- end }}
-      secretName: {{ .secretName }}
-    {{- end }}
+        {{- range .Values.ingress.hosts }}
+        - {{ .host | quote }}
+        {{- end }}
+      secretName: {{ $tlsSecretName }}
   {{- end }}
   rules:
+    {{- if $domain }}
+    - host: {{ $domain | quote }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ $fullName }}
+                port:
+                  number: {{ $svcPort }}
+    {{- end }}
     {{- range .Values.ingress.hosts }}
     - host: {{ .host | quote }}
       http:
@@ -33,9 +54,9 @@ spec:
             pathType: {{ .pathType }}
             backend:
               service:
-                name: {{ include "clawdbot.fullname" $ }}
+                name: {{ $fullName }}
                 port:
-                  number: {{ $.Values.service.port }}
+                  number: {{ $svcPort }}
           {{- end }}
     {{- end }}
 {{- end }}
diff --git a/charts/clawdbot/values.yaml b/charts/clawdbot/values.yaml
index ed3a0d1ee..6b09ae0e4 100644
--- a/charts/clawdbot/values.yaml
+++ b/charts/clawdbot/values.yaml
@@ -139,20 +139,33 @@ service:
 ingress:
   enabled: false
   className: nginx
-  annotations:
-    # cert-manager.io/cluster-issuer: letsencrypt-prod
+
+  # Simplified domain configuration (recommended)
+  # Set your domain here - TLS will be auto-configured if tls.enabled is true
+  domain: ""  # e.g., "clawdbot.yourdomain.com"
+
+  # TLS configuration
+  tls:
+    enabled: false
+    # Secret name for TLS certificate (auto-generated name if empty)
+    secretName: ""
+    # Use cert-manager for automatic certificate provisioning
+    certManager:
+      enabled: false
+      issuer: "letsencrypt-prod"
+
+  # Additional annotations
+  annotations: {}
+    # WebSocket support (recommended for real-time features):
     # nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
     # nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
-    # nginx.ingress.kubernetes.io/websocket-services: "{{ include \"clawdbot.fullname\" . }}"
-  hosts:
-    - host: clawdbot.example.com
-      paths:
-        - path: /
-          pathType: Prefix
-  tls: []
-  #  - secretName: clawdbot-tls
-  #    hosts:
-  #      - clawdbot.example.com
+
+  # Advanced: Manual host configuration (overrides domain if set)
+  hosts: []
+  #  - host: clawdbot.example.com
+  #    paths:
+  #      - path: /
+  #        pathType: Prefix
 
 # Resource limits/requests
 resources: