Stop serving Grafana as anonymous admin on the public hostname

infra/helm/medical-chatbot/templates/ingress.yaml

@@ -1,4 +1,16 @@
 {{- if .Values.ingress.enabled }}
+{{- /*
+  The cutover serves the new production hostname alongside the rehearsal one
+  from the same release, so `host` alone is not enough. `extraHosts` adds more
+  names against the identical path set; with none set the render is unchanged.
+
+  Note that cert-manager's ingress-shim derives Certificates from the `tls`
+  block, not from these rules. A host listed here but absent from `tls` is
+  routed over HTTP without triggering an ACME order — which is what lets a new
+  hostname be wired up *before* its DNS moves, without burning Let's Encrypt
+  failed-validation attempts on a challenge that cannot succeed yet.
+*/}}
+{{- $hosts := concat (list .Values.ingress.host) (default (list) .Values.ingress.extraHosts) }}
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -14,27 +26,29 @@ spec:
     {{- toYaml . | nindent 4 }}
   {{- end }}
   rules:
-    - host: {{ .Values.ingress.host | quote }}
+    {{- range $host := $hosts }}
+    - host: {{ $host | quote }}
       http:
         paths:
           - path: /v1/rag
             pathType: Prefix
             backend:
               service:
-                name: {{ include "medical-chatbot.fullname" . }}-ai-service
+                name: {{ include "medical-chatbot.fullname" $ }}-ai-service
                 port: { name: http }
-          {{- if .Values.observability.enabled }}
+          {{- if $.Values.observability.enabled }}
           - path: /grafana
             pathType: Prefix
             backend:
               service:
-                name: {{ include "medical-chatbot.fullname" . }}-grafana
+                name: {{ include "medical-chatbot.fullname" $ }}-grafana
                 port: { name: http }
           {{- end }}
           - path: /
             pathType: Prefix
             backend:
               service:
-                name: {{ include "medical-chatbot.fullname" . }}-web
+                name: {{ include "medical-chatbot.fullname" $ }}-web
                 port: { name: http }
+    {{- end }}
 {{- end }}