fix: use Cloudflare origin cert for TLS instead of cert-manager

charts/lunarfront/templates/ingress.yaml

@@ -4,13 +4,14 @@ metadata:
   name: lunarfront
   namespace: {{ .Values.customer.name }}
   annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-prod
+    # Cloudflare proxies TLS to the browser — origin cert handles CF → cluster
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
 spec:
   ingressClassName: nginx
   tls:
     - hosts:
         - {{ .Values.customer.domain }}
-      secretName: lunarfront-tls
+      secretName: {{ .Values.cloudflare.originCertSecret }}
   rules:
     - host: {{ .Values.customer.domain }}
       http: