feat(decoredirect): auto-heal failed certs and add retry-cert API rou…

feat(decoredirect): add redirectCode field (301|307) and opt-in X-Red…

feat: normalize 'to' field to https:// when no scheme provided (#16)

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

feat: rename CRD from RedirectDomain to DecoRedirect (#14)

Renames the CRD kind from RedirectDomain to DecoRedirect (group
deco.sites/v1alpha1, plural decoredict). Updates all Go types,
controller, API handlers, tests, RBAC markers, Helm templates, and
sample manifests. Regenerated with make generate.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

feat: rename CRD from RedirectDomain to DecoRedirect (#14)

Renames the CRD kind from RedirectDomain to DecoRedirect (group
deco.sites/v1alpha1, plural decoredict). Updates all Go types,
controller, API handlers, tests, RBAC markers, Helm templates, and
sample manifests. Regenerated with make generate.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

feat: add GET /redirects/{domain} and accept original domain in DELET…

Revert "chore: bump appVersion to 0.4.0-beta.3"

This reverts commit 787086397ed3188e1c1448838e13694231e4e352.

feat: redirect management HTTP API (#12)

* feat: add redirect management HTTP API

Exposes POST/DELETE/GET /redirects for CRUD of RedirectDomain CRs.
Enabled via REDIRECT_API_USER+REDIRECT_API_PASSWORD env vars (or existingSecret).
Set redirectApi.hostname in values to auto-create Ingress+Certificate via redirect-nginx.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat: decouple redirect API ingress from redirect-nginx

Add redirectApi.ingressClass (default empty = cluster default) and
redirectApi.clusterIssuer so the management API routes through the
cluster's default ingress instead of the redirect NLB.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* refactor: rename redirectApi → operatorApi, REDIRECT_API_* → OPERATOR_API_*

API is general-purpose (operator-api.deco.cx/redirects) not redirect-specific.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: update operatorApi hostname example to api.infra.deco.cx

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: preserve original domain in Spec.From, only sanitize k8s Name

sanitizeDomain was converting dots to dashes in both the resource name
and Spec.From, breaking the CEL validation rule. Now domainToName() is
used only for the k8s Name; Spec.From keeps the original domain.
Also returns 422 instead of 500 for validation errors from the API server.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: remove stale redirect-api templates (renamed to operator-api)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: address PR review issues in operator API

- Move OPERATOR_API env vars outside Valkey block (were injected under adminPassword branch)
- Require both username+password (not username alone) to enable Service/Ingress/env
- Tie Ingress creation to credentials being set (hostname alone no longer enough)
- Add HTTP timeouts to server (ReadHeader/Read/Write/Idle)
- Use release-name-prefixed TLS secret to avoid cross-release collisions
- Differentiate 422 (Invalid/AlreadyExists) from 500 in create handler
- Remove unused newTestServer helper from tests

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat: make default redirect namespace configurable via --redirect-namespace

Reads REDIRECT_NAMESPACE env var (default: deco-redirect-system).
Chart injects it from redirect.namespace in values.yaml so the API
default namespace stays in sync with the rest of the redirect config.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* refactor: remove inline username/password, credentials via existingSecret only

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: make operatorApi existingSecret optional so pod starts without the k8s Secret

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: return 409 Conflict for already-exists, keep 422 for validation errors

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: fallback to deco-redirect-system when defaultNamespace is empty

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* refactor: use envFrom secretRef instead of individual secretKeyRef for operatorApi credentials

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: update operatorApi hostname example to operator.infra.deco.cx

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: make HTTP-01 solver annotations configurable via values (#11)

* fix: make HTTP-01 solver annotations configurable via values

Adds redirect.clusterIssuer.solverAnnotations to pass extra annotations
to the ACME challenge Ingress — fixes nginx admission webhook rejection
when pathType Exact is used.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: generate solverAnnotations support via helm-generator

Updates addClusterIssuer in hack/helm-generator/main.go so that
make helm regenerates the clusterissuer template correctly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>