fix ingress path

helm-overrides/k8s-admin-prd-ase1/argocd-admin-prd/custom-values.yaml

@@ -51,10 +51,13 @@ argo-cd:
     ingress:
       enabled: true
       ingressClassName: contour
-      # LAN hostname, matching claude.md's documented access URL. Add the
-      # Tailscale nip.io variant (argocd.100.90.248.118.nip.io) the same
-      # way Gitea does it if remote access is needed later.
       hostname: "argocd.192.168.1.7.nip.io"
+      # Tailscale nip.io variant, same dual-host pattern as Gitea — chart
+      # supports this natively via extraHosts (confirmed against the real
+      # values.yaml, not assumed).
+      extraHosts:
+        - name: "argocd.100.90.248.118.nip.io"
+          path: /
     resources:
       requests:
         cpu: 50m

helm-overrides/k8s-admin-prd-ase1/jenkins/custom-values.yaml

@@ -47,6 +47,19 @@ jenkins:
       enabled: true
       hostName: "jenkins.192.168.1.7.nip.io"
       ingressClassName: contour
+    # This chart's primary ingress only supports one hostName — no
+    # extraHosts like argo-cd. secondaryingress renders a whole second
+    # Ingress object at the same backend (confirmed against the actual
+    # template, not assumed) — that's the supported way to get a second
+    # hostname here. paths must be set explicitly: the template just
+    # renders zero routes if left at the chart's own default `[]`, unlike
+    # the primary ingress.
+    secondaryingress:
+      enabled: true
+      hostName: "jenkins.100.90.248.118.nip.io"
+      ingressClassName: contour
+      paths:
+        - /
 
   agent:
     resources:

helm-overrides/k8s-admin-prd-ase1/vault/custom-values.yaml

@@ -47,5 +47,21 @@ vault:
           path = "/vault/data"
         }
 
+    # No ingress config existed here before — access was via two raw,
+    # unmanaged Ingress objects (vault-ingress, vault-ingress-tailscale)
+    # that don't match anything Helm would generate, so this creates new
+    # GitOps-managed ones alongside them rather than adopting. Once these
+    # are confirmed working, the two raw ones should be deleted by hand
+    # (kubectl -n vault delete ingress vault-ingress vault-ingress-tailscale)
+    # — do that only after confirming, not before, so there's no access gap.
+    ingress:
+      enabled: true
+      ingressClassName: contour
+      hosts:
+        - host: "vault.192.168.1.7.nip.io"
+          paths: []
+        - host: "vault.100.90.248.118.nip.io"
+          paths: []
+
   ui:
     enabled: true