Networking and ingress
One ingress-nginx controller terminates TLS and routes by host and path. Certificates come from cert-manager with the letsencrypt-prod issuer (HTTP-01). The ingress definitions that production uses are in infra/oci-devops/deploy/.
Hosts
| Host | Serves |
|---|---|
rtih.peoplewave.in | The web app and, on the same host, the /api/v1/* prefixes. This is the canonical host. The frontend's /api/auth/*, /api/status and /status are only served here. |
api.rtih.peoplewave.in | The same /api/v1/* prefixes for non-browser clients. Its catch-all / goes to the LMS service, so /api/auth/* on this host is not the frontend. |
app.rtih.peoplewave.in | The web app. |
livekit.rtih.peoplewave.in | The LiveKit server, over WSS. |
grafana.rtih.peoplewave.in | Defined in the same ingress file. Not covered by this site. |
DNS for peoplewave.in is managed by hand at the registrar's DNS service, not by Terraform. See ADR 1.
The older host startuposv2.peoplewave.in still appears in infra/k8s/ingress.yaml. That file is not the live ingress.
Path routing
| Prefix | Service |
|---|---|
/api/v1/identity, /tenants, /audit, /permissions, /import | identity |
/api/v1/onboarding, /founders | onboarding |
/api/v1/mentors, /sessions, /matches | mentorship |
/api/v1/programs, /programmes, /ventures, /milestones, /cohorts, /schemes, /health | program |
/api/v1/lms | lms |
/api/v1/admin, /cm, /analytics | analytics |
/api/v1/copilot | ai-copilot |
/api/v1/notifications | notification |
/ | frontend (on the web hosts) |
A second ingress object, startupos-lms-uploads-ingress, claims the more specific prefix /api/v1/lms/lessons. It raises the request body limit to 2 GB and the timeouts to one hour. The main ingress keeps 50 MB for every other path.
What the ingress does not route
/q (health, metrics, OpenAPI, Swagger UI) is not routed to any service. On the API host /q is sent to the frontend, which answers 404, because that host's catch-all would otherwise serve it from the LMS service. See Status page.
CORS
Each Quarkus service answers CORS itself. The ingress does not set CORS headers. Doing both would put two allow-lists on one decision.
Sources: infra/oci-devops/deploy/ingress.yaml, infra/oci-devops/deploy/livekit-ingress.yaml, infra/k8s/ingress-lms-uploads.yaml, .agents/tasks/status-page/ingress.md, .agents/tasks/migrate-fqdn-peoplewave-in/decisions.json. The live ingress was not re-read for this page. The status-page task recorded that the live ingress matched the repository manifest on 2026-11-07.