> For the complete documentation index, see [llms.txt](https://docs.wproofreader.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.wproofreader.com/v6.18.1/deployment/installation/kubernetes/set-up-external-access.md).

# Set up external access

Open Admin-panel and WProofreader Server to users on one public host name with HTTPS.

On this page, you open the stack to users on one public host name with HTTPS. For example, if the host name is `wproofreader.example.com`:

* `https://wproofreader.example.com/` opens Admin-panel.
* `https://wproofreader.example.com/wscservice/api` sends requests to WProofreader Server.

### What you need

* An Ingress controller or a Gateway API controller in the cluster. The Admin-panel chart does not install a controller.
* A DNS name that points to the controller, for example `wproofreader.example.com`.
* A TLS certificate for this name. You can get it from [cert-manager](https://cert-manager.io/) or use a certificate that you already have.

Before you start, load the settings in your terminal:

```bash
cd ~/wproofreader-k8s
source wsc-stack.env
```

{% stepper %}
{% step %}

#### Add the host name to the settings file

Replace `wproofreader.example.com` with your DNS name. Run these commands:

```bash
echo "export PUBLIC_HOST='wproofreader.example.com'" >> wsc-stack.env
source wsc-stack.env
echo "$PUBLIC_HOST"
```

The last command shows your DNS name.
{% endstep %}

{% step %}

#### Create the routing values file

Select the tab for your controller.

{% tabs %}
{% tab title="Ingress" %}
Replace `<ingress_class>` with the IngressClass name, for example `nginx` or `traefik`. Replace `<cluster_issuer>` with the name of your cert-manager ClusterIssuer.

```bash
cat > admin-panel-routing.yaml <<EOF
config:
  appUrl: https://${PUBLIC_HOST}
  appServerUrl: https://${PUBLIC_HOST}/wscservice/api
ingress:
  enabled: true
  className: <ingress_class>
  annotations:
    cert-manager.io/cluster-issuer: <cluster_issuer>
  hosts:
    - host: ${PUBLIC_HOST}
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: admin-panel-tls
      hosts:
        - ${PUBLIC_HOST}
  wproofreader:
    enabled: true
    serviceName: wproofreader-app
    servicePort: 80
EOF
```

{% hint style="info" %}
If you do not use cert-manager, delete the two `annotations` lines from the file. Then create the `admin-panel-tls` Secret.

Replace the two example file names before you run this command:

```bash
kubectl -n wsc create secret tls admin-panel-tls \
  --cert=certificate.pem --key=certificate-key.pem
```

{% endhint %}
{% endtab %}

{% tab title="Gateway API" %}
Use this tab if the cluster has a Gateway with an HTTPS listener for your host name. The Gateway owner manages the TLS certificate.

Replace `<gateway_name>` with the Gateway name. Replace `<gateway_namespace>` with its namespace.

```bash
cat > admin-panel-routing.yaml <<EOF
config:
  appUrl: https://${PUBLIC_HOST}
  appServerUrl: https://${PUBLIC_HOST}/wscservice/api
gateway:
  enabled: true
  create: false
  parentRefs:
    - name: <gateway_name>
      namespace: <gateway_namespace>
  hostnames:
    - ${PUBLIC_HOST}
  wproofreader:
    enabled: true
    serviceName: wproofreader-app
    servicePort: 80
EOF
```

{% hint style="info" %}
The Gateway must allow routes from the `wsc` namespace. For the settings, see the documentation of your Gateway API controller.
{% endhint %}
{% endtab %}
{% endtabs %}
{% endstep %}

{% step %}

#### Apply the routing values

Check the chart and both values files:

```bash
helm lint ./admin-panel-helm/admin-panel \
  --values admin-panel-values.yaml \
  --values admin-panel-routing.yaml
```

The command shows `1 chart(s) linted, 0 chart(s) failed`.

Apply the routing values:

```bash
helm upgrade admin-panel ./admin-panel-helm/admin-panel \
  --namespace wsc \
  --values admin-panel-values.yaml \
  --values admin-panel-routing.yaml \
  --atomic \
  --timeout 10m
```

The command shows `STATUS: deployed`.

{% hint style="warning" %}
From now on, use both values files for every upgrade of Admin-panel. If you use only `admin-panel-values.yaml`, Admin-panel goes back to the `127.0.0.1` addresses.
{% endhint %}
{% endstep %}

{% step %}

#### Check the access

```bash
curl --fail --show-error --silent --output /dev/null \
  --write-out '%{http_code}\n' "https://${PUBLIC_HOST}/up"
curl --fail --show-error --silent \
  "https://${PUBLIC_HOST}/wscservice/api?cmd=license_status"
```

The first command shows `200`. The second command shows JSON that contains `"valid":true`.

Open your public Admin-panel URL in a web browser. Sign in with the administrator account.
{% endstep %}
{% endstepper %}

### Common problems

| Problem                                              | What to do                                                                                                                                                                                    |
| ---------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `curl` cannot resolve the host name.                 | Make sure that the DNS name points to the address of the controller.                                                                                                                          |
| `curl` shows a certificate error.                    | Make sure that the certificate is ready: `kubectl -n wsc get certificate`. A new certificate from cert-manager can take some minutes.                                                         |
| `/wscservice/api` returns `404` from Admin-panel.    | Make sure that the `wproofreader` settings are in `admin-panel-routing.yaml`, and apply the file again.                                                                                       |
| The browser shows a redirect loop or insecure links. | Make sure that the controller sends the original protocol to Admin-panel. See the [Admin-panel routing guide](https://github.com/WebSpellChecker/admin-panel-helm/blob/main/docs/ROUTING.md). |

### Next step

The stack is ready. To upgrade or remove it, see [Upgrade and uninstall](/v6.18.1/deployment/installation/kubernetes/upgrade-and-uninstall.md).