feat: Support TLS for ingress

Author: stainless-app[bot]

.stats.yml

@@ -1,4 +1,4 @@
 configured_endpoints: 24
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel%2Fhypeman-6a8902e840cc8f443018c06b23884d3b42e45181c1ac156f5cf56cac84b717ee.yml
-openapi_spec_hash: d1535b5fdc9d097940928f0689c8baa1
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel%2Fhypeman-5949b3d0dabd8e0b10afddb388b6f0ea66c44b0f383e28d49bcd81b22b021dee.yml
+openapi_spec_hash: 9e9e6964a4cafc48e3cff37d918d0889
 config_hash: 510018ffa6ad6a17875954f66fe69598

ingress.go

@@ -105,7 +105,14 @@ func (r *Ingress) UnmarshalJSON(data []byte) error {
 }
 
 type IngressMatch struct {
-	// Hostname to match (exact match on Host header)
+	// Hostname to match. Can be:
+	//
+	// - Literal: "api.example.com" (exact match on Host header)
+	// - Pattern: "{instance}.example.com" (dynamic routing based on subdomain)
+	//
+	// Pattern hostnames use named captures in curly braces (e.g., {instance}, {app})
+	// that extract parts of the hostname for routing. The extracted values can be
+	// referenced in the target.instance field.
 	Hostname string `json:"hostname,required"`
 	// Host port to listen on for this rule (default 80)
 	Port int64 `json:"port"`
@@ -135,7 +142,14 @@ func (r IngressMatch) ToParam() IngressMatchParam {
 
 // The property Hostname is required.
 type IngressMatchParam struct {
-	// Hostname to match (exact match on Host header)
+	// Hostname to match. Can be:
+	//
+	// - Literal: "api.example.com" (exact match on Host header)
+	// - Pattern: "{instance}.example.com" (dynamic routing based on subdomain)
+	//
+	// Pattern hostnames use named captures in curly braces (e.g., {instance}, {app})
+	// that extract parts of the hostname for routing. The extracted values can be
+	// referenced in the target.instance field.
 	Hostname string `json:"hostname,required"`
 	// Host port to listen on for this rule (default 80)
 	Port param.Opt[int64] `json:"port,omitzero"`
@@ -153,12 +167,19 @@ func (r *IngressMatchParam) UnmarshalJSON(data []byte) error {
 type IngressRule struct {
 	Match  IngressMatch  `json:"match,required"`
 	Target IngressTarget `json:"target,required"`
+	// Auto-create HTTP to HTTPS redirect for this hostname (only applies when tls is
+	// enabled)
+	RedirectHTTP bool `json:"redirect_http"`
+	// Enable TLS termination (certificate auto-issued via ACME).
+	Tls bool `json:"tls"`
 	// JSON contains metadata for fields, check presence with [respjson.Field.Valid].
 	JSON struct {
-		Match       respjson.Field
-		Target      respjson.Field
-		ExtraFields map[string]respjson.Field
-		raw         string
+		Match        respjson.Field
+		Target       respjson.Field
+		RedirectHTTP respjson.Field
+		Tls          respjson.Field
+		ExtraFields  map[string]respjson.Field
+		raw          string
 	} `json:"-"`
 }
 
@@ -181,6 +202,11 @@ func (r IngressRule) ToParam() IngressRuleParam {
 type IngressRuleParam struct {
 	Match  IngressMatchParam  `json:"match,omitzero,required"`
 	Target IngressTargetParam `json:"target,omitzero,required"`
+	// Auto-create HTTP to HTTPS redirect for this hostname (only applies when tls is
+	// enabled)
+	RedirectHTTP param.Opt[bool] `json:"redirect_http,omitzero"`
+	// Enable TLS termination (certificate auto-issued via ACME).
+	Tls param.Opt[bool] `json:"tls,omitzero"`
 	paramObj
 }
 
@@ -193,7 +219,14 @@ func (r *IngressRuleParam) UnmarshalJSON(data []byte) error {
 }
 
 type IngressTarget struct {
-	// Target instance name or ID
+	// Target instance name, ID, or capture reference.
+	//
+	//   - For literal hostnames: Use the instance name or ID directly (e.g., "my-api")
+	//   - For pattern hostnames: Reference a capture from the hostname (e.g.,
+	//     "{instance}")
+	//
+	// When using pattern hostnames, the instance is resolved dynamically at request
+	// time.
 	Instance string `json:"instance,required"`
 	// Target port on the instance
 	Port int64 `json:"port,required"`
@@ -223,7 +256,14 @@ func (r IngressTarget) ToParam() IngressTargetParam {
 
 // The properties Instance, Port are required.
 type IngressTargetParam struct {
-	// Target instance name or ID
+	// Target instance name, ID, or capture reference.
+	//
+	//   - For literal hostnames: Use the instance name or ID directly (e.g., "my-api")
+	//   - For pattern hostnames: Reference a capture from the hostname (e.g.,
+	//     "{instance}")
+	//
+	// When using pattern hostnames, the instance is resolved dynamically at request
+	// time.
 	Instance string `json:"instance,required"`
 	// Target port on the instance
 	Port int64 `json:"port,required"`

ingress_test.go

@@ -30,13 +30,15 @@ func TestIngressNew(t *testing.T) {
 		Name: "my-api-ingress",
 		Rules: []hypeman.IngressRuleParam{{
 			Match: hypeman.IngressMatchParam{
-				Hostname: "api.example.com",
+				Hostname: "{instance}.example.com",
 				Port:     hypeman.Int(8080),
 			},
 			Target: hypeman.IngressTargetParam{
-				Instance: "my-api",
+				Instance: "{instance}",
 				Port:     8080,
 			},
+			RedirectHTTP: hypeman.Bool(true),
+			Tls:          hypeman.Bool(true),
 		}},
 	})
 	if err != nil {