---
# North-south ingress for Headlamp at headlamp.home.keithjackson.dev. Attaches to the shared Gateway
# (docs/09); TLS terminated at the Gateway by the *.home.keithjackson.dev wildcard cert (already
# covers this host). Same-namespace backend, so no ReferenceGrant is needed; the parentRef is
# permitted because the headlamp namespace carries gateway-access=shared. CR of the Gateway API CRDs
# — CARRIED BY platform-config (dependsOn platform) so the CRDs exist first (like grafana-httproute).
#
# auth-mode annotation records that Headlamp authenticates via native Keycloak OIDC (R-IDP-02); this
# route is NOT protected by oauth2-proxy forward-auth (Headlamp runs its own OIDC login + per-user
# token forwarding), so it must NOT carry an oauth2-proxy ExtAuth filter.
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: headlamp
  namespace: headlamp
  labels:
    app.kubernetes.io/name: headlamp
  annotations:
    homelab.keithjackson.dev/auth-mode: oidc
    homelab.keithjackson.dev/auth-groups: platform-admins
    # LAN/VPN-ONLY (operator decision 2026-11-08). Disowned from external-dns, so the public
    # headlamp record and its TXT are DELETED and nothing republishes them; LAN/VPN clients keep
    # resolving the name via PiHole's split-horizon wildcard (-> the Gateway VIP). The Cloudflare
    # Tunnel also maps headlamp.${BASE_DOMAIN} to http_status:404 (platform/cloudflared/config.yaml).
    # Same mechanism the renderer emits for `exposure: internal` services; asserted by
    # conformance/tests/l0-static/internal-services-publish-no-public-dns (9c).
    external-dns.alpha.kubernetes.io/controller: none
spec:
  parentRefs:
    - name: shared
      namespace: gateway
      sectionName: https
  hostnames:
    - headlamp.${BASE_DOMAIN}
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: headlamp
          port: 80