---
# Shared Gateway — HTTPS listeners on *.home.keithjackson.dev, TLS terminated with the wildcard cert
# (docs/09). Implemented by Cilium (GatewayClass `cilium`). The ingress VIP is announced via Cilium
# L2 announcement on the flat LAN (docs/09, OQ-1 resolved). Phase 0 STUB.
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: shared
  namespace: gateway
spec:
  gatewayClassName: cilium
  listeners:
    - name: https
      protocol: HTTPS
      port: 443
      hostname: "*.home.keithjackson.dev"
      tls:
        mode: Terminate
        certificateRefs:
          - kind: Secret
            name: wildcard-home-tls      # produced by wildcard-certificate.yaml
      allowedRoutes:
        namespaces:
          from: Selector
          selector:
            matchLabels:
              # App namespaces opt in to attach HTTPRoutes here (WS-APPS renders the label +
              # ReferenceGrant from ServiceDefinition `exposure`). docs/09.
              gateway-access: "shared"
    - name: http-redirect
      protocol: HTTP
      port: 80
      hostname: "*.home.keithjackson.dev"
      allowedRoutes:
        namespaces:
          from: Selector
          selector:
            matchLabels:
              gateway-access: "shared"
# TODO(WS-NET, Phase 2): pin the L2-announced VIP / IP pool; add HTTP->HTTPS redirect HTTPRoute;
#   confirm cross-namespace ReferenceGrant pattern with WS-APPS. Ingress opens NORTH-SOUTH only —
#   it does not relax east-west default-deny (docs/09).