---
# North-south ingress for the Crafty web UI at crafty.home.keithjackson.dev. Attaches to the shared
# Gateway (docs/09); TLS terminated at the Gateway by the *.home.keithjackson.dev wildcard cert (this
# host is covered). Same-namespace backend, so no ReferenceGrant; the parentRef is permitted because
# the crafty namespace carries gateway-access=shared. CR of the Gateway API CRDs — the CRDs are
# registered by `platform`, which is Ready before this tier's platform-config dependency completes.
#
# auth-mode annotation records that this route is gated by a per-app oauth2-proxy REVERSE-PROXY sidecar
# (Option B), NOT by Gateway ext_authz forward-auth (impossible on Cilium 1.16.5) and NOT native OIDC
# (Crafty has none). The backendRef is the `crafty` Service, which fronts the sidecar (:4180) — so the
# gate is IN the data path; the route needs no ext_authz filter of its own.
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: crafty
  namespace: crafty
  labels:
    app.kubernetes.io/name: crafty
  annotations:
    homelab.keithjackson.dev/auth-mode: oauth2-proxy
    homelab.keithjackson.dev/auth-groups: platform-admins
spec:
  parentRefs:
    - name: shared
      namespace: gateway
      sectionName: https
  hostnames:
    - crafty.${BASE_DOMAIN}
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: crafty
          port: 80