---
# Shared Gateway — HTTPS listeners on *.home.keithjackson.dev, TLS terminated with the wildcard cert
# (docs/09). Implemented by Cilium (GatewayClass `cilium`). The ingress VIP is announced via Cilium
# L2 announcement on the flat LAN (docs/09, OQ-1 resolved). Phase 0 STUB.
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: shared
  namespace: gateway
spec:
  gatewayClassName: cilium
  listeners:
    - name: https
      protocol: HTTPS
      port: 443
      hostname: "*.home.keithjackson.dev"
      tls:
        mode: Terminate
        certificateRefs:
          - kind: Secret
            name: wildcard-home-tls      # produced by wildcard-certificate.yaml
      allowedRoutes:
        namespaces:
          from: Selector
          selector:
            matchLabels:
              # App namespaces opt in to attach HTTPRoutes here (WS-APPS renders the label +
              # ReferenceGrant from ServiceDefinition `exposure`). docs/09.
              gateway-access: "shared"
    - name: http-redirect
      protocol: HTTP
      port: 80
      hostname: "*.home.keithjackson.dev"
      allowedRoutes:
        namespaces:
          from: Selector
          selector:
            matchLabels:
              gateway-access: "shared"
    # APEX listeners. The wildcard listeners above match ONLY subdomains: `*.home.keithjackson.dev`
    # does NOT intersect the bare apex `home.keithjackson.dev`, so an HTTPRoute for the apex host
    # (the Homepage landing dashboard, clusters/base/homepage.yaml) would bind to NO listener and
    # never serve. These two listeners give the apex its own hostname. TLS is the SAME wildcard cert:
    # `home.keithjackson.dev` is already a SAN on wildcard-certificate.yaml, so `wildcard-home-tls`
    # terminates the apex too — no extra Certificate needed. Same gateway-access=shared opt-in.
    - name: https-apex
      protocol: HTTPS
      port: 443
      hostname: "home.keithjackson.dev"
      tls:
        mode: Terminate
        certificateRefs:
          - kind: Secret
            name: wildcard-home-tls      # apex is a SAN on the wildcard cert (wildcard-certificate.yaml)
      allowedRoutes:
        namespaces:
          from: Selector
          selector:
            matchLabels:
              gateway-access: "shared"
    - name: http-apex-redirect
      protocol: HTTP
      port: 80
      hostname: "home.keithjackson.dev"
      allowedRoutes:
        namespaces:
          from: Selector
          selector:
            matchLabels:
              gateway-access: "shared"
# TODO(WS-NET, Phase 2): pin the L2-announced VIP / IP pool; add HTTP->HTTPS redirect HTTPRoute;
#   confirm cross-namespace ReferenceGrant pattern with WS-APPS. Ingress opens NORTH-SOUTH only —
#   it does not relax east-west default-deny (docs/09).