---
# ClusterIP fronting the oauth2-proxy SIDECAR (NOT Crafty directly). The shared Gateway routes
# crafty.home.keithjackson.dev to this Service (httproute.yaml); Service :80 -> sidecar :4180, which
# authenticates against Keycloak and only then proxies to the co-located Crafty UI (127.0.0.1:8443).
# There is deliberately NO Service targeting Crafty's :8443 — the UI is reachable ONLY through the
# gate. (Game traffic reaches the MC server subprocesses via the separate L4 LoadBalancer, which is
# NOT auth-gated because game protocols authenticate themselves — service-l4.yaml.)
apiVersion: v1
kind: Service
metadata:
  name: crafty
  namespace: crafty
  labels:
    app.kubernetes.io/name: crafty
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: crafty
  ports:
    - name: http
      port: 80
      targetPort: http   # oauth2-proxy sidecar :4180
      protocol: TCP