---
# ExternalDNS — publishes public DNS records for `public` services automatically (docs/09, R-DNS-02).
# Watches Gateway/HTTPRoute (+Service); manages records in Cloudflare. Phase 0 STUB.
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: external-dns
  namespace: external-dns
spec:
  interval: 30m
  chart:
    spec:
      chart: external-dns
      version: ">=1.15.0 <1.16.0"   # TODO(WS-NET): pin at bring-up; Renovate maintains
      sourceRef:
        kind: HelmRepository
        name: external-dns
        namespace: external-dns
  install:
    remediation:
      retries: 3
  upgrade:
    remediation:
      retries: 3
  values:
    provider:
      name: cloudflare
    # Watch Gateway API routes (Cilium Gateway) + Services. docs/09: records rendered from intent.
    sources:
      - gateway-httproute
      - service
    # Only manage the platform zone. `internal` services need no public record (split-horizon via
    # PiHole) — docs/09 "DNS record depth".
    domainFilters:
      - "home.keithjackson.dev"
    policy: sync            # create + update + delete records as services come and go
    # Cloudflare API token: SOPS-encrypted secret, referenced BY NAME only (OQ-4, ADR-0007).
    env:
      - name: CF_API_TOKEN
        valueFrom:
          secretKeyRef:
            name: cloudflare-api-token
            key: api-token
    # TODO(WS-NET, Phase 2): confirm gateway-httproute source wiring; prove a record appears
    #   automatically for a test route (R-DNS-02, Phase-2 exit gate).