---
# North-south ingress for Homepage at the APEX home.keithjackson.dev. Attaches to the shared Gateway
# via the dedicated `https-apex` listener (sectionName) — the wildcard `https` listener's hostname
# `*.home.keithjackson.dev` does NOT match the bare apex, so this route MUST bind the apex listener
# added in platform/gateway/gateway.yaml. TLS is terminated at the Gateway by the wildcard cert (the
# apex is a SAN on it). Same-namespace backend, so no ReferenceGrant; the parentRef is permitted
# because the homepage namespace carries gateway-access=shared.
#
# auth-mode=forward-auth records the INTENDED posture: Homepage is a bare UI with no native OIDC, so
# it should sit behind oauth2-proxy forward-auth at the Gateway (R-IDP-02). NOTE: the Gateway
# ext-authz ATTACHMENT that actually enforces forward-auth is a Phase-6 WS-NET TODO that is NOT yet
# built anywhere in the repo (platform/oauth2-proxy is the authenticator only; no CiliumEnvoyConfig /
# ext-authz exists). Until that mechanism lands, this route — like every other forward-auth app
# (jackett, qbittorrent, pihole, radarr, …) — is reachable without auth. See README.md "Forward-auth".
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: homepage
  namespace: homepage
  labels:
    app.kubernetes.io/name: homepage
  annotations:
    homelab.keithjackson.dev/auth-mode: forward-auth
    homelab.keithjackson.dev/auth-groups: platform-admins
spec:
  parentRefs:
    - name: shared
      namespace: gateway
      sectionName: https-apex     # the apex listener (wildcard `https` won't match the bare apex)
  hostnames:
    - ${BASE_DOMAIN}
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: homepage
          port: 80