---
apiVersion: v1
kind: Namespace
metadata:
  name: homepage
  labels:
    # Expose Homepage at the APEX home.keithjackson.dev via the shared Gateway (docs/09). The apex is
    # a SAN on the *.home.keithjackson.dev wildcard cert, and the Gateway carries a dedicated
    # `https-apex` listener for it (platform/gateway/gateway.yaml). This label opts the namespace in
    # to attach HTTPRoutes to the shared Gateway (httproute.yaml).
    gateway-access: "shared"
    # NOTE: intentionally NOT homelab.keithjackson.dev/app-namespace=true. Homepage is a PLATFORM
    # landing UI (like Grafana in `monitoring` / Headlamp in `headlamp`), so Kyverno does not generate
    # the app default-deny baseline here and the app-scoped auth-mode / egress-class policies do not
    # apply. We still ship an explicit default-deny NetworkPolicy + a CiliumNetworkPolicy
    # (networkpolicy.yaml) as defense-in-depth: Gateway-only ingress, DNS-only egress.