# platform/gateway

**Gateway API** (north-south ingress) implemented by **Cilium** + the shared HTTPS Gateway and the
wildcard TLS certificate.

- **Governing ADRs:** [ADR-0002 — Cilium + Gateway API](../../../home-network-k3s/decisions/adr-0002-cni-cilium.md),
  [ADR-0006 — cert-manager/Let's Encrypt](../../../home-network-k3s/decisions/adr-0006-tls-cert-manager-letsencrypt.md)
- **Spec:** [docs/09 — DNS & Ingress](../../../home-network-k3s/docs/09-dns-and-ingress.md)
- **Serves:** R-DNS-01, R-TLS-01
- **Owner:** WS-NET (+ WS-SEC for the cert)

## What this stub is

- **`GatewayClass` `cilium`** — Gateway API implemented by Cilium; no separate ingress controller
  (ADR-0002).
- **`Gateway` `shared`** — HTTPS listener on `*.home.keithjackson.dev`, TLS terminated with the
  wildcard cert. App HTTPRoutes attach cross-namespace via a namespace label + ReferenceGrant
  (rendered by WS-APPS from each ServiceDefinition's `exposure`).
- **`Certificate` `wildcard-home`** — `*.home.keithjackson.dev` issued by `${ACME_CLUSTER_ISSUER}`
  (staging in dev, prod in prod — R-ENV-02). Makes onboarding certificate-free (ADR-0006 default).

## Contract (Issuer + Gateway TLS)

The "Issuer + Gateway TLS" interface (`roadmap/workstreams.md`): this Gateway + wildcard cert are what
every service's HTTPRoute attaches to. ExternalDNS ([`../externaldns`](../externaldns)) publishes the
`public` records for hostnames routed here. Ingress opens **north-south** only — it does **not** relax
east-west default-deny (docs/09).

## TODO (later phases)

- **Phase 2 (WS-NET):** pin the L2-announced ingress VIP / IP pool (Cilium L2 announcement, docs/09);
  add the HTTP→HTTPS redirect route; confirm the cross-namespace ReferenceGrant pattern with WS-APPS.
- **Public exposure** is a **manual edge port-forward** of 80/443 to the Gateway VIP (single SOHO
  router, docs/09) — a documented manual step, the analogue of the old pfSense exception.