# =============================================================================
# L0 STATIC — PiHole answers an explicit LAN name list, and no LAN-only name is left out of it
# Catalog: docs/14 L0 row ("Pre-apply, in CI") — runs WITHOUT a cluster.
#
# Since PR #156 every public name is a proxied CNAME to the Cloudflare Tunnel and works from the
# LAN, so PiHole's zone wildcard was replaced by an explicit list (catalog/pihole.yaml). That makes
# the list load-bearing: a route disowned from public DNS and absent from it resolves nowhere. This
# test derives the required names from the tree (every `controller: none` HTTPRoute, every hostname
# the tunnel 404s, the L4 Services' own VIPs) and asserts the list covers them, carries no
# zone-wide entry, and pins gitea and nextcloud to the Gateway VIP. It proves itself non-vacuous by
# mutation. Rationale and the honest NOT-proven list: check.sh.
#
# WHY SCOPE, NOT REQUIREMENTS: the property spans catalog/, apps/, platform/ and runbooks/; a new
# internal service in any of them can break it, and ci/touched-requirements.sh maps apps/* to no
# requirement at all, so a requirement-scoped selection would skip it on precisely those changes.
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
  name: pihole-lan-names
  labels:
    conformance.home.k3s/R-DNS-03: "true"
  annotations:
    conformance.home.k3s/requirements: "R-DNS-03"
    conformance.home.k3s/layer: "L0"
    conformance.home.k3s/scope: "whole-repo"
    conformance.home.k3s/safety-critical: "true"
    conformance.home.k3s/executable: "true"
    conformance.home.k3s/intent: >-
      PiHole answers an explicit list of LAN names rather than the whole zone; every HTTPRoute
      disowned from public DNS has an entry to the Gateway VIP; every hostname the Cloudflare
      Tunnel 404s has an entry, with the L4 names on their own VIPs; and gitea and nextcloud stay
      on the LAN path, off Cloudflare's request-size and timeout limits.
spec:
  steps:
    - name: assert-pihole-explicit-lan-names
      description: >-
        Parse FTLCONF_misc_dnsmasq_lines from catalog/pihole.yaml and the rendered
        apps/wave-0/pihole.yaml, derive the required names from every `controller: none` HTTPRoute,
        the http_status:404 hostnames in platform/cloudflared/config.yaml and the L4 Services'
        lbipam annotations, assert the list covers them and contains no zone-wide entry, and run
        the evaluator on mutated lists to prove it is not vacuous.
      try:
        - script:
            content: bash ./check.sh