---
# The CVE page at cve.<domain>. Internal exposure only (docs/17 "Access"): a list of what is exploitable
# where is sensitive, so this hostname publishes NO public DNS record (the `controller: none` annotation
# below disowns it from external-dns) and the Cloudflare Tunnel 404s it (platform/cloudflared/config.yaml).
# It resolves on the LAN through PiHole's explicit list (catalog/pihole.yaml).
#
# The backend is the `vuln-scanner` Service's `http` port, which fronts the oauth2-proxy sidecar, so the
# SSO gate is in the data path; nothing routes to the page (:8080) directly.
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: vuln-scanner
  namespace: vuln-scanner
  labels:
    app.kubernetes.io/name: vuln-scanner
  annotations:
    homelab.keithjackson.dev/auth-mode: oauth2-proxy
    homelab.keithjackson.dev/auth-groups: platform-admins
    external-dns.alpha.kubernetes.io/controller: "none"
spec:
  parentRefs:
    - name: shared
      namespace: gateway
      sectionName: https
  hostnames:
    - cve.${BASE_DOMAIN}
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: vuln-scanner
          port: 4180