# Three Ingresses on one host because middlewares and router priority are
# per-Ingress. Traefik matches pathType Prefix character-wise (not per path
# segment), so public prefixes carry a trailing slash and priorities are
# explicit - by default Traefik orders routers by rule length, which would
# not reliably put /api/admin above /api/.
#   300 dev-admin  /api/admin  -> Authelia -> api (prefix /api stripped)
#   200 dev-public /api/ /m /m/ -> api / m, public (prefixes stripped)
#   100 dev        /           -> Authelia -> ui (also bare /api)
# All carry the tls section (otherwise the router is http-only), but only
# "dev" has the cert-manager annotation so a single Certificate owns dev-tls.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: dev
  namespace: dev
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    traefik.ingress.kubernetes.io/router.priority: "100"
    traefik.ingress.kubernetes.io/router.middlewares: auth-tinyauth@kubernetescrd
spec:
  ingressClassName: traefik
  rules:
    - host: dev.aggtaa.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: dev
                port:
                  name: ui
  tls:
    - secretName: dev-tls
      hosts:
        - dev.aggtaa.com
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: dev-admin
  namespace: dev
  annotations:
    traefik.ingress.kubernetes.io/router.priority: "300"
    traefik.ingress.kubernetes.io/router.middlewares: auth-tinyauth@kubernetescrd,dev-strip-prefix@kubernetescrd
spec:
  ingressClassName: traefik
  rules:
    - host: dev.aggtaa.com
      http:
        paths:
          # no trailing slash on purpose: also catches bare /api/admin
          # (and /api/administrator...), all of which stay behind Authelia
          - path: /api/admin
            pathType: Prefix
            backend:
              service:
                name: dev
                port:
                  name: api
  tls:
    - secretName: dev-tls
      hosts:
        - dev.aggtaa.com
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: dev-public
  namespace: dev
  annotations:
    traefik.ingress.kubernetes.io/router.priority: "200"
    traefik.ingress.kubernetes.io/router.middlewares: dev-strip-prefix@kubernetescrd
spec:
  ingressClassName: traefik
  rules:
    - host: dev.aggtaa.com
      http:
        paths:
          - path: /api/
            pathType: Prefix
            backend:
              service:
                name: dev
                port:
                  name: api
          - path: /m
            pathType: Exact
            backend:
              service:
                name: dev
                port:
                  name: m
          - path: /m/
            pathType: Prefix
            backend:
              service:
                name: dev
                port:
                  name: m
  tls:
    - secretName: dev-tls
      hosts:
        - dev.aggtaa.com