# Two Ingresses on one host because the auth middleware is per-Ingress:
# "/" goes through Authelia, "/api" and "/m" are public. Traefik picks the
# longer path prefix first, so /api and /m never hit the auth router.
# Both need the tls section (otherwise the router is http-only), but only
# the first carries the cert-manager annotation so a single Certificate
# owns the dev-tls secret.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: dev
  namespace: dev
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    traefik.ingress.kubernetes.io/router.middlewares: auth-authelia@kubernetescrd
spec:
  ingressClassName: traefik
  rules:
    - host: dev.aggtaa.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: dev
                port:
                  name: ui
  tls:
    - secretName: dev-tls
      hosts:
        - dev.aggtaa.com
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: dev-public
  namespace: dev
spec:
  ingressClassName: traefik
  rules:
    - host: dev.aggtaa.com
      http:
        paths:
          - path: /api
            pathType: Prefix
            backend:
              service:
                name: dev
                port:
                  name: api
          - path: /m
            pathType: Prefix
            backend:
              service:
                name: dev
                port:
                  name: m
  tls:
    - secretName: dev-tls
      hosts:
        - dev.aggtaa.com