---
# HTTPS front for ghp, served on two names via the internal Traefik:
#   ghp.unkin.net              — canonical/primary (apex, bind-operator zone)
#   ghp.k8s.syd1.au.unkin.net  — admin/internal route (external-dns k8s.syd1 zone)
# The cert-manager annotations below make cert-manager mint the ghp-gateway-tls
# Secret with CN ghp.unkin.net and a DNS SAN for each TLS listener hostname
# automatically. This is a SEPARATE Secret from ghp-tls (certificate.yaml), which
# carries the GitHub impersonation SANs and is mounted by ghp itself — the two
# never share a Secret, so cert-manager does not fight over either.
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  labels:
    traefik.io/instance: internal
  annotations:
    argocd.argoproj.io/sync-wave: "2"
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: ghp.unkin.net
    cert-manager.io/private-key-size: "4096"
    # Only the k8s admin route is published by external-dns (it owns just the
    # k8s.syd1.au.unkin.net zone). ghp.unkin.net lives in the apex zone and is
    # served by the bind-operator DNSRecord — NOT managed here.
    external-dns.alpha.kubernetes.io/hostname: ghp.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.4
  name: ghp
  namespace: ghp
spec:
  gatewayClassName: traefik-internal
  listeners:
    - name: http-primary
      port: 80
      protocol: HTTP
      hostname: ghp.unkin.net
      allowedRoutes:
        namespaces:
          from: Same
    - name: https-primary
      port: 443
      protocol: HTTPS
      hostname: ghp.unkin.net
      allowedRoutes:
        namespaces:
          from: Same
      tls:
        mode: Terminate
        certificateRefs:
          - group: ""
            kind: Secret
            name: ghp-gateway-tls
    - name: http-admin
      port: 80
      protocol: HTTP
      hostname: ghp.k8s.syd1.au.unkin.net
      allowedRoutes:
        namespaces:
          from: Same
    - name: https-admin
      port: 443
      protocol: HTTPS
      hostname: ghp.k8s.syd1.au.unkin.net
      allowedRoutes:
        namespaces:
          from: Same
      tls:
        mode: Terminate
        certificateRefs:
          - group: ""
            kind: Secret
            name: ghp-gateway-tls