---
# External (DMZ) front for the WatchState admin UI, served on watchstate.unkin.net
# via the external Traefik (LB VIP 198.18.199.0). TLS is terminated with the real
# Let's Encrypt *.unkin.net wildcard (Certificate wildcard-unkin-net in the
# cert-manager namespace, reflected into this namespace as wildcard-unkin-net-tls
# by the emberstack reflector), so there is no cert-manager annotation here. The
# apex watchstate.unkin.net A record lives in the bind-operator unkin.net zone
# (bind-internal/authoritative), NOT external-dns, so no external-dns annotation
# either. The internal watchstate Gateway (watchstate.k8s.syd1.au.unkin.net) is
# untouched; oauth2-proxy fronts both hostnames.
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  labels:
    traefik.io/instance: external
  name: watchstate-external
  namespace: watchstate
spec:
  gatewayClassName: traefik-external
  listeners:
    - name: http
      port: 80
      protocol: HTTP
      hostname: watchstate.unkin.net
      allowedRoutes:
        namespaces:
          from: Same
    - name: https
      port: 443
      protocol: HTTPS
      hostname: watchstate.unkin.net
      allowedRoutes:
        namespaces:
          from: Same
      tls:
        mode: Terminate
        certificateRefs:
          - group: ""
            kind: Secret
            name: wildcard-unkin-net-tls