---
# External (DMZ) front for the arrstack, served on arrstack.unkin.net via the
# external Traefik (LB VIP 198.18.199.0). cert-manager mints arrproxy-gateway-tls
# (CN arrstack.unkin.net) off the internal Vault-PKI CA. The apex arrstack.unkin.net
# A record lives in the bind-operator unkin.net zone (bind-internal/authoritative),
# NOT external-dns, so no external-dns annotation here.
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  labels:
    traefik.io/instance: external
  annotations:
    argocd.argoproj.io/sync-wave: "2"
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: arrstack.unkin.net
    cert-manager.io/private-key-size: "4096"
  name: arrproxy
  namespace: arrstack
spec:
  gatewayClassName: traefik-external
  listeners:
    - name: http
      port: 80
      protocol: HTTP
      hostname: arrstack.unkin.net
      allowedRoutes:
        namespaces:
          from: Same
    - name: https
      port: 443
      protocol: HTTPS
      hostname: arrstack.unkin.net
      allowedRoutes:
        namespaces:
          from: Same
      tls:
        mode: Terminate
        certificateRefs:
          - group: ""
            kind: Secret
            name: arrproxy-gateway-tls