---
# External (DMZ) front for the VictoriaLogs UI on vlogs.unkin.net via the
# external Traefik (LB VIP 198.18.199.0). TLS terminates with the real Let's
# Encrypt *.unkin.net wildcard (Certificate wildcard-unkin-net in cert-manager,
# reflected into this namespace as wildcard-unkin-net-tls by the emberstack
# reflector), so there is no cert-manager annotation here. The apex
# vlogs.unkin.net A record lives in the bind-operator unkin.net zone, NOT
# external-dns, so no external-dns annotation either. oauth2-proxy fronts it.
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  labels:
    traefik.io/instance: external
  name: vlogs-external
  namespace: vlogs
spec:
  gatewayClassName: traefik-external
  listeners:
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: vlogs.unkin.net
      name: http
      port: 80
      protocol: HTTP
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: vlogs.unkin.net
      name: https
      port: 443
      protocol: HTTPS
      tls:
        certificateRefs:
          - group: ""
            kind: Secret
            name: wildcard-unkin-net-tls
        mode: Terminate