---
# External (DMZ) front for the haproxy edge on the traefik-external LB VIP
# 198.18.199.0. Traefik terminates TLS so HTTP/2 connections coalesced from
# other *.unkin.net hosts still route by Host; the hop to haproxy is re-encrypted via
# BackendTLSPolicy. Routes carry the explicit hostname list.
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: haproxy
  namespace: haproxy
  labels:
    traefik.io/instance: external
spec:
  gatewayClassName: traefik-external
  listeners:
    - name: http
      port: 80
      protocol: HTTP
      allowedRoutes:
        namespaces:
          from: Same
    - name: https
      port: 443
      protocol: HTTPS
      tls:
        mode: Terminate
        certificateRefs:
          - group: ""
            kind: Secret
            name: wildcard-unkin-net-tls
          - group: ""
            kind: Secret
            name: wildcard-main-unkin-net-tls
          - group: ""
            kind: Secret
            name: wildcard-ceph-unkin-net-tls
      allowedRoutes:
        namespaces:
          from: Same