---
# Redirect plain HTTP to HTTPS.
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: arrproxy-http-redirect
  namespace: arrstack
  annotations:
    argocd.argoproj.io/sync-wave: "2"
spec:
  hostnames:
    - arrstack.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: arrproxy
      sectionName: http
  rules:
    - filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            statusCode: 301
      matches:
        - path:
            type: PathPrefix
            value: /
---
# All HTTPS traffic enters via oauth2-proxy (the arrproxy entry Service), which
# authenticates and path-routes to arrproxy-ui / arrproxy-api. The UI-vs-api and
# the /<app>/api oauth-bypass split is done inside oauth2-proxy (upstreams +
# skip-auth-regex), so a single backend here is sufficient.
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: arrproxy-route
  namespace: arrstack
  annotations:
    argocd.argoproj.io/sync-wave: "2"
spec:
  hostnames:
    - arrstack.unkin.net
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: arrproxy
      sectionName: https
  rules:
    - backendRefs:
        - group: ""
          kind: Service
          name: arrproxy
          port: 80
          weight: 1
      matches:
        - path:
            type: PathPrefix
            value: /