---
# Front-door entry Service: the HTTPRoute for arrstack.unkin.net targets this.
# All traffic (UI, token API, and the *arr proxy) enters via oauth2-proxy.
apiVersion: v1
kind: Service
metadata:
  name: arrproxy
  namespace: arrstack
  annotations:
    argocd.argoproj.io/sync-wave: "2"
spec:
  internalTrafficPolicy: Cluster
  ports:
    - name: http
      port: 80
      protocol: TCP
      targetPort: http
  selector:
    app: arrproxy-oauth2
  sessionAffinity: None
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  name: arrproxy-api
  namespace: arrstack
  annotations:
    argocd.argoproj.io/sync-wave: "2"
spec:
  internalTrafficPolicy: Cluster
  ports:
    - name: http
      port: 8080
      protocol: TCP
      targetPort: http
  selector:
    app: arrproxy-api
  sessionAffinity: None
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  name: arrproxy-ui
  namespace: arrstack
  annotations:
    argocd.argoproj.io/sync-wave: "2"
spec:
  internalTrafficPolicy: Cluster
  ports:
    - name: http
      port: 8080
      protocol: TCP
      targetPort: http
  selector:
    app: arrproxy-ui
  sessionAffinity: None
  type: ClusterIP