---
# Friendly public hostname for the kids instance, cheeztv.unkin.net. Same
# internal-Traefik + external-dns pattern as logviewer.unkin.net: external-dns
# publishes the A record at the internal LB VIP (198.18.200.4). Public TLS is
# terminated with the real Let's Encrypt *.unkin.net wildcard, centrally minted
# once in the cert-manager namespace (Certificate wildcard-unkin-net) and
# reflected into this namespace by the emberstack reflector as the secret
# wildcard-unkin-net-tls, not the Vault PKI issuer.
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  labels:
    traefik.io/instance: internal
  annotations:
    external-dns.alpha.kubernetes.io/hostname: cheeztv.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.4
  name: cheeztv
  namespace: cheeztv
spec:
  gatewayClassName: traefik-internal
  listeners:
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: cheeztv.unkin.net
      name: http
      port: 80
      protocol: HTTP
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: cheeztv.unkin.net
      name: https
      port: 443
      protocol: HTTPS
      tls:
        certificateRefs:
          - group: ""
            kind: Secret
            name: wildcard-unkin-net-tls
        mode: Terminate
---
# Cluster hostname variant, mirroring fafflix's jellyfin.k8s.syd1.au.unkin.net
# gateway 1:1 (internal Traefik, external-dns at 198.18.200.4). Own cert secret
# so each hostname gets its own leaf.
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  labels:
    traefik.io/instance: internal
  annotations:
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: cheeztv.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
    external-dns.alpha.kubernetes.io/hostname: cheeztv.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.4
  name: cheeztv-internal
  namespace: cheeztv
spec:
  gatewayClassName: traefik-internal
  listeners:
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: cheeztv.k8s.syd1.au.unkin.net
      name: http
      port: 80
      protocol: HTTP
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: cheeztv.k8s.syd1.au.unkin.net
      name: https
      port: 443
      protocol: HTTPS
      tls:
        certificateRefs:
          - group: ""
            kind: Secret
            name: cheeztv-internal-tls
        mode: Terminate