{{- include "aptly.exposureGuard" . -}}
{{- if .Values.ingress.enabled }}
{{- $fullname := include "aptly.fullname" . -}}
{{- $svcName := $fullname -}}
---
# Repo Ingress — apt clients. In `single` mode this is also where /api/
# traffic arrives; nginx does the read/write split internally (see
# templates/_helpers.tpl's aptly.nginxConf). In `split` mode, note that this
# is a DNS/Ingress-level split only: nginx does not itself reject /api/
# requests that arrive via this host, so combine `split` mode with
# security.write.inClusterOnly or a NetworkPolicy if you need that enforced.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: {{ $fullname }}
  labels:
    {{- include "aptly.labels" . | nindent 4 }}
  annotations:
    {{- toYaml .Values.ingress.annotations | nindent 4 }}
spec:
  {{- with .Values.ingress.className }}
  ingressClassName: {{ . }}
  {{- end }}
  {{- with .Values.ingress.repo.tls }}
  tls:
    {{- toYaml . | nindent 4 }}
  {{- end }}
  rules:
    - {{- with .Values.ingress.repo.host }}
      host: {{ . | quote }}
      {{- end }}
      http:
        paths:
          - path: {{ .Values.ingress.repo.path }}
            pathType: {{ .Values.ingress.repo.pathType }}
            backend:
              service:
                name: {{ $svcName }}
                port:
                  name: http
{{- if and (eq .Values.ingress.mode "split") .Values.ingress.api.enabled (not .Values.security.write.inClusterOnly) }}
---
# API Ingress (split mode) — a separate host so you can put a different
# ingressClass, mTLS, or WAF policy in front of the mutating API than the
# public read path gets.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: {{ $fullname }}-api
  labels:
    {{- include "aptly.labels" . | nindent 4 }}
  annotations:
    {{- toYaml (merge .Values.ingress.api.annotations .Values.ingress.annotations) | nindent 4 }}
spec:
  {{- $apiClass := .Values.ingress.api.className | default .Values.ingress.className }}
  {{- with $apiClass }}
  ingressClassName: {{ . }}
  {{- end }}
  {{- with .Values.ingress.api.tls }}
  tls:
    {{- toYaml . | nindent 4 }}
  {{- end }}
  rules:
    - {{- with .Values.ingress.api.host }}
      host: {{ . | quote }}
      {{- end }}
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: {{ $svcName }}
                port:
                  name: http
{{- end }}
{{- end }}