{{- include "aptly.exposureGuard" . -}}
{{- if .Values.gateway.enabled }}
{{- $fullname := include "aptly.fullname" . -}}
{{- $svcName := $fullname -}}
{{- if not .Values.gateway.parentRefs }}
{{- fail "gateway.enabled=true requires gateway.parentRefs to reference at least one existing Gateway — this chart never creates a Gateway itself." -}}
{{- end }}
---
# Repo HTTPRoute — apt clients. In `single` mode this is also where /api/
# traffic arrives; nginx does the read/write split internally (see
# templates/_helpers.tpl's aptly.nginxConf). In `split` mode, note that this
# is a route-level split only: nginx does not itself reject /api/ requests
# that arrive via this hostname, so combine `split` mode with
# security.write.inClusterOnly or a NetworkPolicy if you need that enforced.
# TLS is configured on the referenced Gateway's listener, not here.
apiVersion: {{ .Values.gateway.apiVersion }}
kind: HTTPRoute
metadata:
  name: {{ $fullname }}
  labels:
    {{- include "aptly.labels" . | nindent 4 }}
spec:
  parentRefs:
    {{- toYaml .Values.gateway.parentRefs | nindent 4 }}
  {{- with .Values.gateway.repo.hostnames }}
  hostnames:
    {{- toYaml . | nindent 4 }}
  {{- end }}
  rules:
    - matches:
        - path:
            type: {{ .Values.gateway.repo.pathType }}
            value: {{ .Values.gateway.repo.path }}
      backendRefs:
        - name: {{ $svcName }}
          port: {{ .Values.service.port }}
{{- if and (eq .Values.gateway.mode "split") .Values.gateway.api.enabled (not .Values.security.write.inClusterOnly) }}
---
# API HTTPRoute (split mode) — a separate hostname/Gateway so you can put a
# different Gateway, mTLS, or WAF policy in front of the mutating API than
# the public read path gets.
apiVersion: {{ .Values.gateway.apiVersion }}
kind: HTTPRoute
metadata:
  name: {{ $fullname }}-api
  labels:
    {{- include "aptly.labels" . | nindent 4 }}
spec:
  {{- $apiParentRefs := .Values.gateway.api.parentRefs | default .Values.gateway.parentRefs }}
  parentRefs:
    {{- toYaml $apiParentRefs | nindent 4 }}
  {{- with .Values.gateway.api.hostnames }}
  hostnames:
    {{- toYaml . | nindent 4 }}
  {{- end }}
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: {{ $svcName }}
          port: {{ .Values.service.port }}
{{- end }}
{{- end }}