apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: gateway-relay-tls
  namespace: kube-system
spec:
  secretName: gateway-relay-tls
  secretTemplate:
    annotations:
      reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: zitadel,stalwart
      reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: zitadel
  issuerRef:
    name: letsencrypt
    kind: ClusterIssuer
  commonName: quorate.dev
  dnsNames:
    - quorate.dev
    - "*.quorate.dev"
  duration: 2160h
  renewBefore: 360h
  privateKey:
    algorithm: ECDSA
    size: 256
    rotationPolicy: Always
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: gateway-relay
  namespace: kube-system
  annotations:
    io.cilium/lb-ipam-ips: "10.104.40.127"
spec:
  gatewayClassName: cilium
  listeners:
    - name: https
      port: 443
      protocol: HTTPS
      hostname: "*.quorate.dev"
      tls:
        mode: Terminate
        certificateRefs:
          - kind: Secret
            name: gateway-relay-tls
      allowedRoutes:
        namespaces:
          from: Selector
          selector:
            matchLabels:
              gateway.quorate.internal/allow-public: "true"
    - name: http
      port: 80
      protocol: HTTP
      hostname: "*.quorate.dev"
      allowedRoutes:
        namespaces:
          from: Selector
          selector:
            matchLabels:
              gateway.quorate.internal/allow-public: "true"
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: https-redirect-relay
  namespace: kube-system
spec:
  parentRefs:
    - name: gateway-relay
      namespace: kube-system
      sectionName: http
  hostnames:
    - "*.quorate.dev"
  rules:
    - filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            statusCode: 301