{{- if .Values.ingress.enabled }}
{{- $name := include "cloudhost-app.name" . -}}
{{- $ns   := include "cloudhost-app.namespace" . -}}
{{- $host := printf "%s.%s" (default $name .Values.ingress.subdomain) .Values.ingress.domain -}}
{{- $previewHost := .Values.ingress.previewHost | default "" -}}
{{- $className := .Values.ingress.className | default "traefik" -}}
{{- /* Only public, real-TLD hosts (custom domain + preview) can get a managed cert.
       The internal *.apps.cloudhost.local host is not a valid public suffix and would
       make Let's Encrypt reject the whole order. */ -}}
{{- $tlsHosts := list -}}
{{- if .Values.ingress.customDomain }}{{- $tlsHosts = append $tlsHosts .Values.ingress.customDomain -}}{{- end -}}
{{- if $previewHost }}{{- $tlsHosts = append $tlsHosts $previewHost -}}{{- end -}}
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: {{ $name }}
  namespace: {{ $ns }}
  labels:
    {{- include "cloudhost-app.labels" . | nindent 4 }}
  {{- if gt (len $tlsHosts) 0 }}
  annotations:
    cert-manager.io/cluster-issuer: {{ .Values.ingress.clusterIssuer | quote }}
  {{- end }}
spec:
  ingressClassName: {{ $className }}
  rules:
    - host: {{ $host }}
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: {{ $name }}
                port:
                  number: 80
    {{- if .Values.ingress.customDomain }}
    - host: {{ .Values.ingress.customDomain }}
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: {{ $name }}
                port:
                  number: 80
    {{- end }}
    {{- if $previewHost }}
    - host: {{ $previewHost }}
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: {{ $name }}
                port:
                  number: 80
    {{- end }}
  {{- if gt (len $tlsHosts) 0 }}
  tls:
    - hosts:
        {{- range $tlsHosts }}
        - {{ . }}
        {{- end }}
      secretName: {{ $name }}-tls
  {{- end }}
{{- end }}