{{/*
The Gateway-API alternative to calibre-web-automated.ingress.yaml (Gitea #114).
Form and reasoning: template-chart/templates/xxx.httproute.yaml and README,
"Ingress and Gateway API".

Only an HTTPRoute with parentRefs. No Gateway, no gatewayClassName, no
Certificate, and no implementation-specific policy object - that subset looks
identical on nginx-gateway-fabric, Cilium, Envoy Gateway and Istio, which is
the whole reason the cluster's implementation can be swapped without touching
this chart. Class and certificate therefore belong to the PLATFORM, on the
Gateway and its listeners.

ingress.clusterIssuer is meaningless here - this chart renders no Certificate
in this mode - and it is not demanded either: its only required() sits inside
calibre-web-automated.ingress.yaml, behind ingress.enabled.

THE UPLOAD LIMIT IS THE ONE THING THIS MODE LOSES, AND IT IS NOT REBUILT

cwa.maxUploadFileSize is rendered into nginx.ingress.kubernetes.io/proxy-body-size
and nginx.org/client-max-body-size by the Ingress template. The Gateway API has
NO counterpart: it knows no body size at all, because a request-body limit is
implementation-specific policy and lives in an implementation's own object
(ClientSettingsPolicy on nginx-gateway-fabric, ClientTrafficPolicy on Istio,
and so on). Rendering one here would bind this chart to one implementation and
to a CRD whose presence it cannot check, so the limit is DOCUMENTED instead -
NOTES.txt says in this mode that the value is not enforced and names where to
set it. The price is named and deliberate: whoever overlooks that output gets
the Gateway's default limit, and an oversized book fails as a proxy error
rather than as a message from CWA. This chart is an e-book library, so the
value is not decoration - a book above the Gateway's default is rejected, and
the rejection carries no hint that a chart value was ignored.

ingress.domain, AND WHY THIS FILE CHANGES WHAT CAN BE CLAIMED ABOUT IT

Checked for this chart rather than copied: ingress.domain is read in the
Ingress template and - until this file existed - NOWHERE else. No environment
variable, no probe Host header, no URL the app builds itself; CWA is told its
address by nothing. That is why values.yaml could say that switching the
Ingress off makes domain unnecessary along with clusterIssuer.

This file is now a second reader (when httpRoute.hostnames is empty), so that
sentence holds only while BOTH modes are off. It is corrected in values.yaml
and in values.schema.json rather than left standing. In Gateway mode with
hostnames empty, domain is required again - by the required() below.
*/}}
{{- /*
Null-safe like every other block this chart dereferences (#99): an override
written without children - "httpRoute:" with the keys below it deleted - is
YAML null, and `.Values.httpRoute.enabled` would abort the render with a nil
pointer. An empty block means "chart defaults apply", and all three defaults
are empty or false, so the whole block collapses to "no HTTPRoute".
*/ -}}
{{- $httpRoute := .Values.httpRoute | default dict -}}
{{- if and $httpRoute.enabled .Values.ingress.enabled -}}
{{- fail "ingress.enabled and httpRoute.enabled are both true - set exactly one of them. The Ingress and the HTTPRoute would publish the same Service under the same hostname over two different data paths, which is already a conflict at DNS level: one name, two addresses, and which one a client reaches is luck. A migration runs over a SECOND hostname (set httpRoute.hostnames explicitly while the Ingress keeps ingress.domain), never over parallel operation of both." -}}
{{- end -}}
{{- if $httpRoute.enabled -}}
{{- $parentRefs := $httpRoute.parentRefs | default list -}}
{{- if not $parentRefs -}}
{{- fail "httpRoute.enabled is true but httpRoute.parentRefs is empty - an HTTPRoute without a parent attaches to no Gateway. It is created, it is schema-valid, and it routes NOTHING, with no event and no condition that says so; the only symptom is a hostname that does not answer. Name the cluster's Gateway, e.g. httpRoute.parentRefs: [{name: public, namespace: gateway}]." -}}
{{- end -}}
{{- /*
One source of truth for the hostname: an empty httpRoute.hostnames means
[ingress.domain], so the two cannot drift apart. ingress.domain is read here
even though no Ingress is rendered in this mode - the value names the public
hostname of this release, which both modes need; it is not an Ingress switch.
Nothing inside the pod follows it, so a hostname set explicitly here needs no
second value changed with it - which is what makes a migration over a second
hostname cheap in THIS chart and expensive in others.
*/ -}}
{{- $hostnames := $httpRoute.hostnames | default list -}}
{{- if not $hostnames -}}
{{- $hostnames = list (required "A Domain/Host must be provided: set ingress.domain (used as the HTTPRoute's single hostname when httpRoute.hostnames is empty) or set httpRoute.hostnames explicitly" .Values.ingress.domain) -}}
{{- end -}}
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: {{ .Release.Name }}-{{ .Chart.Name }}-httproute
spec:
  parentRefs:
    {{- toYaml $parentRefs | nindent 4 }}
  hostnames:
    {{- toYaml $hostnames | nindent 4 }}
  rules:
    # The Ingress counterpart is `path: / , pathType: Prefix` on the one
    # backend Service - CWA serves its whole UI, including the OPDS feed and
    # the ingest views, from one process on one port, so a single path covers
    # it. The port is the Service's port NUMBER and not its name ("http"):
    # backendRefs takes a PortNumber, so unlike the Ingress this reference
    # cannot be made by name and the 80 below has to track
    # calibre-web-automated.service.yaml by hand.
    # ci/run-httproute-match-test.sh is what holds that pair - it fails when a
    # backendRef names a Service, or a port, the same render does not create.
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: {{ .Release.Name }}-{{ .Chart.Name }}-service
          port: 80
{{- end }}