{{- /*
The Ingress for the WebUI and JMAP only. SMTP, IMAP and ManageSieve are not
HTTP and cannot pass through it - those reach the pods through the per-port
NodePort Services.

It targets exactly ONE node group (ingress.nodeGroup) through that group's own
http Service, never a port-label selector: the management surface is not safe
to spread across a group that may not run the management tasks.

TWO TRAPS THAT BELONG TO THIS OBJECT AND ARE NOT SOLVED BY IT:

1. The auto-ban sees the INGRESS CONTROLLER's pod IP for every JMAP and WebUI
   request, not the client's. Sooner or later it bans that address and the
   WebUI and JMAP go dark for everyone at once. The PROXY protocol is not the
   remedy for HTTP: the remedy is Stalwart's "forwarded" handling with
   X-Forwarded-For evaluation, plus discarding whatever forwarding headers the
   client brought along. That is a configuration step in the database, and it
   is mandatory rather than optional - the failure arrives weeks later and
   looks like a server problem.

2. AFTER BOOTSTRAP, PORT 8080 IS NOT THE ADMIN PORT ANY MORE. Upstream:
   "After the restart, the WebUI is reached at https://<hostname>/admin on the
   configured server hostname, and HTTP access on port 8080 is no longer
   available for administration." So this Ingress only works once an HTTP
   NetworkListener on 8080 exists in the database. Between finishing the setup
   and creating that listener, the Ingress resolves to a port that answers
   nothing.
*/ -}}
{{- if .Values.ingress.enabled }}
{{- $group := include "stalwart.ingressNodeGroup" . -}}
{{- $nodes := fromYaml (include "stalwart.nodes" .) -}}
{{- $spec := index $nodes $group -}}
{{- if not (has "http" $spec.exposedPorts) -}}
{{- fail (printf "ingress.nodeGroup is %q, but nodes.%s.exposedPorts does not include \"http\" - there would be no Service for the Ingress to point at" $group $group) -}}
{{- end -}}
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: {{ include "stalwart.fullname" . }}-ingress
  labels:
    app: {{ include "stalwart.fullname" . }}
  annotations:
    cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided (ingress.clusterIssuer)" .Values.ingress.clusterIssuer }}
    {{- with .Values.ingress.annotations }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
spec:
  ingressClassName: {{ .Values.ingress.className }}
  rules:
    - host: {{ required "A Domain/Host must be provided (ingress.domain)" .Values.ingress.domain }}
      http:
        paths:
          - backend:
              service:
                # The http Service of the "{{ $group }}" group only.
                name: {{ include "stalwart.fullname" . }}-{{ $group }}-http-service
                port:
                  name: http
            path: /
            pathType: Prefix
  tls:
    - hosts:
        - {{ required "A Domain/Host must be provided (ingress.domain)" .Values.ingress.domain }}
      secretName: tls-{{ include "stalwart.fullname" . }}-ingress
{{- end }}