{{/*
The Gateway-API alternative to outline.ingress.yaml (Gitea #114). Form and
reasoning: template-chart/templates/xxx.httproute.yaml and README, "Ingress and
Gateway API".

Only an HTTPRoute with parentRefs. No Gateway, no gatewayClassName, no
Certificate, and no implementation-specific policy object - that subset looks
identical on nginx-gateway-fabric, Cilium, Envoy Gateway and Istio, which is
the whole reason the cluster's implementation can be swapped without touching
this chart. Class and certificate therefore belong to the PLATFORM, on the
Gateway and its listeners.

ingress.clusterIssuer is meaningless here - this chart renders no Certificate
in this mode - and it is not demanded either: its only required() sits inside
outline.ingress.yaml, behind ingress.enabled.

ingress.domain IS STILL REQUIRED, AND NOT BECAUSE OF THIS FILE

Checked for this chart rather than copied: ingress.domain is read once more
outside both routing templates, in outline.sfs.yaml, where it builds Outline's
URL variable and carries its own required(). URL is what every generated link,
every share URL and the OIDC redirect URI are built from, so domain is
mandatory in EVERY mode of this chart - the fallback below is never its only
reader. Setting httpRoute.hostnames to a name ingress.domain does not carry
therefore publishes the route under one name while the app hands out links
under another, and an OIDC login fails on a redirect_uri the provider does not
know. Set both together.

THE UPLOAD LIMIT, AND WHY THIS MODE MOVES Gitea #12 INSTEAD OF FIXING IT

ingress.maxUploadFileSize is rendered into proxy-body-size and
nginx.org/client-max-body-size by the Ingress template. The Gateway API has NO
counterpart: a request-body limit is implementation-specific policy and lives
in an implementation's own object (ClientSettingsPolicy, ClientTrafficPolicy
and their equivalents), which this chart deliberately does not render. So the
value is DOCUMENTED as unenforced in NOTES.txt rather than rebuilt.

That matters more here than anywhere else in this sweep, because this chart is
the one with the open defect: outline.maxUploadSize is 250 MB by default while
ingress.maxUploadFileSize is 25m - a factor of ten, and the smaller number
wins (Gitea #12). In Gateway mode the ingress half of that pair DISAPPEARS, so
the effective ceiling becomes the Gateway's, which is neither of the two values
the chart documents. That CHANGES the situation of #12; it does not resolve it,
and this file deliberately does not try to: the chart would have to render a
policy object to do so, which is exactly the portability the sweep is buying.
The honest statement is in NOTES.txt for this mode: whichever of
outline.maxUploadSize and the Gateway's limit is smaller decides, and the chart
can only name one of them.
*/}}
{{- /*
Null-safe like every other block this chart dereferences (#99): an override
written without children - "httpRoute:" with the keys below it deleted - is
YAML null, and `.Values.httpRoute.enabled` would abort the render with a nil
pointer. An empty block means "chart defaults apply", and all three defaults
are empty or false, so the whole block collapses to "no HTTPRoute".
*/ -}}
{{- $httpRoute := .Values.httpRoute | default dict -}}
{{- if and $httpRoute.enabled .Values.ingress.enabled -}}
{{- fail "ingress.enabled and httpRoute.enabled are both true - set exactly one of them. The Ingress and the HTTPRoute would publish the same Service under the same hostname over two different data paths, which is already a conflict at DNS level: one name, two addresses, and which one a client reaches is luck. A migration runs over a SECOND hostname (set httpRoute.hostnames explicitly while the Ingress keeps ingress.domain), never over parallel operation of both." -}}
{{- end -}}
{{- if $httpRoute.enabled -}}
{{- $parentRefs := $httpRoute.parentRefs | default list -}}
{{- if not $parentRefs -}}
{{- fail "httpRoute.enabled is true but httpRoute.parentRefs is empty - an HTTPRoute without a parent attaches to no Gateway. It is created, it is schema-valid, and it routes NOTHING, with no event and no condition that says so; the only symptom is a hostname that does not answer. Name the cluster's Gateway, e.g. httpRoute.parentRefs: [{name: public, namespace: gateway}]." -}}
{{- end -}}
{{- /*
One source of truth for the hostname: an empty httpRoute.hostnames means
[ingress.domain], so the two cannot drift apart. ingress.domain is read here
even though no Ingress is rendered in this mode - the value names the public
hostname of this release, which both modes need; it is not an Ingress switch.
A hostname set explicitly here does NOT move Outline's URL variable with it:
that keeps following ingress.domain, so the two have to be set together or the
app publishes links nobody can follow.
*/ -}}
{{- $hostnames := $httpRoute.hostnames | default list -}}
{{- if not $hostnames -}}
{{- $hostnames = list (required "A Domain/Host must be provided: set ingress.domain (used as the HTTPRoute's single hostname when httpRoute.hostnames is empty) or set httpRoute.hostnames explicitly" .Values.ingress.domain) -}}
{{- end -}}
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: {{ .Release.Name }}-{{ .Chart.Name }}-httproute
spec:
  parentRefs:
    {{- toYaml $parentRefs | nindent 4 }}
  hostnames:
    {{- toYaml $hostnames | nindent 4 }}
  rules:
    # The Ingress counterpart is `path: / , pathType: Prefix` on the one
    # backend Service - Outline serves its UI, its API and its collaborative
    # WebSocket from one process on one port, so a single path covers all
    # three. The port is the Service's port NUMBER and not its name ("http"):
    # backendRefs takes a PortNumber, so unlike the Ingress this reference
    # cannot be made by name and the 80 below has to track
    # outline.service.yaml by hand.
    # ci/run-httproute-match-test.sh is what holds that pair - it fails when a
    # backendRef names a Service, or a port, the same render does not create.
    #
    # WEBSOCKETS: nothing to configure, in either mode. Outline's realtime
    # editing runs over a WebSocket upgrade on the same port, and the Gateway
    # API passes an upgrade through on a plain HTTPRoute - there is no
    # annotation involved in Ingress mode either.
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: {{ .Release.Name }}-{{ .Chart.Name }}-service
          port: 80
{{- end }}