# Render-only overlay for ci/run-httproute-match-test.sh, applied LAST.
#
# Its one job is to put this chart into Gateway mode, because the convention
# ships with httpRoute.enabled: false and the test would otherwise be green
# over nothing. A chart that has an overlay here and still renders no
# HTTPRoute FAILS the test - that is the whole point of the file existing.
#
# An overlay and not a change to ci/matrix-synapse/test-values.yaml: the
# install-test runs exactly ONE configuration per chart, and this chart's
# fixture installs the StatefulSet with its PVC and the delegation Deployment.
# Trading its Ingress for a CRD schema check that cyberchef's fixture already
# performs against the real Gateway-API CRDs would be a bad swap. The install
# keeps the Ingress; the routes are held here, at render level, which is where
# their silent failure modes live.
#
# ingress.enabled: false is not optional here - ingress.enabled is this chart's
# routing switch and defaults to TRUE, so without this line the chart aborts
# its own render with both modes on.
#
# WHAT THIS OVERLAY COVERS, WHICH IS BOTH ROUTING OBJECTS - and this chart is
# the one in group 3 where "both" means two different hostnames, two different
# paths and two different backends:
#
#   - ingress.domain comes from the fixture (matrix.ci.local), so the
#     HOMESERVER route renders with its hostname from that single source of
#     truth. httpRoute.hostnames stays empty on purpose: the fallback is the
#     path every installation will actually use.
#   - matrix.delegation.enabled is TRUE in the fixture with
#     matrix.delegation.serverUrl: ci.local, so the DELEGATION route renders
#     too - on its own hostname, matching PathPrefix /.well-known/matrix, and
#     pointing at the delegation Service rather than at Synapse. Its
#     parentRefs fall back to httpRoute.parentRefs below, which is the branch
#     an installation hits unless the server name sits behind a different
#     Gateway.
#   - both routes' backendRefs are checked against the Services of the same
#     render, and they are DIFFERENT Services. Both references are by PORT
#     NUMBER rather than by the name "http" the Ingress uses, because
#     backendRefs takes a PortNumber - so this overlay is what holds those
#     numbers against the Services'.
#
# No URLRewrite filter is rendered by this chart in either mode: the delegation
# nginx answers on the full /.well-known/matrix/* path, so nothing is stripped
# and the #118 prefix/redirect assurance has no precondition to meet here.
#
# NOT covered here, and it cannot be: that either hostname answers, which for
# Matrix is also whether FEDERATION works. No Gateway controller runs in CI, no
# route reaches "Accepted: True", and Matrix federation is HTTPS-only while
# nothing in this mode renders a certificate. Nor is the body-size limit
# covered - proxy-body-size: 50m is on the live Ingress and has no counterpart
# in the specification; that loss is documented in values.yaml and printed by
# NOTES.txt, and documentation is not something a test can assert.
ingress:
  enabled: false
httpRoute:
  enabled: true
  parentRefs:
    - name: public
      namespace: gateway
      sectionName: https