{{/*
The Gateway-API alternative to paperless.ingress.yaml (Gitea #114). Form and
reasoning: template-chart/templates/xxx.httproute.yaml and README, "Ingress and
Gateway API".

Only an HTTPRoute with parentRefs. No Gateway, no gatewayClassName, no
Certificate, and no implementation-specific policy object - that subset looks
identical on nginx-gateway-fabric, Cilium, Envoy Gateway and Istio, which is
the whole reason the cluster's implementation can be swapped without touching
this chart. Class and certificate therefore belong to the PLATFORM, on the
Gateway and its listeners.

THIS CHART NEEDED AN ingress.enabled SWITCH BEFORE THIS FILE COULD EXIST

It was the only chart here still rendering its Ingress unconditionally, so
there was no second value path for the mutual-exclusion abort to name - and
in Gateway mode the Ingress would have kept rendering, together with the
unconditional required() on ingress.clusterIssuer, i.e. a value demanded for
nothing. The switch was added with this file, defaulting to true so an existing
release renders byte-identically. See the header of paperless.ingress.yaml.

ingress.clusterIssuer is meaningless here - this chart renders no Certificate
in this mode - and since the switch exists it is no longer demanded either: its
required() now sits behind ingress.enabled.

ingress.domain IS STILL REQUIRED, AND NOT BECAUSE OF THIS FILE

Checked for this chart rather than copied: ingress.domain is read once more
outside both routing templates, in paperless-server.sfs.yaml, where it becomes
PAPERLESS_URL - the ONLY origin this release declares to Django. That read used
to rely on the Ingress template's required() firing first, which stopped being
true the moment the Ingress became switchable, so it now carries its own
required(). Without it an empty domain would render "https://" and every login
POST would be refused as a CSRF failure, with nothing in the log naming a chart
value. Consequence in this mode: a hostname in httpRoute.hostnames that
ingress.domain does not carry publishes the route under one name while Django
trusts another, and the login breaks exactly that way. Set both together, and
remember the pods have to restart before they notice a changed domain.

THE UPLOAD LIMIT IS WHAT THIS MODE LOSES, AND IT IS NOT REBUILT

paperless.files.maxUploadFileSize is rendered into proxy-body-size and
nginx.org/client-max-body-size by the Ingress template. The Gateway API has NO
counterpart - a request-body limit is implementation-specific policy and lives
in an implementation's own object (ClientSettingsPolicy, ClientTrafficPolicy
and their equivalents), which this chart deliberately does not render. So the
value is DOCUMENTED as unenforced in NOTES.txt rather than rebuilt.

The second route documents is unaffected, and that is worth knowing here: the
consume directory (and the SMB CronJob that feeds it) has no size limit at all
and does not pass any proxy, so in Gateway mode a document too large for the
web UI still gets in that way.
*/}}
{{- /*
Null-safe like every other block this chart dereferences (#99): an override
written without children - "httpRoute:" with the keys below it deleted - is
YAML null, and `.Values.httpRoute.enabled` would abort the render with a nil
pointer. An empty block means "chart defaults apply", and all three defaults
are empty or false, so the whole block collapses to "no HTTPRoute".
*/ -}}
{{- $httpRoute := .Values.httpRoute | default dict -}}
{{- if and $httpRoute.enabled .Values.ingress.enabled -}}
{{- fail "ingress.enabled and httpRoute.enabled are both true - set exactly one of them. The Ingress and the HTTPRoute would publish the same Service under the same hostname over two different data paths, which is already a conflict at DNS level: one name, two addresses, and which one a client reaches is luck. A migration runs over a SECOND hostname (set httpRoute.hostnames explicitly while the Ingress keeps ingress.domain), never over parallel operation of both. Note that ingress.enabled defaults to TRUE in this chart, so setting httpRoute.enabled alone is not enough - switch the Ingress off explicitly." -}}
{{- end -}}
{{- if $httpRoute.enabled -}}
{{- $parentRefs := $httpRoute.parentRefs | default list -}}
{{- if not $parentRefs -}}
{{- fail "httpRoute.enabled is true but httpRoute.parentRefs is empty - an HTTPRoute without a parent attaches to no Gateway. It is created, it is schema-valid, and it routes NOTHING, with no event and no condition that says so; the only symptom is a hostname that does not answer. Name the cluster's Gateway, e.g. httpRoute.parentRefs: [{name: public, namespace: gateway}]." -}}
{{- end -}}
{{- /*
One source of truth for the hostname: an empty httpRoute.hostnames means
[ingress.domain], so the two cannot drift apart. ingress.domain is read here
even though no Ingress is rendered in this mode - the value names the public
hostname of this release, which both modes need; it is not an Ingress switch.
A hostname set explicitly here does NOT move PAPERLESS_URL with it, which is
why the two have to be set together in this chart.
*/ -}}
{{- $hostnames := $httpRoute.hostnames | default list -}}
{{- if not $hostnames -}}
{{- $hostnames = list (required "A Domain/Host must be provided: set ingress.domain (used as the HTTPRoute's single hostname when httpRoute.hostnames is empty) or set httpRoute.hostnames explicitly" .Values.ingress.domain) -}}
{{- end -}}
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: {{ .Release.Name }}-{{ .Chart.Name }}-httproute
spec:
  parentRefs:
    {{- toYaml $parentRefs | nindent 4 }}
  hostnames:
    {{- toYaml $hostnames | nindent 4 }}
  rules:
    # The Ingress counterpart is `path: / , pathType: Prefix` on the one
    # backend Service - paperless serves its UI, its API and the document
    # downloads from one process on one port, so a single path covers them.
    #
    # The port is the Service's port NUMBER, not its name: the Ingress
    # references it as "pless-s-port" and backendRefs takes a PortNumber, so
    # this reference cannot be made by name and the 80 below has to track
    # paperless.service.yaml by hand. Three different names describe the same
    # hop in this chart (service port "pless-s-port", targetPort
    # "paperless-port", container port), which is exactly why the number is
    # kept under a test rather than under review:
    # ci/run-httproute-match-test.sh fails when a backendRef names a Service,
    # or a port, the same render does not create.
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: {{ .Release.Name }}-{{ .Chart.Name }}-service
          port: 80
{{- end }}