---
# HTTP → HTTPS redirect
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: gestion-http
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "gestion-traefik.labels" . | nindent 4 }}
spec:
  entryPoints:
    - web
  routes:
    - match: Host(`{{ .Values.domain }}`)
      kind: Rule
      middlewares:
        - name: redirect-https
      services:
        - name: noop@internal
          kind: TraefikService
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: redirect-https
  namespace: {{ .Release.Namespace }}
spec:
  redirectScheme:
    scheme: https
    permanent: true
---
# HTTPS — routes principales
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: gestion-https
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "gestion-traefik.labels" . | nindent 4 }}
spec:
  entryPoints:
    - websecure
  routes:
    # API backend — WAF + headers + rate limit
    - match: Host(`{{ .Values.domain }}`) && (PathPrefix(`/api/`) || PathPrefix(`/webhook/`))
      kind: Rule
      priority: 20
      middlewares:
        - name: waf-chain
      services:
        - name: {{ .Values.backend.serviceName }}
          namespace: {{ .Values.servicesNamespace }}
          port: {{ .Values.backend.servicePort }}

    # Fichiers uploadés — WAF désactivé dans les règles Coraza pour ce path
    - match: Host(`{{ .Values.domain }}`) && PathPrefix(`/uploads/`)
      kind: Rule
      priority: 15
      middlewares:
        - name: security-headers
      services:
        - name: {{ .Values.backend.serviceName }}
          namespace: {{ .Values.servicesNamespace }}
          port: {{ .Values.backend.servicePort }}

    # Frontend SPA — WAF + headers + rate limit
    - match: Host(`{{ .Values.domain }}`)
      kind: Rule
      priority: 1
      middlewares:
        - name: waf-chain
      services:
        - name: {{ .Values.frontend.serviceName }}
          namespace: {{ .Values.servicesNamespace }}
          port: {{ .Values.frontend.servicePort }}

  tls:
    {{- if eq .Values.tls.mode "letsencrypt" }}
    certResolver: letsencrypt
    {{- else }}
    secretName: {{ .Values.tls.secretName }}
    {{- end }}
    domains:
      - main: {{ .Values.domain }}