apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: hosting-add-prefix
  namespace: minio
spec:
  addPrefix:
    prefix: /hosting
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: hosting-redirect-mila
  namespace: minio
spec:
  redirectRegex:
    regex: "^https?://([^/]+)/(?:family/)?(mila|sleep)\\.html.*"
    replacement: "https://family.haumdaucher.de/tracking/mila/"
    permanent: true
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: hosting-redirect-moritz
  namespace: minio
spec:
  redirectRegex:
    regex: "^https?://([^/]+)/(?:family/)?(moritz|nutrition)\\.html.*"
    replacement: "https://family.haumdaucher.de/tracking/moritz/"
    permanent: true
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: hosting-redirect-family-root
  namespace: minio
spec:
  redirectRegex:
    regex: "^https?://([^/]+)/family/?$"
    replacement: "https://family.haumdaucher.de/"
    permanent: true
---
# Public Ingress for hosting.haumdaucher.de (Recipes, Public Assets, Legacy Redirects)
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: minio-hosting
  namespace: minio
  annotations:
    kubernetes.io/ingress.class: "traefik"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    kubernetes.io/tls-acme: "true"
    traefik.ingress.kubernetes.io/router.priority: "10"
    traefik.ingress.kubernetes.io/router.middlewares: minio-hosting-redirect-mila@kubernetescrd,minio-hosting-redirect-moritz@kubernetescrd,minio-hosting-redirect-family-root@kubernetescrd,minio-hosting-add-prefix@kubernetescrd
spec:
  ingressClassName: traefik
  rules:
  - host: hosting.haumdaucher.de
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: minio
            port:
              number: 9000
  tls:
  - hosts:
    - hosting.haumdaucher.de
    secretName: hosting-haumdaucher-de-tls
---
# Protected Ingress for /family (Redirects and Authentik Outpost)
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: minio-hosting-family
  namespace: minio
  annotations:
    kubernetes.io/ingress.class: "traefik"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    kubernetes.io/tls-acme: "true"
    traefik.ingress.kubernetes.io/router.priority: "100"
    traefik.ingress.kubernetes.io/router.middlewares: minio-hosting-redirect-mila@kubernetescrd,minio-hosting-redirect-moritz@kubernetescrd,minio-hosting-redirect-family-root@kubernetescrd,auth-authentik-forwardauth@kubernetescrd,minio-hosting-add-prefix@kubernetescrd
spec:
  ingressClassName: traefik
  rules:
  - host: hosting.haumdaucher.de
    http:
      paths:
      - path: /family
        pathType: Prefix
        backend:
          service:
            name: minio
            port:
              number: 9000
      - path: /outpost.goauthentik.io
        pathType: Prefix
        backend:
          service:
            name: minio
            port:
              number: 9000
  tls:
  - hosts:
    - hosting.haumdaucher.de
    secretName: hosting-haumdaucher-de-tls