apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: hosting-add-prefix
  namespace: minio
spec:
  addPrefix:
    prefix: /hosting
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: hosting-legacy-redirect
  namespace: minio
spec:
  redirectRegex:
    regex: "^https?://([^/]+)/(mila|moritz|nutrition|sleep)\\.html(.*)"
    replacement: "https://${1}/family/${2}.html${3}"
    permanent: false
---
# Public Ingress for hosting.haumdaucher.de (Recipes, Public Assets)
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: minio-hosting
  namespace: minio
  annotations:
    kubernetes.io/ingress.class: "traefik"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    kubernetes.io/tls-acme: "true"
    traefik.ingress.kubernetes.io/router.priority: "10"
    traefik.ingress.kubernetes.io/router.middlewares: minio-hosting-legacy-redirect@kubernetescrd,minio-hosting-add-prefix@kubernetescrd
spec:
  ingressClassName: traefik
  rules:
  - host: hosting.haumdaucher.de
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: minio
            port:
              number: 9000
  tls:
  - hosts:
    - hosting.haumdaucher.de
    secretName: hosting-haumdaucher-de-tls
---
# Protected Ingress for /family (Family Dashboards, Nutrition & Sleep Analytics)
# Protected by Authentik ForwardAuth
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: minio-hosting-family
  namespace: minio
  annotations:
    kubernetes.io/ingress.class: "traefik"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    kubernetes.io/tls-acme: "true"
    traefik.ingress.kubernetes.io/router.priority: "100"
    traefik.ingress.kubernetes.io/router.middlewares: auth-authentik-forwardauth@kubernetescrd,minio-hosting-add-prefix@kubernetescrd
spec:
  ingressClassName: traefik
  rules:
  - host: hosting.haumdaucher.de
    http:
      paths:
      - path: /family
        pathType: Prefix
        backend:
          service:
            name: minio
            port:
              number: 9000
      - path: /outpost.goauthentik.io
        pathType: Prefix
        backend:
          service:
            name: minio
            port:
              number: 9000
  tls:
  - hosts:
    - hosting.haumdaucher.de
    secretName: hosting-haumdaucher-de-tls