# knoe-db-postgres-tcp-ingress.yaml
# Traefik IngressRouteTCP for direct PostgreSQL access on db.internal.prole.org:5432.
# Routes to knoe-db-rw (CNPG primary read-write endpoint) in the knoe-db namespace.
#
# Prerequisites:
#   - traefik HelmChart must have ports.postgres.port=5432 configured (exposedPort 5432)
#   - DNS: db.internal.prole.org → 10.0.0.3 (myrddin, traefik LB VIP)
#   - Access is local-network only (no port 5432 forwarded through NAT router)
#
# NOTE: HostSNI("*") is required for plain TCP (non-TLS) passthrough.
# All TCP connections on the 'postgres' entrypoint go to knoe-db-rw:5432.
---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: knoe-db-rw-postgres
  namespace: knoe-db
spec:
  entryPoints:
    - postgres
  routes:
    - match: HostSNI(`*`)
      services:
        - name: knoe-db-rw
          port: 5432