apiVersion: v1
kind: ConfigMap
metadata:
  name: knoe-svc-kong-config
  namespace: knoe-system
data:
  kong.yml: |
    _format_version: "3.0"
    _transform: true

    services:
      - name: healthz
        url: http://knoe.healthz.invalid/
        routes:
          - name: healthz
            paths:
              - /healthz
            strip_path: true
        plugins:
          - name: request-termination
            config:
              status_code: 200
              message: ok

      - name: knoe-service
        url: http://knoe-svc.knoe-system.svc.cluster.local:8080
        routes:
          - name: knoe-k3s-kubeconfig
            hosts:
              - svc.prole.org
            paths:
              - /k3s/kube_config.sh
            strip_path: false

      - name: db-manager
        url: http://knoe-db-manager.knoe-db.svc.cluster.local:80
        routes:
          - name: backup-route
            hosts:
              - svc.prole.org
            paths:
              - /backup
            strip_path: false

      # Grafana: routed through knoe-grafana-proxy (nginx) which handles
      # Kerberos auth_request (X-WEBAUTH-USER injection) and passes
      # /grafana/login paths through for auth.google sign-in.
      - name: grafana
        url: http://knoe-grafana-proxy.monitoring.svc.cluster.local:80
        routes:
          - name: grafana-root
            hosts:
              - svc.prole.org
            paths:
              - /
            strip_path: false

      - name: knoe-auth
        url: http://knoe-auth.knoe-system.svc.cluster.local:8080
        routes:
          - name: knoe-auth-root
            hosts:
              - api.prole.org
            paths:
              - /auth
            strip_path: false

      # Supabase Studio: gated by oauth2-proxy (Google Workspace prole.org).
      # oauth2-proxy forwards authenticated requests upstream to supabase-kong.
      - name: studio
        url: http://oauth2-proxy.supabase.svc.cluster.local:4180
        routes:
          - name: studio-root
            hosts:
              - db.prole.org
            paths:
              - /
            strip_path: false

      # Gitea: routed through gitea-spnego-proxy (Apache + mod_auth_gssapi) which
      # negotiates SPNEGO/Kerberos and injects X-WEBAUTH-USER for reverse proxy login.
      - name: gitea-http
        url: http://gitea-spnego-proxy.gitea.svc.cluster.local:4000
        routes:
          - name: gitea-root
            hosts:
              - git.prole.org
            paths:
              - /
            strip_path: false

      - name: gitea-ssh
        host: gitea-ssh.gitea.svc.cluster.local
        port: 22
        protocol: tcp
        routes:
          - name: gitea-ssh-tcp
            protocols:
              - tcp
            destinations:
              - port: 3022