{{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}
{{- $host := index $cozyConfig.data "root-host" }}
{{- $issuerType := (index $cozyConfig.data "clusterissuer") | default "http01" }}
{{- $exposeIngress := index $cozyConfig.data "expose-ingress" | default "tenant-root" }}

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: keycloak-ingress
  {{- with .Values.ingress.annotations }}
  annotations:
    {{- if ne $issuerType "cloudflare" }}
    acme.cert-manager.io/http01-ingress-class: {{ $exposeIngress }}
    {{- end }}
    cert-manager.io/cluster-issuer: letsencrypt-prod
    {{- toYaml . | nindent 4 }}
  {{- end }}
spec:
  ingressClassName: {{ $exposeIngress }}
  tls:
  - hosts:
      - keycloak.{{ $host }}
    secretName: web-tls
  rules:
  - host: keycloak.{{ $host }}
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: keycloak-http
            port:
              name: http
