{{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}
{{- $exposeIngress := index $cozyConfig.data "expose-ingress" | default "tenant-root" }}
{{- $exposeExternalIPs := (index $cozyConfig.data "expose-external-ips") | default "" }}
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: ingress-nginx-system
spec:
  chart:
    spec:
      chart: cozy-ingress-nginx
      reconcileStrategy: Revision
      sourceRef:
        kind: HelmRepository
        name: cozystack-system
        namespace: cozy-system
      version: '>= 0.0.0-0'
  interval: 1m0s
  timeout: 5m0s
  values:
    ingress-nginx:
      fullnameOverride: {{ trimPrefix "tenant-" .Release.Namespace }}-ingress
      controller:
        replicaCount: {{ .Values.replicas }}
        ingressClass: {{ .Release.Namespace }}
        ingressClassResource:
          name: {{ .Release.Namespace }}
          controllerValue: k8s.io/ingress-nginx-{{ .Release.Namespace }}
        podLabels:
          cozystack.io/service: ingress
          policy.cozystack.io/allow-to-apiserver: "true"
        {{- if not (eq .Release.Namespace "tenant-root") }}
        admissionWebhooks:
          enabled: false
        {{- end }}
        service:
          {{- if and (eq $exposeIngress .Release.Namespace) $exposeExternalIPs }}
          externalIPs:
            {{- toYaml (splitList "," $exposeExternalIPs) | nindent 12 }}
          type: ClusterIP
          externalTrafficPolicy: Cluster
          {{- else }}
          type: LoadBalancer
          externalTrafficPolicy: Local
          {{- end }}
        {{- if or .Values.whitelist .Values.clouflareProxy }}
        config:
          {{- with .Values.whitelist }}
          whitelist-source-range: "{{ join "," . }}"
          {{- end }}
          {{- if .Values.clouflareProxy }}
          set_real_ip_from: "{{ include "ingress.cloudflare-ips" . }}"
          use-forwarded-headers: "true"
          server-snippet: "real_ip_header CF-Connecting-IP;"
          {{- end }}
        {{- end }}
