# services/hermes/agent-ingress.yaml
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: hermes-agent-terminal-slash
  namespace: hermes
spec:
  redirectRegex:
    # Host-preserving so the trailing-slash fixup works on both the canonical
    # worker.bstein.dev and the legacy agent.hermes.bstein.dev host.
    regex: ^https://(worker\.bstein\.dev|agent\.hermes\.bstein\.dev)/terminal$
    replacement: https://${1}/terminal/
    permanent: false
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: hermes-agent-stock-dashboard-headers
  namespace: hermes
spec:
  headers:
    customRequestHeaders:
      Origin: http://127.0.0.1:9119
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: hermes-agent-dashboard
  namespace: hermes
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    traefik.ingress.kubernetes.io/router.middlewares: hermes-hermes-agent-stock-dashboard-headers@kubernetescrd
    traefik.ingress.kubernetes.io/router.tls: "true"
spec:
  ingressClassName: traefik
  tls:
    - hosts:
        - worker.bstein.dev
        - agent.hermes.bstein.dev
      secretName: hermes-sites-tls
  rules:
    - host: worker.bstein.dev
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: oauth2-proxy-hermes-agent
                port:
                  name: http
    # Legacy host, served unchanged until it is retired in a separate change.
    - host: agent.hermes.bstein.dev
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: oauth2-proxy-hermes-agent
                port:
                  name: http
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: hermes-agent-terminal
  namespace: hermes
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    traefik.ingress.kubernetes.io/router.middlewares: hermes-hermes-agent-terminal-slash@kubernetescrd
    traefik.ingress.kubernetes.io/router.tls: "true"
spec:
  ingressClassName: traefik
  tls:
    - hosts:
        - worker.bstein.dev
        - agent.hermes.bstein.dev
      secretName: hermes-sites-tls
  rules:
    - host: worker.bstein.dev
      http:
        paths:
          - path: /terminal
            pathType: Prefix
            backend:
              service:
                name: oauth2-proxy-hermes-agent
                port:
                  name: http
    # Legacy host, served unchanged until it is retired in a separate change.
    - host: agent.hermes.bstein.dev
      http:
        paths:
          - path: /terminal
            pathType: Prefix
            backend:
              service:
                name: oauth2-proxy-hermes-agent
                port:
                  name: http
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: hermes-sites
  namespace: hermes
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    traefik.ingress.kubernetes.io/router.tls: "true"
spec:
  ingressClassName: traefik
  tls:
    - hosts:
        - agent.hermes.bstein.dev
        - chat.bstein.dev
        - triage.bstein.dev
        - worker.bstein.dev
        - chat.hermes.bstein.dev
        - triage.hermes.bstein.dev
      secretName: hermes-sites-tls
  rules:
    - host: chat.bstein.dev
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: oauth2-proxy-hermes-chat
                port:
                  name: http
    - host: triage.bstein.dev
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: oauth2-proxy-hermes-triage
                port:
                  name: http
    # Legacy hosts serve the same backends so the rename is additive. They are
    # kept until an explicit retirement change, not redirected: oauth2-proxy
    # cookies are host-bound, so a redirect would silently drop the session.
    - host: chat.hermes.bstein.dev
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: oauth2-proxy-hermes-chat
                port:
                  name: http
    - host: triage.hermes.bstein.dev
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: oauth2-proxy-hermes-triage
                port:
                  name: http