# Two routers on one host. The site itself must stay readable by anyone --
# it is a family blog -- while the editing surface sits behind Authentik.
#
# Why not one gated Ingress with a skip-path, the way paperless carves out
# /static/: that works when the PUBLIC paths are enumerable. Here
# it is the reverse -- every post URL is public and only two paths are gated
# -- which would need a negative lookahead. The outpost is Go, and RE2 has no
# lookahead. So the split happens at the router instead.
#
# Traefik orders routers by rule length, so PathPrefix(`/wp-admin`) is
# evaluated before PathPrefix(`/`); no explicit priority is needed.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: wordpress
  namespace: wordpress
  labels:
    dns.renner.uno/public: "true"
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-cluster
spec:
  ingressClassName: traefik
  rules:
    - host: www.renner.uno
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: wordpress
                port:
                  number: 80
  tls:
    - secretName: wordpress-tls
      hosts:
        - www.renner.uno
---
# wp-admin, wp-login.php, xmlrpc.php and the outpost's own OAuth leg
# (/outpost.goauthentik.io) are gated by authentik-gate-sync (ingress class
# authentik-gate): WordPress Authors only. The public Ingress above owns the
# Certificate for wordpress-tls.
#
# /wp-admin covers admin-ajax.php, which is safe because no plugin on the site
# emits an ajaxurl. xmlrpc.php goes through the gate because an Ingress has no
# deny verb.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: wordpress-admin
  namespace: wordpress
  labels:
    # external-dns-unifi runs with --label-filter=dns.renner.uno/public!=true,
    # so an unlabelled Ingress on this host would gain a UDM A-record pointing
    # LAN clients at the Traefik VIP.
    dns.renner.uno/public: "true"
  annotations:
    auth.renner.uno/group: WordPress Authors
spec:
  ingressClassName: authentik-gate
  tls:
    - secretName: wordpress-tls
      hosts:
        - www.renner.uno
  rules:
    - host: www.renner.uno
      http:
        paths:
          - path: /outpost.goauthentik.io
            pathType: Prefix
            backend:
              service:
                name: wordpress
                port:
                  number: 80
          # anchor: gated-paths
          - path: /wp-admin
            pathType: Prefix
            backend:
              service:
                name: wordpress
                port:
                  number: 80
          - path: /wp-login.php
            pathType: Exact
            backend:
              service:
                name: wordpress
                port:
                  number: 80
          - path: /xmlrpc.php
            pathType: Exact
            backend:
              service:
                name: wordpress
                port:
                  number: 80