{{- if .Values.ingress.enabled -}}
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: {{ include "pomerium.fullname" . }}
  labels:
    app.kubernetes.io/name: {{ include "pomerium.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    helm.sh/chart: {{ include "pomerium.chart" . }}
{{- with .Values.ingress.annotations }}
  annotations:
{{ toYaml . | indent 4 }}
{{- end }}
spec:
  tls:
    - secretName: {{ default .Values.ingress.secretName .Values.ingress.secret.name}}
      hosts:
        - {{ printf "authorize.%s" .Values.config.rootDomain | quote }}
        - {{ printf "authenticate.%s" .Values.config.rootDomain | quote }}
        - {{ template "pomerium.forwardAuth.name" . }}
      {{- if not .Values.ingress.hosts }}
      {{- range .Values.config.policy }}
        - {{ .from | trimPrefix "https://" | trimPrefix "http://" | quote }}
      {{- end }}
      {{- end }}
      {{- range .Values.ingress.hosts }}
        - {{ . | quote }}
      {{- end }}
  rules:
    {{- range .Values.ingress.hosts }}
    - host: {{ . | quote }}
      http:
        paths:
          - paths:
            backend:
              serviceName: {{ template "pomerium.proxy.fullname" $ }}
              servicePort: https
    {{- end }}
    {{- if not (or .Values.ingress.hosts .Values.forwardAuth.enabled) }}
    {{- range .Values.config.policy }}
    - host: {{ .from | trimPrefix "https://" | trimPrefix "http://" | quote }}
      http:
        paths:
          - paths:
            backend:
              serviceName: {{ template "pomerium.proxy.fullname" $ }}
              servicePort: https
    {{- end }}
    {{- end }}
    {{- if .Values.forwardAuth.enabled }}
    - host: {{ template "pomerium.forwardAuth.name" . }}
      http:
        paths:
          - paths:
            backend:
              serviceName: {{ template "pomerium.proxy.fullname" . }}
              servicePort: https
    {{- end }}
    {{- if not .Values.service.authorize.headless }}
    - host:  {{ printf "authorize.%s" .Values.config.rootDomain }}
      http:
        paths:
          - paths:
            backend:
              serviceName: {{ template "pomerium.authorize.fullname" . }}
              servicePort: https
    {{- end }}
    - host: {{ printf "authenticate.%s" .Values.config.rootDomain }}
      http:
        paths:
          - paths:
            backend:
              serviceName: {{ template "pomerium.authenticate.fullname" . }}
              servicePort: https
{{- end }}
