##############################################################################
# M3 Coordinator IngressRoute
# Traefik handles TLS termination + basic auth
# External: https://m3db.vultrlabs.dev → Traefik → m3coordinator:7201
##############################################################################

---
# HTTP redirect to HTTPS
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: m3coordinator-redirect
  namespace: m3db
spec:
  entryPoints:
    - web
  routes:
    - match: Host(`m3db.vultrlabs.dev`)
      kind: Rule
      middlewares:
        - name: redirect-https
          namespace: m3db
      services:
        - name: m3coordinator
          port: 7201

---
# HTTPS with basic auth
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: m3coordinator
  namespace: m3db
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`m3db.vultrlabs.dev`)
      kind: Rule
      middlewares:
        - name: basic-auth
          namespace: m3db
      services:
        - name: m3coordinator
          port: 7201
  tls:
    certResolver: letsencrypt

---
# HTTPS redirect middleware
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: redirect-https
  namespace: m3db
spec:
  redirectScheme:
    scheme: https
    permanent: true