apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: guacamole-envoy-tls
  namespace: guacamole
spec:
  secretName: guacamole-envoy-tls
  issuerRef:
    kind: ClusterIssuer
    name: letsencrypt-production
  dnsNames:
    - guacamole.kube.huskypup.net

---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: guacamole
  namespace: guacamole
spec:
  gatewayClassName: envoy-gateway
  listeners:
    - name: https
      hostname: guacamole.kube.huskypup.net
      port: 443
      protocol: HTTPS
      tls:
        mode: Terminate
        certificateRefs:
          - group: ""
            kind: Secret
            name: guacamole-envoy-tls

---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: guacamole
  namespace: guacamole
spec:
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: guacamole
      sectionName: https
  hostnames:
    - guacamole.kube.huskypup.net
  rules:
    # Legacy path support: https://host/guacamole/* -> https://host/*
    - matches:
        - path:
            type: PathPrefix
            value: /guacamole
      filters:
        - type: URLRewrite
          urlRewrite:
            path:
              type: ReplacePrefixMatch
              replacePrefixMatch: /
      backendRefs:
        - group: ""
          kind: Service
          name: guacamole
          port: 8080
          weight: 1
    # Standard root routing
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - group: ""
          kind: Service
          name: guacamole
          port: 8080
          weight: 1

---
# Cookie-based session persistence so OIDC nonce validation works across 2 replicas.
# Without this, the OIDC callback can hit a different pod than the one that generated
# the nonce, causing "Rejected OpenID token with invalid/old nonce" errors.
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: BackendTrafficPolicy
metadata:
  name: guacamole-session-persistence
  namespace: guacamole
spec:
  targetRefs:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      name: guacamole
  loadBalancer:
    type: ConsistentHash
    consistentHash:
      type: Cookie
      cookie:
        name: GUAC_ROUTE
        ttl: 3600s