apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: savepal-backend-ingress
  namespace: savepal-production
  labels:
    app: savepal-backend
    component: ingress
    environment: production
  annotations:
    # Ingress Controller
    kubernetes.io/ingress.class: "nginx"
    
    # SSL/TLS Configuration
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    
    # Rate Limiting
    nginx.ingress.kubernetes.io/rate-limit: "100"
    nginx.ingress.kubernetes.io/rate-limit-window: "1m"
    nginx.ingress.kubernetes.io/rate-limit-connections: "10"
    
    # CORS Configuration
    nginx.ingress.kubernetes.io/enable-cors: "true"
    nginx.ingress.kubernetes.io/cors-allow-origin: "https://savepal.ai,https://app.savepal.ai,https://admin.savepal.ai"
    nginx.ingress.kubernetes.io/cors-allow-methods: "GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS"
    nginx.ingress.kubernetes.io/cors-allow-headers: "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization"
    nginx.ingress.kubernetes.io/cors-allow-credentials: "true"
    
    # Security Headers
    nginx.ingress.kubernetes.io/configuration-snippet: |
      add_header X-Frame-Options DENY always;
      add_header X-Content-Type-Options nosniff always;
      add_header X-XSS-Protection "1; mode=block" always;
      add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
      add_header Referrer-Policy "strict-origin-when-cross-origin" always;
      add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' https:; media-src 'self'; object-src 'none'; child-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';" always;
    
    # Performance & Caching
    nginx.ingress.kubernetes.io/proxy-body-size: "10m"
    nginx.ingress.kubernetes.io/proxy-connect-timeout: "5"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "60"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "60"
    nginx.ingress.kubernetes.io/proxy-buffer-size: "4k"
    nginx.ingress.kubernetes.io/proxy-buffers-number: "8"
    
    # Load Balancing
    nginx.ingress.kubernetes.io/upstream-hash-by: "$remote_addr"
    nginx.ingress.kubernetes.io/load-balance: "round_robin"
    
    # Monitoring
    nginx.ingress.kubernetes.io/enable-access-log: "true"
    nginx.ingress.kubernetes.io/access-log-path: "/var/log/nginx/savepal-access.log"
    
    # External DNS
    external-dns.alpha.kubernetes.io/hostname: "api.savepal.ai"
    external-dns.alpha.kubernetes.io/ttl: "300"

spec:
  tls:
  - hosts:
    - api.savepal.ai
    secretName: savepal-tls-secret
  rules:
  - host: api.savepal.ai
    http:
      paths:
      # Health Check Endpoint (no rate limiting)
      - path: /health
        pathType: Prefix
        backend:
          service:
            name: savepal-backend-service
            port:
              number: 4100
      
      # API Documentation
      - path: /docs
        pathType: Prefix
        backend:
          service:
            name: savepal-backend-service
            port:
              number: 4100
      
      # Authentication Endpoints (stricter rate limiting)
      - path: /api/v1/auth
        pathType: Prefix
        backend:
          service:
            name: savepal-backend-service
            port:
              number: 4100
      
      # Main API Endpoints
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: savepal-backend-service
            port:
              number: 4100
      
      # Metrics Endpoint (restricted access)
      - path: /metrics
        pathType: Prefix
        backend:
          service:
            name: savepal-backend-service
            port:
              number: 4100
      
      # Default catch-all
      - path: /
        pathType: Prefix
        backend:
          service:
            name: savepal-backend-service
            port:
              number: 4100

---
# Separate ingress for admin/monitoring interfaces
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: savepal-monitoring-ingress
  namespace: savepal-production
  labels:
    app: savepal-monitoring
    component: ingress
    environment: production
  annotations:
    kubernetes.io/ingress.class: "nginx"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    
    # Basic Authentication for monitoring endpoints
    nginx.ingress.kubernetes.io/auth-type: basic
    nginx.ingress.kubernetes.io/auth-secret: savepal-monitoring-auth
    nginx.ingress.kubernetes.io/auth-realm: "SavePal Monitoring - Authentication Required"
    
    # IP Whitelist (adjust as needed)
    nginx.ingress.kubernetes.io/whitelist-source-range: "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
    
    external-dns.alpha.kubernetes.io/hostname: "monitoring.savepal.ai"

spec:
  tls:
  - hosts:
    - monitoring.savepal.ai
    secretName: savepal-monitoring-tls-secret
  rules:
  - host: monitoring.savepal.ai
    http:
      paths:
      # Grafana Dashboard
      - path: /grafana
        pathType: Prefix
        backend:
          service:
            name: grafana-service
            port:
              number: 3000
      
      # Prometheus Metrics
      - path: /prometheus
        pathType: Prefix
        backend:
          service:
            name: prometheus-service
            port:
              number: 9090
      
      # Default redirect to Grafana
      - path: /
        pathType: Prefix
        backend:
          service:
            name: grafana-service
            port:
              number: 3000
