# Apply: kubectl apply -f manifests/home-services/alert-bridge-ingress.yaml
# Delete: kubectl delete -f manifests/home-services/alert-bridge-ingress.yaml
# Description: Plain-HTTP Traefik IngressRoute for alert-bridge at
# alert-bridge.home.arpa, so a caller elsewhere on the home network (not
# inside the k8s cluster, e.g. a cronjob on another LAN host) can reach
# POST /alerts. Deliberately plain HTTP, not internal-CA TLS like
# authentik-ingress.yaml/ha.home.arpa - callers (e.g. nik-gpu) don't have this
# cluster's internal CA trusted, and the alternative (installing it via
# ca.home.arpa on every caller) was judged not worth it for a LAN-only,
# already-bearer-token-authenticated endpoint. The `/alerts` bearer token
# therefore travels in cleartext on the LAN - accepted tradeoff, not an
# oversight. Revisit (switch back to websecure + internal-ca-issuer, see git
# history for the prior version) if this ever needs to be reachable from
# somewhere less trusted than the home LAN.
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: alert-bridge
  namespace: home-services
spec:
  entryPoints:
    - web
  routes:
    - match: Host(`alert-bridge.home.arpa`)
      kind: Rule
      services:
        - name: alert-bridge
          port: 8080