Step 4: enable frontend + path-based routing + tower:0.2.0

templates/ingressroute.yaml

@@ -1,11 +1,13 @@
-# Tower IngressRoute. Routes by path:
-#   /api/*  → backend (8080)
-#   /*      → frontend (when Step 4 builds it; currently a 503 from
-#               Traefik because backend.frontend.enabled=false)
+# Tower IngressRoute — path-based split between API and UI on the
+# same hostname.
 #
-# Once frontend lands, we add a second route block with a Path matcher
-# for the `/api` prefix going to backend, and the catch-all for static
-# files going to frontend.
+# Routing rules (Traefik picks longest-match-with-priority):
+#   - API endpoints (/healthz, /instances, future /api/*) → backend
+#   - everything else → frontend (Vue SPA)
+#
+# Priority is set explicitly so Traefik doesn't fall back to its
+# heuristic; the API rule outranks the catchall, which outranks no
+# rule at all.
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -17,15 +19,15 @@ spec:
     - {{ .Values.ingress.entryPoint }}
   routes:
 {{- if .Values.backend.enabled }}
-    - match: Host(`{{ .Values.ingress.domain }}`)
+    - match: Host(`{{ .Values.ingress.domain }}`) && (PathPrefix(`/healthz`) || PathPrefix(`/instances`) || PathPrefix(`/api`))
       kind: Rule
+      priority: 200
       services:
         - name: tower-backend
           port: 8080
 {{- end }}
 {{- if .Values.frontend.enabled }}
-    # Frontend slot — enabled when Step 4 builds the UI.
-    - match: Host(`{{ .Values.ingress.domain }}`) && !PathPrefix(`/api`) && !PathPrefix(`/healthz`) && !PathPrefix(`/instances`)
+    - match: Host(`{{ .Values.ingress.domain }}`)
       kind: Rule
       priority: 100
       services: