# Tower IngressRoute. Routes by path:
#   /api/*  → backend (8080)
#   /*      → frontend (when Step 4 builds it; currently a 503 from
#               Traefik because backend.frontend.enabled=false)
#
# Once frontend lands, we add a second route block with a Path matcher
# for the `/api` prefix going to backend, and the catch-all for static
# files going to frontend.
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: tower
  labels:
    {{- include "tower.labels" . | nindent 4 }}
spec:
  entryPoints:
    - {{ .Values.ingress.entryPoint }}
  routes:
{{- if .Values.backend.enabled }}
    - match: Host(`{{ .Values.ingress.domain }}`)
      kind: Rule
      services:
        - name: tower-backend
          port: 8080
{{- end }}
{{- if .Values.frontend.enabled }}
    # Frontend slot — enabled when Step 4 builds the UI.
    - match: Host(`{{ .Values.ingress.domain }}`) && !PathPrefix(`/api`) && !PathPrefix(`/healthz`) && !PathPrefix(`/instances`)
      kind: Rule
      priority: 100
      services:
        - name: tower-frontend
          port: 80
{{- end }}
  tls:
    secretName: tower-tls