apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: login
  namespace: login
  annotations:
    # Cloudflare tunnel: public access, bypass CF Access
    # Keycloak IS the auth provider — it must be reachable before any OIDC
    # flow can begin, so CF Access must not gate it.
    dns.public: "true"
    dns.public.access.policy: bypass
    dns.public.hostname: login.olb42.com

    # Homepage service discovery
    gethomepage.dev/enabled: "true"
    gethomepage.dev/name: "Keycloak"
    gethomepage.dev/group: "Security"
    gethomepage.dev/description: "Identity & Access Management (operator-managed)"
    gethomepage.dev/href: "https://login.olb42.com"
    gethomepage.dev/icon: "keycloak"
    gethomepage.dev/app: "keycloak"
    gethomepage.dev/namespace: "login"
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`login.olb42.com`)
      kind: Rule
      # No OIDC middleware: Keycloak is the identity provider itself.
      # Traefik passes traffic straight through to the Keycloak service.
      services:
        - name: keycloak-service
          namespace: login
          port: 8080
  tls:
    secretName: olb42-wildcard-tls