# AdGuard Home — household DNS with ad blocking and local nook.family resolution

resource "kubernetes_namespace" "dns" {
  metadata {
    name = "dns"
    labels = {
      managed-by = "terraform"
      tier       = "infrastructure"
    }
  }
}

resource "kubernetes_persistent_volume_claim" "adguard_config" {
  wait_until_bound = false
  metadata {
    name      = "adguard-config"
    namespace = kubernetes_namespace.dns.metadata[0].name
  }
  spec {
    access_modes = ["ReadWriteOnce"]
    resources {
      requests = {
        storage = "1Gi"
      }
    }
  }
}

resource "kubernetes_persistent_volume_claim" "adguard_data" {
  wait_until_bound = false
  metadata {
    name      = "adguard-data"
    namespace = kubernetes_namespace.dns.metadata[0].name
  }
  spec {
    access_modes = ["ReadWriteOnce"]
    resources {
      requests = {
        storage = "5Gi"
      }
    }
  }
}

# Deployment + Service managed by Argo CD — see servers/legion/apps/adguard.yaml

resource "kubernetes_ingress_v1" "adguard" {
  metadata {
    name      = "adguard"
    namespace = kubernetes_namespace.dns.metadata[0].name
    annotations = {
      "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
      "cert-manager.io/cluster-issuer"                   = "letsencrypt-prod"
    }
  }

  spec {
    tls {
      hosts       = ["dns.${var.domain_suffix}"]
      secret_name = "adguard-tls"
    }

    rule {
      host = "dns.${var.domain_suffix}"
      http {
        path {
          path      = "/"
          path_type = "Prefix"
          backend {
            service {
              name = "adguard-ui"
              port {
                number = 3000
              }
            }
          }
        }
      }
    }
  }

  depends_on = [helm_release.cert_manager]
}

# Host-level bootstrap notes (run bootstrap.sh once on new Legion installs):
# - systemd-resolved disabled (conflicts with AdGuard on port 53)
# - k3s config.yaml includes tls-san for LAN IP
# - /etc/resolv.conf set to 1.1.1.1 fallback
# See: servers/legion/bootstrap.sh