infrastructure/servers/legion/ingress.tf

# Traefik ingress routes for all services — TLS via cert-manager + Cloudflare DNS-01
# Kong and open-webui ingresses moved to inactive/ — restore when needed

resource "kubernetes_ingress_v1" "ollama" {
  metadata {
    name      = "ollama"
    namespace = kubernetes_namespace.ollama.metadata[0].name
    annotations = {
      "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
      "cert-manager.io/cluster-issuer"                   = "letsencrypt-prod"
    }
  }

  spec {
    tls {
      hosts       = ["ollama.${var.infra_domain}"]
      secret_name = "ollama-tls"
    }
    rule {
      host = "ollama.${var.infra_domain}"
      http {
        path {
          path      = "/"
          path_type = "Prefix"
          backend {
            service {
              name = "ollama"
              port { number = 11434 }
            }
          }
        }
      }
    }
  }

  depends_on = [helm_release.cert_manager]
}


resource "kubernetes_ingress_v1" "registry" {
  metadata {
    name      = "registry"
    namespace = kubernetes_namespace.registry.metadata[0].name
    annotations = {
      "traefik.ingress.kubernetes.io/router.entrypoints"        = "websecure"
      "cert-manager.io/cluster-issuer"                          = "letsencrypt-prod"
      "traefik.ingress.kubernetes.io/router.middlewares"        = "registry-chunked@kubernetescrd"
      "nginx.ingress.kubernetes.io/proxy-body-size"             = "0"
      "nginx.ingress.kubernetes.io/proxy-read-timeout"          = "600"
      "nginx.ingress.kubernetes.io/proxy-send-timeout"          = "600"
    }
  }

  spec {
    tls {
      hosts       = ["registry.${var.infra_domain}"]
      secret_name = "registry-tls"
    }
    rule {
      host = "registry.${var.infra_domain}"
      http {
        path {
          path      = "/"
          path_type = "Prefix"
          backend {
            service {
              name = "registry"
              port { number = 5000 }
            }
          }
        }
      }
    }
  }

  depends_on = [helm_release.cert_manager]
}

resource "kubernetes_ingress_v1" "registry_ui" {
  metadata {
    name      = "registry-ui"
    namespace = kubernetes_namespace.registry.metadata[0].name
    annotations = {
      "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
      "cert-manager.io/cluster-issuer"                   = "letsencrypt-prod"
    }
  }

  spec {
    tls {
      hosts       = ["docker.neuralplatform.ai"]
      secret_name = "docker-ui-tls"
    }
    rule {
      host = "docker.neuralplatform.ai"
      http {
        path {
          path      = "/"
          path_type = "Prefix"
          backend {
            service {
              name = "registry-ui"
              port { number = 80 }
            }
          }
        }
      }
    }
  }

  depends_on = [helm_release.cert_manager]
}

# npm registry — Verdaccio (proxies npmjs.org, caches locally)
resource "kubernetes_ingress_v1" "npm_registry" {
  metadata {
    name      = "npm-registry"
    namespace = kubernetes_namespace.packages.metadata[0].name
    annotations = {
      "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
      "cert-manager.io/cluster-issuer"                   = "letsencrypt-prod"
    }
  }

  spec {
    tls {
      hosts       = ["npm.neuralplatform.ai"]
      secret_name = "npm-registry-tls"
    }
    rule {
      host = "npm.neuralplatform.ai"
      http {
        path {
          path      = "/"
          path_type = "Prefix"
          backend {
            service {
              name = "verdaccio"
              port { number = 4873 }
            }
          }
        }
      }
    }
  }

  depends_on = [helm_release.cert_manager]
}

# PyPI registry — devpi (proxies pypi.org, caches locally)
resource "kubernetes_ingress_v1" "pypi_registry" {
  metadata {
    name      = "pypi-registry"
    namespace = kubernetes_namespace.packages.metadata[0].name
    annotations = {
      "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
      "cert-manager.io/cluster-issuer"                   = "letsencrypt-prod"
    }
  }

  spec {
    tls {
      hosts       = ["pypi.neuralplatform.ai"]
      secret_name = "pypi-registry-tls"
    }
    rule {
      host = "pypi.neuralplatform.ai"
      http {
        path {
          path      = "/"
          path_type = "Prefix"
          backend {
            service {
              name = "devpi"
              port { number = 3141 }
            }
          }
        }
      }
    }
  }

  depends_on = [helm_release.cert_manager]
}