apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: radarr-route
  namespace: arrstack
  # NOTE: original ingress had VPN IP whitelist (whitelist-source-range)
  # Gateway API has no direct equivalent — handle with NetworkPolicy if needed
spec:
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: gateway-internal
      namespace: envoy-gateway
      sectionName: radarr
  hostnames:
    - "radarr.jsme.be"
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      filters:
        - type: RequestHeaderModifier
          requestHeaderModifier:
            set:
              - name: X-Forwarded-Host
                value: "radarr.jsme.be"
              - name: X-Forwarded-Proto
                value: https
        - type: ResponseHeaderModifier
          responseHeaderModifier:
            set:
              - name: Strict-Transport-Security
                value: "max-age=31536000; includeSubDomains"
              - name: X-Content-Type-Options
                value: nosniff
              - name: X-Frame-Options
                value: SAMEORIGIN
              - name: Referrer-Policy
                value: strict-origin-when-cross-origin
              - name: Permissions-Policy
                value: "camera=(), microphone=(), geolocation=(), payment=()"
      backendRefs:
        - name: radarr
          port: 7878
          kind: Service
          group: ""
          weight: 1