apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: grafana-route
  namespace: victoria-metrics
spec:
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: gateway-internal
      namespace: envoy-gateway
      sectionName: grafana
    # Uncomment to expose Grafana publicly — ensure auth is properly configured first
    # - group: gateway.networking.k8s.io
    #   kind: Gateway
    #   name: gateway-public
    #   namespace: envoy-gateway
    #   sectionName: grafana
  hostnames:
    - "grafana.jsme.be"
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      filters:
        - type: RequestHeaderModifier
          requestHeaderModifier:
            set:
              - name: X-Forwarded-Host
                value: "grafana.jsme.be"
              - name: X-Forwarded-Proto
                value: https
        - type: ResponseHeaderModifier
          responseHeaderModifier:
            set:
              - name: Strict-Transport-Security
                value: "max-age=31536000; includeSubDomains"
              - name: X-Content-Type-Options
                value: nosniff
              - name: X-Frame-Options
                value: SAMEORIGIN
              - name: Referrer-Policy
                value: strict-origin-when-cross-origin
              - name: Permissions-Policy
                value: "camera=(), microphone=(), geolocation=(), payment=()"
      backendRefs:
        - name: vm-grafana
          port: 80
          kind: Service
          group: ""
          weight: 1
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: vmagent-route
  namespace: victoria-metrics
spec:
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: gateway-internal
      namespace: envoy-gateway
      sectionName: vmagent
  hostnames:
    - "vmagent.jsme.be"
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      filters:
        - type: RequestHeaderModifier
          requestHeaderModifier:
            set:
              - name: X-Forwarded-Host
                value: "vmagent.jsme.be"
              - name: X-Forwarded-Proto
                value: https
        - type: ResponseHeaderModifier
          responseHeaderModifier:
            set:
              - name: Strict-Transport-Security
                value: "max-age=31536000; includeSubDomains"
              - name: X-Content-Type-Options
                value: nosniff
              - name: X-Frame-Options
                value: SAMEORIGIN
              - name: Referrer-Policy
                value: strict-origin-when-cross-origin
              - name: Permissions-Policy
                value: "camera=(), microphone=(), geolocation=(), payment=()"
      backendRefs:
        - name: vmagent-vm-victoria-metrics-k8s-stack
          port: 8429
          kind: Service
          group: ""
          weight: 1
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: vmetrics-route
  namespace: victoria-metrics
spec:
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: gateway-internal
      namespace: envoy-gateway
      sectionName: vmetrics
  hostnames:
    - "vmetrics.jsme.be"
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      filters:
        - type: RequestHeaderModifier
          requestHeaderModifier:
            set:
              - name: X-Forwarded-Host
                value: "vmetrics.jsme.be"
              - name: X-Forwarded-Proto
                value: https
        - type: ResponseHeaderModifier
          responseHeaderModifier:
            set:
              - name: Strict-Transport-Security
                value: "max-age=31536000; includeSubDomains"
              - name: X-Content-Type-Options
                value: nosniff
              - name: X-Frame-Options
                value: SAMEORIGIN
              - name: Referrer-Policy
                value: strict-origin-when-cross-origin
              - name: Permissions-Policy
                value: "camera=(), microphone=(), geolocation=(), payment=()"
      backendRefs:
        - name: vmsingle-vm-victoria-metrics-k8s-stack
          port: 8428
          kind: Service
          group: ""
          weight: 1
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: vlogs-route
  namespace: victoria-metrics
spec:
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: gateway-internal
      namespace: envoy-gateway
      sectionName: vlogs
  hostnames:
    - "vlogs.jsme.be"
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      filters:
        - type: RequestHeaderModifier
          requestHeaderModifier:
            set:
              - name: X-Forwarded-Host
                value: "vlogs.jsme.be"
              - name: X-Forwarded-Proto
                value: https
        - type: ResponseHeaderModifier
          responseHeaderModifier:
            set:
              - name: Strict-Transport-Security
                value: "max-age=31536000; includeSubDomains"
              - name: X-Content-Type-Options
                value: nosniff
              - name: X-Frame-Options
                value: SAMEORIGIN
              - name: Referrer-Policy
                value: strict-origin-when-cross-origin
              - name: Permissions-Policy
                value: "camera=(), microphone=(), geolocation=(), payment=()"
      backendRefs:
        - name: vlsingle-victoria-logs
          port: 9428
          kind: Service
          group: ""
          weight: 1