{{- if .Values.ingress.enabled }}
{{- if not .Values.ingress.host }}
{{- fail "ingress.enabled is true but ingress.host is empty — set the hostname in your service's values.yaml" }}
{{- end }}
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: {{ include "app.name" . }}
  labels:
    {{- include "app.labels" . | nindent 4 }}
  {{- if .Values.ingress.tls }}
  annotations:
    # Phase 1: cert-manager issues the cert. Phase 2: external-dns reads the
    # host below and creates the DNS record. When tls is false (a secondary
    # path on a shared host), this Ingress owns neither — it just adds a route.
    cert-manager.io/cluster-issuer: {{ .Values.ingress.clusterIssuer }}
  {{- end }}
spec:
  ingressClassName: {{ .Values.ingress.className }}
  {{- if .Values.ingress.tls }}
  tls:
    - hosts:
        - {{ .Values.ingress.host }}
      secretName: {{ .Values.ingress.tlsSecretName | default (printf "%s-tls" (include "app.name" .)) }}
  {{- end }}
  rules:
    - host: {{ .Values.ingress.host }}
      http:
        paths:
          - path: {{ .Values.ingress.path }}
            pathType: Prefix
            backend:
              service:
                name: {{ include "app.name" . }}
                port:
                  number: {{ .Values.service.port }}
{{- end }}