# Gitea behind the shared ingress — TCP passthrough
#
# One NLB for the cluster (185.19.28.170, the ingress-nginx Service)
# instead of one per Service. Bikoret is an HTTP Ingress
# (service.yaml). Gitea has no hostname that resolves
# (gitea.temple-council.ch is configured in Gitea and exists nowhere),
# and host-based routing needs a name — so Gitea rides the ingress
# controller's TCP passthrough on two ports of the same NLB:
#
#   185.19.28.170:3000  →  temple-council/gitea:80   (HTTP — git, web UI)
#   185.19.28.170:22    →  temple-council/gitea:22   (SSH)
#
# Three live objects carry this; only the first is a whole manifest:
#
# 1. This ConfigMap.
# 2. The controller reads it — one argument on the Deployment:
#      kubectl -n ingress-nginx patch deploy ingress-nginx-controller --type=json -p \
#        '[{"op":"add","path":"/spec/template/spec/containers/0/args/-",
#           "value":"--tcp-services-configmap=$(POD_NAMESPACE)/tcp-services"}]'
# 3. The controller's Service exposes the two ports ON THE NODEPORTS THE
#    SECURITY GROUP ALREADY ALLOWS (they were Gitea's own; the CCM never
#    opens a NodePort — tablets 29, 46):
#      kubectl -n ingress-nginx patch svc ingress-nginx-controller --type=json -p \
#        '[{"op":"add","path":"/spec/ports/-","value":{"name":"gitea-http","port":3000,"targetPort":3000,"protocol":"TCP","nodePort":30575}},
#          {"op":"add","path":"/spec/ports/-","value":{"name":"gitea-ssh","port":22,"targetPort":22,"protocol":"TCP","nodePort":31345}}]'
#    and temple-council/gitea is type ClusterIP (it held 30575/31345 as a
#    LoadBalancer until 2026-10-06).
#
# When Gitea has a real name: add an HTTP Ingress for it (TLS via
# cert-manager) and drop the 3000 line here; SSH stays.
apiVersion: v1
kind: ConfigMap
metadata:
  name: tcp-services
  namespace: ingress-nginx
data:
  "3000": "temple-council/gitea:80"
  "22": "temple-council/gitea:22"