# Shorashim Services
# Operations spec §1.1: Four access tiers
#   - Pe'ah (public, no auth)
#   - Machaneh Leviyah (authenticated)
#   - Chatzer (full access)
#   - Kodesh (operator, mTLS)
#
# All tiers go through a single Service → vav-pipeline port 4000
---
apiVersion: v1
kind: Service
metadata:
  name: shorashim
  namespace: shorashim
  labels:
    app.kubernetes.io/name: shorashim
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: shorashim
  ports:
    - port: 80
      targetPort: 4000
      protocol: TCP
      name: http
---
# External access via LoadBalancer
# For Exoscale SKS, this provisions an Exoscale NLB
apiVersion: v1
kind: Service
metadata:
  name: shorashim-external
  namespace: shorashim
  labels:
    app.kubernetes.io/name: shorashim
  annotations:
    # Exoscale NLB annotations
    service.beta.kubernetes.io/exoscale-loadbalancer-zone: "ch-gva-2"
    service.beta.kubernetes.io/exoscale-loadbalancer-name: "shorashim"
spec:
  type: LoadBalancer
  selector:
    app.kubernetes.io/name: shorashim
  ports:
    - port: 80
      targetPort: 4000
      protocol: TCP
      name: http