# Shorashim Services
# Operations spec §1.1: Four access tiers
#   - Pe'ah (public, no auth)
#   - Machaneh Leviyah (authenticated)
#   - Chatzer (full access)
#   - Kodesh (operator, mTLS)
#
# All tiers go through a single Service → vav-pipeline port 4000
---
apiVersion: v1
kind: Service
metadata:
  name: shorashim
  namespace: shorashim
  labels:
    app.kubernetes.io/name: shorashim
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: shorashim
  ports:
    - port: 80
      targetPort: 4000
      protocol: TCP
      name: http
---
# External access via LoadBalancer
# For Exoscale SKS, this provisions an Exoscale NLB.
#
# The NLB forwards to this Service's NodePort and TCP-healthchecks it on
# the node. The cloud controller does NOT open that port in the node's
# security group — the operator must, or the NLB IP refuses connections
# while the pod is Ready (2026-10-04, tablet 29):
#   PORT=$(kubectl -n shorashim get svc shorashim-external -o jsonpath='{.spec.ports[0].nodePort}')
#   exo compute security-group rule add default --flow ingress --protocol tcp --port $PORT --network 0.0.0.0/0
apiVersion: v1
kind: Service
metadata:
  name: shorashim-external
  namespace: shorashim
  labels:
    app.kubernetes.io/name: shorashim
  annotations:
    # Exoscale NLB annotations
    service.beta.kubernetes.io/exoscale-loadbalancer-zone: "ch-gva-2"
    service.beta.kubernetes.io/exoscale-loadbalancer-name: "shorashim"
spec:
  type: LoadBalancer
  selector:
    app.kubernetes.io/name: shorashim
  ports:
    - port: 80
      targetPort: 4000
      protocol: TCP
      name: http