apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: body-wars
  namespace: body-wars
  labels:
    app.kubernetes.io/name: body-wars
    app.kubernetes.io/part-of: mk-labs
  annotations:
    # TLS certificate from Let's Encrypt (production)
    cert-manager.io/cluster-issuer: letsencrypt-prod
    # Nginx ingress controller settings
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    # Session affinity for WebSocket support
    nginx.ingress.kubernetes.io/affinity: "cookie"
    nginx.ingress.kubernetes.io/affinity-mode: "persistent"
    # Observability header
    nginx.ingress.kubernetes.io/enable-access-log: "true"
    # Rate limiting to prevent abuse
    nginx.ingress.kubernetes.io/limit-connections: "10"
    nginx.ingress.kubernetes.io/limit-rps: "50"
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - body-wars.local.mk-labs.cloud
    secretName: body-wars-tls
    # Let's Encrypt production certificate
  rules:
  - host: body-wars.local.mk-labs.cloud
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: open-webui
            port:
              number: 80