{{- /*
LibreChat ingress with cert-manager TLS.

Hosted at .Values.ingress.host (operator-supplied — typically
chat-app.<sovereign-fqdn>). cert-manager issues the TLS certificate
via the named ClusterIssuer; the host MUST be operator-set, never
defaulted, per docs/INVIOLABLE-PRINCIPLES.md #4.
*/}}
{{- if and .Values.librechat.enabled .Values.ingress.enabled -}}
{{- if not .Values.ingress.host }}
{{- fail "values.ingress.host is required (e.g. chat-app.<sovereign-fqdn>) — see docs/INVIOLABLE-PRINCIPLES.md #4" }}
{{- end }}
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: {{ include "bp-librechat.fullname" . }}
  labels:
    {{- include "bp-librechat.labels" . | nindent 4 }}
  annotations:
    {{- if .Values.ingress.tls.enabled }}
    cert-manager.io/cluster-issuer: {{ .Values.ingress.tls.issuer | quote }}
    {{- end }}
    {{- with .Values.ingress.annotations }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
spec:
  ingressClassName: {{ .Values.ingress.className | quote }}
  {{- if .Values.ingress.tls.enabled }}
  tls:
    - hosts:
        - {{ .Values.ingress.host | quote }}
      secretName: {{ .Values.ingress.tls.secretName | quote }}
  {{- end }}
  rules:
    - host: {{ .Values.ingress.host | quote }}
      http:
        paths:
          - path: {{ .Values.ingress.path | quote }}
            pathType: {{ .Values.ingress.pathType }}
            backend:
              service:
                name: {{ include "bp-librechat.fullname" . }}
                port:
                  number: {{ .Values.service.port }}
{{- end }}
