apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: gotify
  namespace: notifications
  annotations:
    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
    # WebSocket support for Gotify client connections (/stream endpoint)
    # nginx-ingress handles Upgrade/Connection headers natively with http/1.1
    nginx.ingress.kubernetes.io/proxy-http-version: "1.1"
    # Single sign-on. Gotify has no OIDC, so every request is handed to
    # oauth2-proxy for an allow or deny decision. oauth2-proxy skips the token
    # API paths itself, so /message keeps Gotify's own X-Gotify-Key check.
    nginx.ingress.kubernetes.io/auth-url: "http://gotify-oauth2-proxy.notifications.svc.cluster.local:4180/oauth2/auth"
    nginx.ingress.kubernetes.io/auth-signin: "https://gotify.riotpiao.com/oauth2/start?rd=$scheme://$host$request_uri"
    nginx.ingress.kubernetes.io/auth-response-headers: "x-auth-request-user,x-auth-request-email"
spec:
  ingressClassName: nginx
  rules:
    - host: gotify.riotpiao.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: gotify
                port:
                  number: 80