apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: zhinian-web
  namespace: zhinian
  annotations:
    nginx.ingress.kubernetes.io/proxy-body-size: 100m
spec:
  ingressClassName: nginx
  rules:
    - host: REPLACE_WITH_PUBLIC_HOST
      http:
        paths:
          # Longest-prefix matching sends public internal-API traffic to the
          # selectorless deny Service instead of any workload.
          - path: /api/internal/worker
            pathType: Prefix
            backend:
              service:
                name: zhinian-public-deny
                port:
                  number: 80
          # Backend paths belong to the Go API workload from the first
          # production deployment.
          - path: /api
            pathType: Prefix
            backend:
              service:
                name: zhinian-go-api
                port:
                  number: 8080
          - path: /uploads
            pathType: Prefix
            backend:
              service:
                name: zhinian-go-api
                port:
                  number: 8080
          - path: /generated-results
            pathType: Prefix
            backend:
              service:
                name: zhinian-go-api
                port:
                  number: 8080
          # Pages and static assets stay with Next.js.
          - path: /
            pathType: Prefix
            backend:
              service:
                name: zhinian-web
                port:
                  number: 3000
  tls:
    - hosts:
        - REPLACE_WITH_PUBLIC_HOST
      secretName: REPLACE_WITH_TLS_SECRET