# Public exposure is required: the vote widget runs in each visitor's
# browser (client-side JS on a static Pages site), so it calls this API
# straight from the internet — it cannot reach a cluster-internal-only
# Service. CORS (ALLOWED_ORIGIN in deployment.yaml) is the real boundary:
# it restricts which origin's browser code may call the API, not which
# network can reach it.
#
# No `tls:` block here on purpose: TLS is terminated upstream by Caddy on the
# Oracle VPS, which reverse-proxies over Tailscale to this node's port 80
# (the nginx ingress runs on hostNetwork and routes by Host). That is how all
# ~21 public hosts in this account are served. Reaching this host publicly
# needs the DNS record plus the Caddy block — see vote-service/README.md:
#   cf-dns add ai-for-dummies-vote A 129.148.56.8
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ai-for-dummies-vote
  namespace: ai-for-dummies
spec:
  ingressClassName: public
  rules:
    - host: ai-for-dummies-vote.marcospaulo.dev.br
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: ai-for-dummies-vote
                port:
                  number: 80