# Read-only package registry paths on coulombcore Gitea.
# Allows GET/HEAD/OPTIONS (pull/index); blocks POST/PUT/PATCH/DELETE at the edge.
# Apply together with tools/gitea-disable-package-push.sh (patches main Ingress).
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: gitea-packages-readonly
  namespace: default
  labels:
    app.kubernetes.io/name: gitea
    app.kubernetes.io/instance: gitea
    app.kubernetes.io/part-of: railiance-forge
    railiance/component: gitea-package-readonly
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`gitea.coulomb.social`) && (PathPrefix(`/v2`) || PathPrefix(`/api/packages`)) && (Method(`GET`) || Method(`HEAD`) || Method(`OPTIONS`))
      kind: Rule
      services:
        - name: gitea-http
          port: 3000
  tls:
    secretName: gitea-tls