apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: xui-local
  namespace: xui
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`xui.workstation.internal`) || Host(`xui.gigaforust.internal`)
      kind: Rule
      services:
        - name: xui-service
          port: 30379
---
# Public panel access (optional).
# Realistic, but intentionally disabled: the panel has its own login,
# security-chain adds Authentik in front of it.
# To enable: uncomment and add Public Hostname `xui.forust.xyz`
# in the Cloudflare tunnel (same as other *.forust.xyz hosts).
# ---
# apiVersion: traefik.io/v1alpha1
# kind: IngressRoute
# metadata:
#   name: xui-prod
#   namespace: xui
# spec:
#   entryPoints:
#     - websecure
#   routes:
#     - match: Host(`xui.forust.xyz`)
#       kind: Rule
#       middlewares:
#         - name: security-chain@file
#       services:
#         - name: xui-service
#           port: 30379
#   tls:
#     certResolver: letsencrypt
---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: xray-prod
  namespace: xui
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`xray.forust.xyz`) && PathPrefix(`/pzzfpz6oi281f0u8`)
      kind: Rule
      services:
        - name: xui-service
          port: 2096
    - match: Host(`xray.forust.xyz`)
      kind: Rule
      services:
        - name: xui-service
          port: 10000
  tls:
    secretName: xray-prod-tls
---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: xray-local
  namespace: xui
spec:
  entryPoints:
    - websecure
  routes:
    - match: (Host(`xray.workstation.internal`) || Host(`xray.gigaforust.internal`)) && PathPrefix(`/pzzfpz6oi281f0u8`)
      kind: Rule
      services:
        - name: xui-service
          port: 2096
    - match: Host(`xray.workstation.internal`) || Host(`xray.gigaforust.internal`)
      kind: Rule
      services:
        - name: xui-service
          port: 10000