{{- if .Values.ingress.enabled }}
{{- /*
  The cutover serves the new production hostname alongside the rehearsal one
  from the same release, so `host` alone is not enough. `extraHosts` adds more
  names against the identical path set; with none set the render is unchanged.

  Note that cert-manager's ingress-shim derives Certificates from the `tls`
  block, not from these rules. A host listed here but absent from `tls` is
  routed over HTTP without triggering an ACME order — which is what lets a new
  hostname be wired up *before* its DNS moves, without burning Let's Encrypt
  failed-validation attempts on a challenge that cannot succeed yet.
*/}}
{{- $hosts := concat (list .Values.ingress.host) (default (list) .Values.ingress.extraHosts) }}
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: {{ include "medical-chatbot.fullname" . }}
  labels:
    {{- include "medical-chatbot.labels" . | nindent 4 }}
  annotations:
    {{- toYaml .Values.ingress.annotations | nindent 4 }}
spec:
  ingressClassName: {{ .Values.ingress.className }}
  {{- with .Values.ingress.tls }}
  tls:
    {{- toYaml . | nindent 4 }}
  {{- end }}
  rules:
    {{- range $host := $hosts }}
    - host: {{ $host | quote }}
      http:
        paths:
          - path: /v1/rag
            pathType: Prefix
            backend:
              service:
                name: {{ include "medical-chatbot.fullname" $ }}-ai-service
                port: { name: http }
          {{- if $.Values.observability.enabled }}
          - path: /grafana
            pathType: Prefix
            backend:
              service:
                name: {{ include "medical-chatbot.fullname" $ }}-grafana
                port: { name: http }
          {{- end }}
          - path: /
            pathType: Prefix
            backend:
              service:
                name: {{ include "medical-chatbot.fullname" $ }}-web
                port: { name: http }
    {{- end }}
{{- end }}