{{- if .Values.server.enabled }}
{{- $servicePort := ternary .Values.server.service.servicePortHttps .Values.server.service.servicePortHttp .Values.server.ingress.https -}}
{{- range $name, $route := .Values.server.route }}
{{- if $route.enabled }}
apiVersion: {{ $route.apiVersion | default "gateway.networking.k8s.io/v1" }}
kind: {{ $route.kind | default "HTTPRoute" }}
metadata:
  name: {{ include "authentik.server.fullname" $ }}{{ if ne $name "main" }}-{{ $name }}{{ end }}
  namespace: {{ include "authentik.namespace" $ | quote }}
  labels:
    {{- include "authentik.labels" (dict "context" $ "component" $.Values.server.name) | nindent 4 }}
    {{- with $route.labels }}
      {{- toYaml . | nindent 4 }}
    {{- end }}
  {{- with $route.annotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
spec:
  {{- with $route.parentRefs }}
  parentRefs:
    {{- toYaml . | nindent 4 }}
  {{- end }}
  {{- with $route.hostnames }}
  hostnames:
    {{- tpl (toYaml .) $ | nindent 4 }}
  {{- end }}
  rules:
    {{- if $route.additionalRules }}
    {{- tpl (toYaml $route.additionalRules) $ | nindent 4 }}
    {{- end }}
    {{- if $route.httpsRedirect }}
    - filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            statusCode: 301
    {{- else }}
    - backendRefs:
        - name: {{ include "authentik.server.fullname" $ }}
          port: {{ $servicePort }}
      {{- with $route.filters }}
      filters:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with $route.matches }}
      matches:
        {{- tpl (toYaml .) $ | nindent 8 }}
      {{- end }}
    {{- end }}
{{- end }}
{{- end }}
{{- end }}