apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: istio-config
  namespace: default
spec:
  interval: 5m
  timeout: 10m
  values:
    global:
      env: contour
    environments:
      contour:
        namespaces:
          - name: attachments
        certManager:
          certificates:
            platform-tls:
              dnsNames:
                - sarex.contour.infra.sarex.tech
              issuerRef:
                name: letsencrypt-issuer-istio
                kind: ClusterIssuer
            minio-tls:
              dnsNames:
                - minio.contour.infra.sarex.tech
              issuerRef:
                name: letsencrypt-issuer-istio
                kind: ClusterIssuer
            zitadel-tls:
              dnsNames:
                - zitadel.contour.infra.sarex.tech
              issuerRef:
                name: letsencrypt-issuer-istio
                kind: ClusterIssuer
            dashboard-tls:
              dnsNames:
                - dashboard.contour.infra.sarex.tech
              issuerRef:
                name: letsencrypt-issuer-istio
                kind: ClusterIssuer
            rabbitmq-tls:
              dnsNames:
                - rabbitmq.contour.infra.sarex.tech
              issuerRef:
                name: letsencrypt-issuer-istio
                kind: ClusterIssuer
            keycloak-tls:
              dnsNames:
                - keycloak.contour.infra.sarex.tech
              issuerRef:
                name: letsencrypt-issuer-istio
                kind: ClusterIssuer
            glitchtip-tls:
              dnsNames:
                - glitchtip.contour.infra.sarex.tech
              issuerRef:
                name: letsencrypt-issuer-istio
                kind: ClusterIssuer
            openobserve-tls:
              dnsNames:
                - openobserve.contour.infra.sarex.tech
              issuerRef:
                name: letsencrypt-issuer-istio
                kind: ClusterIssuer
            camunda-keycloak-tls:
              dnsNames:
                - camunda-keycloak.contour.infra.sarex.tech
              issuerRef:
                name: letsencrypt-issuer-istio
                kind: ClusterIssuer
            camunda-identity-tls:
              dnsNames:
                - camunda-identity.contour.infra.sarex.tech
              issuerRef:
                name: letsencrypt-issuer-istio
                kind: ClusterIssuer
            camunda-operate-tls:
              dnsNames:
                - camunda-operate.contour.infra.sarex.tech
              issuerRef:
                name: letsencrypt-issuer-istio
                kind: ClusterIssuer
            camunda-tasklist-tls:
              dnsNames:
                - camunda-tasklist.contour.infra.sarex.tech
              issuerRef:
                name: letsencrypt-issuer-istio
                kind: ClusterIssuer
            camunda-optimize-tls:
              dnsNames:
                - camunda-optimize.contour.infra.sarex.tech
              issuerRef:
                name: letsencrypt-issuer-istio
                kind: ClusterIssuer
            vault-tls:
              dnsNames:
                - vault.contour.infra.sarex.tech
              issuerRef:
                name: letsencrypt-issuer-istio
                kind: ClusterIssuer    
        istio:
          requestAuthentications:
            api-jwt:
              namespace: istio-system
              selector:
                matchLabels:
                  istio: ingressgateway
              jwtRules:
                - issuer: django
                  jwks: |
                    {
                      "keys": [{
                        "kty": "RSA",
                        "kid": "tiSFtZhCeHtAmHjjY3cG55ZYRgpTnIbAdmX1DsD8GOk=",
                        "use": "sig",
                        "alg": "RS512",
                        "n": "iJxequyGx7cS2MKqYBlyFXsrN5mhvKKyMeYFYW2XbvCiVRXVs0OK7gwvmhMRR-spCTxJLrG2rxzvs0CBXEFIrvmVRpXSLAau_aRAoTxmfCTqsZWb9ZT7u2i3_itUgFZmQg9UsuKoSodLJ16mf29XLE6VRqlu9oIxTB61FN5WtJ8ML7-lS00UBNYbemD8iVVFTHdn_v-uJ9blhg-2l-SPaJmwFlYlr8Zll99NXhw0-SNRzYTKJ04B1SIlebkuyTpvKbeGwnA6sPainH26MQ88DJIueRpJy_zgDWYoQBO7JAxbxJnF5A5RWeWDqodZU0FPkuNyQM8RI20j83GPI-X4FvTJNXKoBVgWNpq0yvxbwcFo0GdXDkXu8FPxBjCmh0yQnz-C_3SWcQ6gM1e9ryypoi4IJzR9KIlo7c39VTK4K70lx6piEtR_Cl3LldnHVhztAPEQr58e9cIrStax3EzwMijS6eFPf21vZNIpgs96XoZGBXvbtRJJx8uqbYSjO4uofgJWkIrjleO-ygD1MpTe7Opr_5h7-DfywrgBNbstskCecSbEgCv0Hblx55JCZcb_lL6hT5cJRXOybFEmIGRpGZTR-eUELrI1cqP62Tf3qvUyNeOPi9WE2lDCJtsF1gya64xWTi1nxSXdCJEZGjKyGFHg_Majf2RzyzsYuX90P5c",
                        "e": "AQAB"
                      }]
                    }
                  forwardOriginalToken: true
                  outputClaims:
                    user_id: x-user-id
                    company_ids: x-company-ids
            zitadel-jwks:
              namespace: istio-system
              selector:
                matchLabels:
                  istio: ingressgateway
              jwtRules:
                - issuer: https://zitadel.contour.infra.sarex.tech
                  jwksUri: https://zitadel.contour.infra.sarex.tech/oauth/v2/keys
                  forwardOriginalToken: true
                  fromHeaders:
                    - name: Identity
                      prefix: "Bearer "
                    - name: Authorization
                      prefix: "Bearer "
                  outputClaims:
                    company_ids: x-company-ids
                    sub: x-user-id
          add-traceparent-filter:
            - attachments
            - bim
            - cde
            - checklists
            - comparisons
            - contracts
            - control-interface
            - cross-section
            - django
            - documentations
            - drawings
            - eav
            - faas
            - flows
            - gateway
            - inspections
            - issues
            - mapper
            - measurements
            - message-hub
            - notes
            - pm
            - prescriptions
            - processing
            - projects
            - remarks
            - resources
            - reviews
            - rfi
            - stamp-verification
            - subscriptions
            - system-log
            - transmittal
            - workspaces
          envoyFilters:
            http-header-count-size-control:
              namespace: istio-system
              workloadSelector:
                labels:
                  istio: ingressgateway
              configPatches:
                - applyTo: NETWORK_FILTER
                  match:
                    listener:
                      filterChain:
                        filter:
                          name: envoy.filters.network.http_connection_manager
                  patch:
                    operation: MERGE
                    value:
                      typed_config:
                        '@type': >-
                          type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
                        common_http_protocol_options:
                          max_headers_count: 200
                        max_request_headers_kb: 96
            header-size-sidecar:
              namespace: istio-system
              workloadSelector:
                labels:
                  istio: ingressgateway
              configPatches:
                - applyTo: NETWORK_FILTER
                  match:
                    context: SIDECAR_INBOUND
                    listener:
                      filterChain:
                        filter:
                          name: envoy.filters.network.http_connection_manager
                  patch:
                    operation: MERGE
                    value:
                      typed_config:
                        '@type': >-
                          type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
                        common_http_protocol_options:
                          max_headers_kb: 96
                        max_request_headers_kb: 96
                - applyTo: NETWORK_FILTER
                  match:
                    context: SIDECAR_OUTBOUND
                    listener:
                      filterChain:
                        filter:
                          name: envoy.filters.network.http_connection_manager
                  patch:
                    operation: MERGE
                    value:
                      typed_config:
                        '@type': >-
                          type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
                        common_http_protocol_options:
                          max_headers_kb: 96
                        max_request_headers_kb: 96
            sarex-agents-upload-body-50mb:
              namespace: istio-system
              workloadSelector:
                labels:
                  istio: ingressgateway
              configPatches:
                - applyTo: HTTP_FILTER
                  match:
                    context: GATEWAY
                    listener:
                      filterChain:
                        sni: sarex.contour.infra.sarex.tech
                        filter:
                          name: envoy.filters.network.http_connection_manager
                          subFilter:
                            name: envoy.filters.http.router
                  patch:
                    operation: INSERT_BEFORE
                    value:
                      name: envoy.filters.http.buffer
                      typed_config:
                        "@type": type.googleapis.com/envoy.extensions.filters.http.buffer.v3.Buffer
                        max_request_bytes: 2147483648
            x-robots-tag-noindex:
              namespace: istio-system
              workloadSelector:
                labels:
                  istio: ingressgateway
              configPatches:
                - applyTo: VIRTUAL_HOST
                  match:
                    context: GATEWAY
                    routeConfiguration:
                      vhost:
                        name: sarex.contour.infra.sarex.tech:443
                  patch:
                    operation: MERGE
                    value:
                      response_headers_to_add:
                        - append: false
                          header:
                            key: X-Robots-Tag
                            value: noindex, nofollow
                - applyTo: VIRTUAL_HOST
                  match:
                    context: GATEWAY
                    routeConfiguration:
                      vhost:
                        name: dashboard.contour.infra.sarex.tech:443
                  patch:
                    operation: MERGE
                    value:
                      response_headers_to_add:
                        - append: false
                          header:
                            key: X-Robots-Tag
                            value: noindex, nofollow
                - applyTo: VIRTUAL_HOST
                  match:
                    context: GATEWAY
                    routeConfiguration:
                      vhost:
                        name: sarex.contour.infra.sarex.tech:80
                  patch:
                    operation: MERGE
                    value:
                      response_headers_to_add:
                        - append: false
                          header:
                            key: X-Robots-Tag
                            value: noindex, nofollow
                - applyTo: VIRTUAL_HOST
                  match:
                    context: GATEWAY
                    routeConfiguration:
                      vhost:
                        name: dashboard.contour.infra.sarex.tech:80
                  patch:
                    operation: MERGE
                    value:
                      response_headers_to_add:
                        - append: false
                          header:
                            key: X-Robots-Tag
                            value: noindex, nofollow
            strip-jwt-on-public-hosts:
              namespace: istio-system
              workloadSelector:
                labels:
                  istio: ingressgateway
              configPatches:
                - applyTo: HTTP_FILTER
                  match:
                    context: GATEWAY
                    listener:
                      filterChain:
                        filter:
                          name: envoy.filters.network.http_connection_manager
                          subFilter:
                            name: envoy.filters.http.jwt_authn
                  patch:
                    operation: INSERT_BEFORE
                    value:
                      name: envoy.filters.http.lua
                      typed_config:
                        '@type': type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
                        inlineCode: |
                          local public_hosts = {
                            ["camunda-keycloak.contour.infra.sarex.tech"] = true,
                            ["keycloak.contour.infra.sarex.tech"] = true,
                            ["zitadel.contour.infra.sarex.tech"] = true,
                            ["dashboard.contour.infra.sarex.tech"] = true,
                            ["openobserve.contour.infra.sarex.tech"] = true,
                          }

                          local public_paths = {
                            "^/documentations/api/v1/public/qr",
                            "^/documentations/api/v1/public/documents/public_link",
                          }

                          local function is_public(host, path)
                            if not host then return false end
                            host = string.gsub(host, ":%d+$", "")
                            if public_hosts[host] then
                              return true
                            end
                            if path then
                              for _,pref in ipairs(public_paths) do
                                if string.find(path, pref) == 1 then
                                  return true
                                end
                              end
                            end
                            return false
                          end

                          function envoy_on_request(handle)
                            local h    = handle:headers()
                            local host = h:get(":authority")
                            local path = h:get(":path")
                            if is_public(host, path) then
                              local auth = h:get("authorization")
                              if auth then
                                h:replace("x-orig-authorization", auth)
                                h:remove("authorization")
                              end
                            end
                          end
                - applyTo: HTTP_FILTER
                  match:
                    context: GATEWAY
                    listener:
                      filterChain:
                        filter:
                          name: envoy.filters.network.http_connection_manager
                          subFilter:
                            name: envoy.filters.http.jwt_authn
                  patch:
                    operation: INSERT_AFTER
                    value:
                      name: envoy.filters.http.lua
                      typed_config:
                        '@type': type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
                        inlineCode: |
                          function envoy_on_request(handle)
                            local h     = handle:headers()
                            local xauth = h:get("x-orig-authorization")
                            if xauth and not h:get("authorization") then
                              h:replace("authorization", xauth)
                              h:remove("x-orig-authorization")
                            end
                          end
            strip-jwt-on-public-paths:
              namespace: istio-system
              workloadSelector:
                labels:
                  istio: ingressgateway
              configPatches:
                - applyTo: HTTP_FILTER
                  match:
                    context: GATEWAY
                    listener:
                      filterChain:
                        filter:
                          name: envoy.filters.network.http_connection_manager
                          subFilter:
                            name: envoy.filters.http.jwt_authn
                  patch:
                    operation: INSERT_BEFORE
                    value:
                      name: envoy.filters.http.lua
                      typed_config:
                        '@type': type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
                        inlineCode: |
                          local public_prefixes = {
                            "^/documentations/api/v1/public/qr",
                            "^/documentations/api/v1/public/documents/public_link"
                          }

                          local download_prefixes = {
                            "^/files/api/v1/documents/folders",
                            "^/files/api/v1/documents",
                            "^/files/api/v1/bundles"
                          }

                          local function starts_with_any(path, prefixes)
                            for _, pref in ipairs(prefixes) do
                              if string.find(path, pref) == 1 then
                                return true
                              end
                            end
                            return false
                          end

                          local function has_download_type(path)
                            if not path or path == "" then
                              return false
                            end
                            return string.match(path, "[%?&]download_type=") ~= nil
                          end

                          local function should_strip(path)
                            if not path then
                              return false
                            end

                            if starts_with_any(path, public_prefixes) then
                              return true
                            end

                            if starts_with_any(path, download_prefixes) and has_download_type(path) then
                              return true
                            end

                            return false
                          end

                          function envoy_on_request(handle)
                            local h = handle:headers()
                            local p = h:get(":path") or ""

                            if should_strip(p) then
                              local auth = h:get("authorization")
                              if auth then
                                h:replace("x-orig-authorization-public-paths", auth)
                                h:remove("authorization")
                              end

                              local identity = h:get("identity")
                              if identity then
                                h:replace("x-orig-identity-public-paths", identity)
                                h:remove("identity")
                              end

                              h:replace("x-jwt-stripped-public-paths", "1")
                            end
                          end
                - applyTo: HTTP_FILTER
                  match:
                    context: GATEWAY
                    listener:
                      filterChain:
                        filter:
                          name: envoy.filters.network.http_connection_manager
                          subFilter:
                            name: envoy.filters.http.jwt_authn
                  patch:
                    operation: INSERT_AFTER
                    value:
                      name: envoy.filters.http.lua
                      typed_config:
                        '@type': type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
                        inlineCode: |
                          function envoy_on_request(handle)
                            local h = handle:headers()
                            local stripped = h:get("x-jwt-stripped-public-paths")

                            if stripped == "1" then
                              local xauth = h:get("x-orig-authorization-public-paths")
                              if xauth and not h:get("authorization") then
                                h:replace("authorization", xauth)
                              end
                              h:remove("x-orig-authorization-public-paths")

                              local xidentity = h:get("x-orig-identity-public-paths")
                              if xidentity and not h:get("identity") then
                                h:replace("identity", xidentity)
                              end
                              h:remove("x-orig-identity-public-paths")

                              h:remove("x-jwt-stripped-public-paths")
                            end
                          end
            cors-json-401:
              namespace: istio-system
              workloadSelector:
                labels:
                  istio: ingressgateway
              configPatches:
                - applyTo: HTTP_FILTER
                  match:
                    context: GATEWAY
                    listener:
                      filterChain:
                        filter:
                          name: envoy.filters.http.jwt_authn
                  patch:
                    operation: INSERT_BEFORE
                    value:
                      name: envoy.filters.http.cors
                      typed_config:
                        '@type': type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors
                        cors:
                          allow_credentials: true
                          allow_headers: "Authorization,Content-Type"
                          allow_methods: "GET,POST,PUT,PATCH,DELETE,OPTIONS"
                          allow_origin_string_match:
                            - safe_regex:
                                regex: https://.*\.sarex\.io
                            - safe_regex:
                                regex: https://.*\.contour\.infra\.sarex\.tech
                            - safe_regex:
                                regex: https://localhost:.*
                          max_age: "86400"
                - applyTo: NETWORK_FILTER
                  match:
                    context: GATEWAY
                    listener:
                      filterChain:
                        filter:
                          name: envoy.filters.network.http_connection_manager
                  patch:
                    operation: MERGE
                    value:
                      typed_config:
                        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
                        local_reply_config:
                          mappers:
                            - body:
                                inline_string: |
                                  {"error":"unauthorized","detail":"Invalid or expired token"}
                              filter:
                                status_code_filter:
                                  comparison:
                                    op: EQ
                                    value:
                                      default_value: 401
                                      runtime_key: default
                              headers_to_add:
                                - append_action: OVERWRITE_IF_EXISTS_OR_ADD
                                  header:
                                    key: Content-Type
                                    value: application/json
                                - append_action: OVERWRITE_IF_EXISTS_OR_ADD
                                  header:
                                    key: Access-Control-Allow-Origin
                                    value: '%REQ(Origin)%'
                                - append_action: OVERWRITE_IF_EXISTS_OR_ADD
                                  header:
                                    key: Access-Control-Allow-Credentials
                                    value: 'true'
          gateways:
            platform:
              name: platform-gateway
              namespace: gateway
              servers:
                - hosts:
                    - sarex.contour.infra.sarex.tech
                  tls:
                    credentialName: platform-tls
            minio:
              name: minio-gateway
              namespace: gateway
              servers:
                - hosts:
                    - minio.contour.infra.sarex.tech
                  tls:
                    credentialName: minio-tls
            zitadel:
              name: zitadel-gateway
              namespace: gateway
              servers:
                - hosts:
                    - zitadel.contour.infra.sarex.tech
                  tls:
                    credentialName: zitadel-tls
            dashboard:
              name: dashboard-gateway
              namespace: gateway
              servers:
                - hosts:
                    - dashboard.contour.infra.sarex.tech
                  tls:
                    credentialName: dashboard-tls
            rabbitmq:
              name: rabbitmq-gateway
              namespace: gateway
              servers:
                - hosts:
                    - rabbitmq.contour.infra.sarex.tech
                  tls:
                    credentialName: rabbitmq-tls
            keycloak:
              name: keycloak-gateway
              namespace: gateway
              servers:
                - hosts:
                    - keycloak.contour.infra.sarex.tech
                  tls:
                    credentialName: keycloak-tls
            glitchtip:
              name: glitchtip-gateway
              namespace: gateway
              servers:
                - hosts:
                    - glitchtip.contour.infra.sarex.tech
                  tls:
                    credentialName: glitchtip-tls
            openobserve:
              name: openobserve-gateway
              namespace: gateway
              servers:
                - hosts:
                    - openobserve.contour.infra.sarex.tech
                  tls:
                    credentialName: openobserve-tls
            vault:
              name: vault-gateway
              namespace: gateway
              servers:
                - hosts:
                    - vault.contour.infra.sarex.tech
                  tls:
                    credentialName: vault-tls        
            camunda:
              name: camunda-gateway
              namespace: gateway
              servers:
                - hosts:
                    - camunda-keycloak.contour.infra.sarex.tech
                  tls:
                    credentialName: camunda-keycloak-tls
                - hosts:
                    - camunda-identity.contour.infra.sarex.tech
                  tls:
                    credentialName: camunda-identity-tls
                - hosts:
                    - camunda-operate.contour.infra.sarex.tech
                  tls:
                    credentialName: camunda-operate-tls
                - hosts:
                    - camunda-tasklist.contour.infra.sarex.tech
                  tls:
                    credentialName: camunda-tasklist-tls
                - hosts:
                    - camunda-optimize.contour.infra.sarex.tech
                  tls:
                    credentialName: camunda-optimize-tls
          virtualServices:
            platform:
              name: sarex-frontend-virt-service
              namespace: gateway
              hosts:
                - sarex.contour.infra.sarex.tech
              gateways:
                - gateway/platform-gateway
              routes:
                - path:
                    prefix: /admin/
                  service: backend-svc.django.svc.cluster.local
                  port: 80

                - path:
                    prefix: /api/
                  service: backend-svc.django.svc.cluster.local
                  port: 80

                - path:
                    prefix: /
                  service: frontend-svc.django.svc.cluster.local
                  port: 80
            gateway-platform:
              name: pdm-virt-service
              namespace: gateway
              hosts:
                - sarex.contour.infra.sarex.tech
              gateways:
                - gateway/platform-gateway
              routes:
                - path:
                    prefix: /gateway/
                  rewrite: /
                  service: pdm-svc.documentations.svc.cluster.local
                  port: 80
            resources-admin:
              name: resources-admin-virt-service
              namespace: gateway
              hosts:
                - sarex.contour.infra.sarex.tech
              gateways:
                - gateway/platform-gateway
              routes:
                - path:
                    prefix: /resource-management
                  rewrite: /resource-management
                  service: backend-svc.resources.svc.cluster.local
                  port: 80
            srx-admin-frontend:
              name: srx-admin-frontend-virt-service
              namespace: gateway
              hosts:
                - sarex.contour.infra.sarex.tech
              gateways:
                - gateway/platform-gateway
              routes:
                - path:
                    prefix: /control-interface/
                  rewrite: /
                  service: frontend-svc.control-interface.svc.cluster.local
                  port: 80
            workflows-frontend:
              name: workflows-virt-service
              namespace: gateway
              hosts:
                - sarex.contour.infra.sarex.tech
              gateways:
                - gateway/platform-gateway
              routes:
                - path:
                    prefix: /workflows/api/
                  rewrite: /api/
                  service: backend-svc.processing.svc.cluster.local
                  port: 80
                - path:
                    prefix: /workflows/
                  rewrite: /
                  service: frontend-svc.processing.svc.cluster.local
                  port: 80
            eav-api:
              name: eav-api-virt-service
              namespace: gateway
              hosts:
                - sarex.contour.infra.sarex.tech
              gateways:
                - gateway/platform-gateway
              routes:
                - path:
                    prefix: /eav/api/
                  rewrite: /api/
                  service: backend-svc.eav.svc.cluster.local
                  port: 80
            issues-api:
              name: issues-api-virt-service
              namespace: gateway
              hosts:
                - sarex.contour.infra.sarex.tech
              gateways:
                - gateway/platform-gateway
              routes:
                - path:
                    prefix: /issues/api/
                  rewrite: /api/
                  service: backend-svc.issues.svc.cluster.local
                  port: 80
            flows-api:
              name: flows-api-virt-service
              namespace: gateway
              hosts:
                - sarex.contour.infra.sarex.tech
              gateways:
                - gateway/platform-gateway
              routes:
                - path:
                    prefix: /flows/api/
                  rewrite: /api/
                  service: backend-svc.flows.svc.cluster.local
                  port: 80
            rfi-api:
              name: rfi-api-virt-service
              namespace: gateway
              hosts:
                - sarex.contour.infra.sarex.tech
              gateways:
                - gateway/platform-gateway
              routes:
                - path:
                    prefix: /rfi/api/
                  rewrite: /api/
                  service: backend-svc.rfi.svc.cluster.local
                  port: 80
            transmittals-api:
              name: flows-api-virt-service
              namespace: gateway
              hosts:
                - sarex.contour.infra.sarex.tech
              gateways:
                - gateway/platform-gateway
              routes:
                - path:
                    prefix: /transmittals/api/
                  rewrite: /api/
                  service: backend-svc.transmittal.svc.cluster.local
                  port: 80
            workspaces-api:
              name: workspaces-api-virt-service
              namespace: gateway
              hosts:
                - sarex.contour.infra.sarex.tech
              gateways:
                - gateway/platform-gateway
              routes:
                - path:
                    prefix: /workspaces/api/
                  rewrite: /api/
                  service: backend-svc.workspaces.svc.cluster.local
                  port: 80
            documentations-frontend:
              name: documentations-frontend-virt-service
              namespace: gateway
              hosts:
                - sarex.contour.infra.sarex.tech
              gateways:
                - gateway/platform-gateway
              routes:
                - path:
                    prefix: /documentations/static/
                  rewrite: /
                  service: frontend-svc.documentations.svc.cluster.local
                  port: 80
            transmittal-frontend:
              name: transmittal-frontend-virt-service
              namespace: gateway
              hosts:
                - sarex.contour.infra.sarex.tech
              gateways:
                - gateway/platform-gateway
              routes:
                - path:
                    prefix: /transmittal/static/
                  rewrite: /
                  service: frontend-svc.transmittal.svc.cluster.local
                  port: 80
            documentations-api:
              name: documentations-api-virt-service
              namespace: gateway
              hosts:
                - sarex.contour.infra.sarex.tech
              gateways:
                - gateway/platform-gateway
              routes:
                - path:
                    prefix: /documentations/api/
                  rewrite: /api/
                  service: backend-api-svc.documentations.svc.cluster.local
                  port: 80
            mapper-api:
              name: mapper-api-virt-service
              namespace: gateway
              hosts:
                - sarex.contour.infra.sarex.tech
              gateways:
                - gateway/platform-gateway
              routes:
                - path:
                    prefix: /mapper/api/
                  rewrite: /api/
                  service: backend-svc.mapper.svc.cluster.local
                  port: 80
            filestream-api:
              name: documentations-filestream-virt-service
              namespace: gateway
              hosts:
                - sarex.contour.infra.sarex.tech
              gateways:
                - gateway/platform-gateway
              routes:
                - path:
                    prefix: /files/api/
                  rewrite: /api/
                  service: backend-filestream-svc.documentations.svc.cluster.local
                  port: 80
            issues-frontend:
              name: issues-frontend-virt-service
              namespace: gateway
              hosts:
                - sarex.contour.infra.sarex.tech
              gateways:
                - gateway/platform-gateway
              routes:
                - path:
                    prefix: /issues/static/
                  rewrite: /
                  service: frontend-svc.issues.svc.cluster.local
                  port: 80
            flows-frontend:
              name: flows-frontend-virt-service
              namespace: gateway
              hosts:
                - sarex.contour.infra.sarex.tech
              gateways:
                - gateway/platform-gateway
              routes:
                - path:
                    prefix: /flows/static/
                  rewrite: /
                  service: frontend-svc.flows.svc.cluster.local
                  port: 80
            reviews-frontend:
              name: reviews-frontend-virt-service
              namespace: gateway
              hosts:
                - sarex.contour.infra.sarex.tech
              gateways:
                - gateway/platform-gateway
              routes:
                - path:
                    prefix: /reviews/static/
                  rewrite: /
                  service: frontend-svc.reviews.svc.cluster.local
                  port: 80
            rfi-frontend:
              name: rfi-frontend-virt-service
              namespace: gateway
              hosts:
                - sarex.contour.infra.sarex.tech
              gateways:
                - gateway/platform-gateway
              routes:
                - path:
                    prefix: /rfi/static/
                  rewrite: /
                  service: frontend-svc.rfi.svc.cluster.local
                  port: 80
            vault:
              name: vault-virt-service
              namespace: gateway
              hosts:
                - vault.contour.infra.sarex.tech
              gateways:
                - gateway/vault-gateway
              routes:
                - path:
                    prefix: /
                  service: vault-vault-contour.vault.svc.cluster.local
                  port: 8200
            minio:
              name: minio-virt-service
              namespace: gateway
              hosts:
                - minio.contour.infra.sarex.tech
              gateways:
                - gateway/minio-gateway
              routes:
                - path:
                    prefix: /console/
                  service: minio-console.minio.svc.cluster.local
                  port: 9001
            minio-api:
              name: minio-api-virt-service
              namespace: gateway
              hosts:
                - minio.contour.infra.sarex.tech
              gateways:
                - gateway/minio-gateway
              routes:
                - path:
                    prefix: /
                  service: minio.minio.svc.cluster.local
                  port: 9000  
            zitadel:
              name: zitadel-virt-service
              namespace: gateway
              hosts:
                - zitadel.contour.infra.sarex.tech
              gateways:
                - gateway/zitadel-gateway
              routes:
                - path:
                    prefix: /
                  service: zitadel-idp-contour.zitadel.svc.cluster.local
                  port: 8080
            dashboard:
              name: dashboard-virt-service
              namespace: gateway
              hosts:
                - dashboard.contour.infra.sarex.tech
              gateways:
                - gateway/dashboard-gateway
              routes:
                - path:
                    prefix: /
                  service: dashboard-kong-proxy.kubernetes-dashboard.svc.cluster.local
                  port: 80
            rabbitmq:
              name: rabbitmq-virt-service
              namespace: gateway
              hosts:
                - rabbitmq.contour.infra.sarex.tech
              gateways:
                - gateway/rabbitmq-gateway
              routes:
                - path:
                    prefix: /
                  service: rabbitmq.rabbitmq.svc.cluster.local
                  port: 15672
            keycloak:
              name: keycloak-virt-service
              namespace: gateway
              hosts:
                - keycloak.contour.infra.sarex.tech
              gateways:
                - gateway/keycloak-gateway
              routes:
                - path:
                    prefix: /
                  service: keycloak-keycloak-contour.keycloak.svc.cluster.local
                  port: 80
            glitchtip:
              name: glitchtip-virt-service
              namespace: gateway
              hosts:
                - glitchtip.contour.infra.sarex.tech
              gateways:
                - gateway/glitchtip-gateway
              routes:
                - path:
                    prefix: /
                  service: glitchtip-web.glitchtip.svc.cluster.local
                  port: 8000
            openobserve:
              name: openobserve-virt-service
              namespace: gateway
              hosts:
                - openobserve.contour.infra.sarex.tech
              gateways:
                - gateway/openobserve-gateway
              routes:
                - path:
                    prefix: /
                  service: openobserve-web.openobserve.svc.cluster.local
                  port: 5080
            camunda-keycloak:
              name: camunda-keycloak-virt-service
              namespace: gateway
              hosts:
                - camunda-keycloak.contour.infra.sarex.tech
              gateways:
                - gateway/camunda-gateway
              routes:
                - path:
                    prefix: /
                  service: camunda-keycloak.camunda.svc.cluster.local
                  port: 80
            camunda-identity:
              name: camunda-identity-virt-service
              namespace: gateway
              hosts:
                - camunda-identity.contour.infra.sarex.tech
              gateways:
                - gateway/camunda-gateway
              routes:
                - path:
                    prefix: /
                  service: camunda-identity.camunda.svc.cluster.local
                  port: 80
            camunda-operate:
              name: camunda-operate-virt-service
              namespace: gateway
              hosts:
                - camunda-operate.contour.infra.sarex.tech
              gateways:
                - gateway/camunda-gateway
              routes:
                - path:
                    prefix: /
                  service: camunda-operate.camunda.svc.cluster.local
                  port: 80
            camunda-tasklist:
              name: camunda-tasklist-virt-service
              namespace: gateway
              hosts:
                - camunda-tasklist.contour.infra.sarex.tech
              gateways:
                - gateway/camunda-gateway
              routes:
                - path:
                    prefix: /
                  service: camunda-tasklist.camunda.svc.cluster.local
                  port: 80
            camunda-optimize:
              name: camunda-optimize-virt-service
              namespace: gateway
              hosts:
                - camunda-optimize.contour.infra.sarex.tech
              gateways:
                - gateway/camunda-gateway
              routes:
                - path:
                    prefix: /
                  service: camunda-optimize.camunda.svc.cluster.local
                  port: 80
