# SAMMS ENTERPRISE SOVEREIGN OPERATING SYSTEM - Ingress Configuration
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: sesos-ingress
  labels:
    app: sesos
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/proxy-body-size: "50m"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
    nginx.ingress.kubernetes.io/proxy-buffering: "on"
    nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
    nginx.ingress.kubernetes.io/client-body-buffer-size: "128k"
    cert-manager.io/cluster-issuer: letsencrypt-prod
    nginx.ingress.kubernetes.io/rate-limit: "100"
    nginx.ingress.kubernetes.io/rate-limit-window: "1m"
    nginx.ingress.kubernetes.io/configuration-snippet: |
      more_set_headers "X-Frame-Options: DENY";
      more_set_headers "X-Content-Type-Options: nosniff";
      more_set_headers "X-XSS-Protection: 1; mode=block";
      more_set_headers "Referrer-Policy: strict-origin-when-cross-origin";
      more_set_headers "Permissions-Policy: geolocation=(), microphone=(), camera=()";
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - sesos.example.com
        - api.sesos.example.com
      secretName: sesos-tls
  rules:
    - host: sesos.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: sesos-frontend
                port:
                  number: 3000
    - host: api.sesos.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: sesos-backend
                port:
                  number: 8000
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: sesos-network-policy
  labels:
    app: sesos
spec:
  podSelector:
    matchLabels:
      app: sesos
  policyTypes:
    - Ingress
    - Egress
  ingress:
    # Allow traffic from ingress controller
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: ingress-nginx
      ports:
        - protocol: TCP
          port: 8000
        - protocol: TCP
          port: 3000
    # Allow internal traffic between SESOS components
    - from:
        - podSelector:
            matchLabels:
              app: sesos
      ports:
        - protocol: TCP
          port: 8000
        - protocol: TCP
          port: 3000
  egress:
    # Allow DNS resolution
    - to:
        - namespaceSelector: {}
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - protocol: UDP
          port: 53
    # Allow outbound HTTPS
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
              - 10.0.0.0/8
              - 172.16.0.0/12
              - 192.168.0.0/16
      ports:
        - protocol: TCP
          port: 443
    # Allow traffic to database
    - to:
        - podSelector:
            matchLabels:
              app: postgresql
      ports:
        - protocol: TCP
          port: 5432
    # Allow traffic to Redis
    - to:
        - podSelector:
            matchLabels:
              app: redis
      ports:
        - protocol: TCP
          port: 6379