From 8002d9d0b72b9d4aa671333f9e1365b4e33a64f7 Mon Sep 17 00:00:00 2001
From: "pierre.geeraert" <pierre.geeraert@betfred.com>
Date: Tue, 13 Oct 2026 18:00:23 +0100
Subject: [PATCH] ingress module

---
 modules/ingress/ingress.tf | 87 +++++++++++++++++++++++++-------------
 1 file changed, 57 insertions(+), 30 deletions(-)

diff --git a/modules/ingress/ingress.tf b/modules/ingress/ingress.tf
index b1b22b6..d7b4946 100644
--- a/modules/ingress/ingress.tf
+++ b/modules/ingress/ingress.tf
@@ -59,7 +59,9 @@ variable "kubernetes_input" {
 
 
 resource "kubernetes_ingress_v1" "automatic_ingress" {
+  # Keep your top-level filter for filtering active services
   for_each = { for key, value in var.kubernetes_input : key => value if value.service_port != null && value.enabled == true && value.docker != true && value.exposed == true }
+
   metadata {
     name      = "${each.key}-ingress"
     namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
@@ -72,34 +74,48 @@ resource "kubernetes_ingress_v1" "automatic_ingress" {
 
   spec {
     ingress_class_name = "traefik"
-    # Dynamic TLS configuration for cert-manager
-    tls {
-      hosts       = [join(".", [coalesce(each.value.domain_name, each.key), "geeraert.eu"])]
-      secret_name = "${each.key}-tls-secret" # cert-manager will create and manage this secret automatically
+
+    # --- DYNAMIC TLS BLOCK ---
+    # Generates a separate TLS block + secret per domain entry
+    dynamic "tls" {
+      for_each = toset(coalesce(each.value.domain_name, [each.key]))
+      content {
+        hosts       = [join(".", [tls.value, "geeraert.eu"])]
+        secret_name = "${each.key}-${tls.value}-tls-secret"
+      }
     }
 
-    rule {
-      host = join(".", [coalesce(each.value.domain_name, each.key), "geeraert.eu"])
-      http {
-        path {
-          path = "/"
-          backend {
-            service {
-              name = "${each.key}-svc"
-              port {
-                number = each.value.service_port[0] #selecting the first of the list
+    # --- DYNAMIC RULE BLOCK ---
+    # Loops through the domain list and creates an HTTP path routing rule for each
+    dynamic "rule" {
+      for_each = toset(coalesce(each.value.domain_name, [each.key]))
+      content {
+        host = join(".", [rule.value, "geeraert.eu"])
+        http {
+          path {
+            path = "/"
+            backend {
+              service {
+                name = "${each.key}-svc"
+                port {
+                  number = each.value.service_port[0]
+                }
               }
             }
           }
         }
       }
     }
+
   }
 }
+
 resource "kubernetes_ingress_v1" "automatic_ingress_legacy" {
-  for_each = { for key, value in var.kubernetes_input : key => value if value.service_port != null && value.enabled == true && value.docker != true && value.exposed == true && value.legacy_domain == true }
+  # Keep your top-level filter for filtering active services
+  for_each = { for key, value in var.kubernetes_input : key => value if value.service_port != null && value.enabled == true && value.docker != true && value.exposed == true }
+
   metadata {
-    name      = "${each.key}-ingress-legacy"
+    name      = "${each.key}-ingress"
     namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
 
     annotations = {
@@ -110,27 +126,38 @@ resource "kubernetes_ingress_v1" "automatic_ingress_legacy" {
 
   spec {
     ingress_class_name = "traefik"
-    # Dynamic TLS configuration for cert-manager
-    tls {
-      hosts       = [join(".", [coalesce(each.value.domain_name, each.key), "tryton.geeraert.eu"])]
-      secret_name = "${each.key}-tryton-tls-secret" # cert-manager will create and manage this secret automatically
+
+    # --- DYNAMIC TLS BLOCK ---
+    # Generates a separate TLS block + secret per domain entry
+    dynamic "tls" {
+      for_each = toset(coalesce(each.value.domain_name, [each.key]))
+      content {
+        hosts       = [join(".", [tls.value, "geeraert.eu"])]
+        secret_name = "${each.key}-${tls.value}-tls-secret"
+      }
     }
 
-    rule {
-      host = join(".", [coalesce(each.value.domain_name, each.key), "tryton.geeraert.eu"])
-      http {
-        path {
-          path = "/"
-          backend {
-            service {
-              name = "${each.key}-svc"
-              port {
-                number = each.value.service_port[0] #selecting the first of the list
+    # --- DYNAMIC RULE BLOCK ---
+    # Loops through the domain list and creates an HTTP path routing rule for each
+    dynamic "rule" {
+      for_each = toset(coalesce(each.value.domain_name, [each.key]))
+      content {
+        host = join(".", [rule.value, "geeraert.eu"])
+        http {
+          path {
+            path = "/"
+            backend {
+              service {
+                name = "${each.key}-svc"
+                port {
+                  number = each.value.service_port[0]
+                }
               }
             }
           }
         }
       }
     }
+
   }
 }
\ No newline at end of file