From f4377616e6f91e08092178b61bdcc4c9f99eaad5 Mon Sep 17 00:00:00 2001
From: Ruben Hensen <ruben.hensen@protonmail.com>
Date: Fri, 23 Oct 2026 17:30:42 +0200
Subject: [PATCH] gatus: serve s2.rubenhensen.nl through the Gateway as well

First app on the Gateway API: an HTTPS listener for s2.rubenhensen.nl using the existing certificate in the gatus namespace, an HTTPRoute, and a ReferenceGrant for the certificate. Plain HTTP on the Gateway now redirects to HTTPS. The Ingress stays until the switch-over.
---
 gateway/gateway.yaml        | 16 ++++++++++++++++
 gateway/https-redirect.yaml | 17 +++++++++++++++++
 gatus/httproute.yaml        | 30 ++++++++++++++++++++++++++++++
 gatus/kustomization.yaml    |  1 +
 4 files changed, 64 insertions(+)
 create mode 100644 gateway/https-redirect.yaml
 create mode 100644 gatus/httproute.yaml

diff --git a/gateway/gateway.yaml b/gateway/gateway.yaml
index 1158e90..4067d6d 100644
--- a/gateway/gateway.yaml
+++ b/gateway/gateway.yaml
@@ -14,3 +14,19 @@ spec:
     allowedRoutes:
       namespaces:
         from: All
+  # One HTTPS listener per hostname, each limited to its app's namespace.
+  # The certificates stay in the app namespaces (ReferenceGrant there).
+  - name: https-s2
+    protocol: HTTPS
+    port: 443
+    hostname: s2.rubenhensen.nl
+    tls:
+      certificateRefs:
+      - name: letsencrypt-prod
+        namespace: gatus
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: gatus
diff --git a/gateway/https-redirect.yaml b/gateway/https-redirect.yaml
new file mode 100644
index 0000000..3b8fa8d
--- /dev/null
+++ b/gateway/https-redirect.yaml
@@ -0,0 +1,17 @@
+# Plain HTTP only redirects to HTTPS. cert-manager's HTTP-01 challenge
+# routes name an exact hostname, so they win over this catch-all.
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: https-redirect
+  namespace: envoy-gateway-system
+spec:
+  parentRefs:
+  - name: homelab
+    sectionName: http
+  rules:
+  - filters:
+    - type: RequestRedirect
+      requestRedirect:
+        scheme: https
+        statusCode: 301
diff --git a/gatus/httproute.yaml b/gatus/httproute.yaml
new file mode 100644
index 0000000..ff6d68d
--- /dev/null
+++ b/gatus/httproute.yaml
@@ -0,0 +1,30 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: gatus
+spec:
+  parentRefs:
+  - name: homelab
+    namespace: envoy-gateway-system
+    sectionName: https-s2
+  hostnames:
+  - s2.rubenhensen.nl
+  rules:
+  - backendRefs:
+    - name: gatus
+      port: 8080
+---
+# Lets the Gateway serve the certificate cert-manager keeps in this namespace.
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: gateway-tls
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: envoy-gateway-system
+  to:
+  - group: ""
+    kind: Secret
+    name: letsencrypt-prod
diff --git a/gatus/kustomization.yaml b/gatus/kustomization.yaml
index 6a58f9a..c886127 100644
--- a/gatus/kustomization.yaml
+++ b/gatus/kustomization.yaml
@@ -9,6 +9,7 @@ resources:
   - gatus-deployment.yaml
   - gatus-service.yaml
   - ingress.yaml
+  - httproute.yaml
 
 configMapGenerator:
   - name: gatus-config