# SPDX-License-Identifier: MIT-0
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: {{ wikideck_name | to_json }}
  namespace: {{ wikideck_namespace | to_json }}
  labels:
    app.kubernetes.io/name: wikideck
    app.kubernetes.io/instance: {{ wikideck_name | to_json }}
    app.kubernetes.io/managed-by: ansible
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: wikideck
      app.kubernetes.io/instance: {{ wikideck_name | to_json }}
  policyTypes: [Ingress, Egress]
{% if wikideck_network_policy_ingress_from | length > 0 %}
  ingress:
    - from: {{ wikideck_network_policy_ingress_from | to_json }}
      ports:
        - protocol: TCP
          port: 3001
{% else %}
  ingress: []
{% endif %}
{% if wikideck_network_policy_dns_to | length == 0 and (wikideck_offline or wikideck_network_policy_https_to | length == 0) %}
  egress: []
{% else %}
  egress:
{% if wikideck_network_policy_dns_to | length > 0 %}
    - to: {{ wikideck_network_policy_dns_to | to_json }}
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
{% endif %}
{% if not wikideck_offline and wikideck_network_policy_https_to | length > 0 %}
    - to: {{ wikideck_network_policy_https_to | to_json }}
      ports:
        - protocol: TCP
          port: 443
{% endif %}
{% endif %}