# SPDX-License-Identifier: MIT-0
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: {{ wikideck_name | to_json }}
  namespace: {{ wikideck_namespace | to_json }}
  labels:
    app.kubernetes.io/name: wikideck
    app.kubernetes.io/instance: {{ wikideck_name | to_json }}
    app.kubernetes.io/managed-by: ansible
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: wikideck
      app.kubernetes.io/instance: {{ wikideck_name | to_json }}
  policyTypes: [Ingress, Egress]
{% if wikideck_network_policy_ingress_from | length > 0 %}
  ingress:
    - from: {{ wikideck_network_policy_ingress_from | to_json }}
      ports:
        - protocol: TCP
          port: 3001
{% else %}
  ingress: []
{% endif %}
{% set public_egress = wikideck_peers | length > 0 and wikideck_network_policy_https_to | length > 0 and wikideck_network_policy_https_ports | length > 0 %}
{% if wikideck_network_policy_dns_to | length == 0 and not public_egress and (wikideck_peers | length == 0 or wikideck_network_policy_peer_egress | length == 0) %}
  egress: []
{% else %}
  egress:
{% if wikideck_network_policy_dns_to | length > 0 %}
    - to: {{ wikideck_network_policy_dns_to | to_json }}
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
{% endif %}
{% if public_egress %}
    - to: {{ wikideck_network_policy_https_to | to_json }}
      ports:
{% for port in wikideck_network_policy_https_ports %}
        - protocol: TCP
          port: {{ port | int }}
{% endfor %}
{% endif %}
{% if wikideck_peers | length > 0 %}
{% for rule in wikideck_network_policy_peer_egress %}
    - {{ rule | to_json }}
{% endfor %}
{% endif %}
{% endif %}