From f7af3075307571c374b12dfbc66e8e435d565160 Mon Sep 17 00:00:00 2001
From: "maria.magro" <maria.magro@demetrix.it>
Date: Mon, 20 Jul 2026 14:57:47 +0200
Subject: [PATCH] Updated caddy so it can be a reverse proxy

---
 ionos_sbx/caddy-proxy/deployment.yaml        |  5 ++-
 ionos_sbx/caddy-proxy/ingress.yaml           | 25 +++++++++++++
 ionos_sbx/caddy-proxy/kustomization.yaml     |  8 +++-
 ionos_sbx/caddy-proxy/networkpolicy-tmf.yaml | 39 ++++++++++++++++++++
 ionos_sbx/caddy-proxy/service.yaml           |  5 ++-
 5 files changed, 78 insertions(+), 4 deletions(-)
 create mode 100644 ionos_sbx/caddy-proxy/ingress.yaml
 create mode 100644 ionos_sbx/caddy-proxy/networkpolicy-tmf.yaml

diff --git a/ionos_sbx/caddy-proxy/deployment.yaml b/ionos_sbx/caddy-proxy/deployment.yaml
index 3aee73a6..589448b1 100644
--- a/ionos_sbx/caddy-proxy/deployment.yaml
+++ b/ionos_sbx/caddy-proxy/deployment.yaml
@@ -4,7 +4,7 @@ metadata:
   name: caddy-proxy
   labels: { app: caddy-proxy }
 spec:
-  replicas: 1                       # 1 replica => 1 IP sorgente in uscita
+  replicas: 1                       
   selector:
     matchLabels: { app: caddy-proxy }
   template:
@@ -37,6 +37,9 @@ spec:
           readinessProbe: { tcpSocket: { port: 8080 }, initialDelaySeconds: 5,  periodSeconds: 10 }
           livenessProbe:  { tcpSocket: { port: 8080 }, initialDelaySeconds: 10, periodSeconds: 15 }
       volumes:
+        - name: caddyfile                                  
+          configMap:
+            name: caddy-proxy-config                                
         - name: data
           emptyDir: {}
         - name: config-store
diff --git a/ionos_sbx/caddy-proxy/ingress.yaml b/ionos_sbx/caddy-proxy/ingress.yaml
new file mode 100644
index 00000000..6d8368dc
--- /dev/null
+++ b/ionos_sbx/caddy-proxy/ingress.yaml
@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: tmf-caddy
+  namespace: caddy-proxy
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-sbx-issuer
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - tmf.dome-marketplace-sbx.org
+      secretName: tmf-dome-sbx-tls          
+  rules:
+    - host: tmf.dome-marketplace-sbx.org    
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: caddy-proxy                 
+                port:
+                  number: 80
\ No newline at end of file
diff --git a/ionos_sbx/caddy-proxy/kustomization.yaml b/ionos_sbx/caddy-proxy/kustomization.yaml
index 1c7fbdfd..1d971bed 100644
--- a/ionos_sbx/caddy-proxy/kustomization.yaml
+++ b/ionos_sbx/caddy-proxy/kustomization.yaml
@@ -4,4 +4,10 @@ resources:
   - deployment.yaml
   - service.yaml
   - forward-auth-sealed.yaml
-  - ghcr-auth-sealed.yaml   
\ No newline at end of file
+  - ghcr-auth-sealed.yaml
+  - ingress.yaml
+  - networkpolicy-tmf.yaml
+configMapGenerator:
+  - name: caddy-proxy-config
+    files:
+      - Caddyfile=Caddyfile   
\ No newline at end of file
diff --git a/ionos_sbx/caddy-proxy/networkpolicy-tmf.yaml b/ionos_sbx/caddy-proxy/networkpolicy-tmf.yaml
new file mode 100644
index 00000000..82ed6e0f
--- /dev/null
+++ b/ionos_sbx/caddy-proxy/networkpolicy-tmf.yaml
@@ -0,0 +1,39 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: tmf-allow-only-caddy
+  namespace: marketplace
+  labels: { app: caddy-proxy }
+spec:
+  podSelector:
+    matchExpressions:
+      - key: app.kubernetes.io/name
+        operator: In
+        values:
+          - tm-forum-api-account
+          - tm-forum-api-agreement
+          - tm-forum-api-product-catalog
+          - tm-forum-api-customer-bill-management
+          - tm-forum-api-customer-management
+          - tm-forum-api-party-catalog
+          - tm-forum-api-party-role
+          - tm-forum-api-product-inventory
+          - tm-forum-api-product-ordering-managementù
+          - tm-forum-api-quote
+          - tm-forum-api-resource-catalog
+          - tm-forum-api-resource-function-activation
+          - tm-forum-api-resource-inventory
+          - tm-forum-api-service-catalog
+          - tm-forum-api-service-inventory
+          - tm-forum-api-usage-management
+          - tm-forum-api-document-management
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app: caddy-proxy
+      ports:
+        - protocol: TCP
+          port: 8080 
\ No newline at end of file
diff --git a/ionos_sbx/caddy-proxy/service.yaml b/ionos_sbx/caddy-proxy/service.yaml
index 54be86aa..c8aed59c 100644
--- a/ionos_sbx/caddy-proxy/service.yaml
+++ b/ionos_sbx/caddy-proxy/service.yaml
@@ -3,7 +3,8 @@ kind: Service
 metadata:
   name: caddy-proxy
 spec:
-  type: ClusterIP          # consumato dalle app INTERNE via HTTP_PROXY
+  type: ClusterIP          
   selector: { app: caddy-proxy }
   ports:
-    - { name: forward, port: 8080, targetPort: 8080 }
\ No newline at end of file
+    - { name: forward, port: 8080, targetPort: 8080 }
+    - { name: http,    port: 80,   targetPort: 80 }
\ No newline at end of file