apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/auth-tls-verify-client: "on"
    nginx.ingress.kubernetes.io/auth-tls-secret: "kube-system/mtls-client-crt-bundle"
    nginx.ingress.kubernetes.io/auth-tls-error-page: "https://maintenance.python-discord.workers.dev/"
    # block HEAD requests
    nginx.ingress.kubernetes.io/configuration-snippet: |
      if ($request_method = HEAD) {
        return 444;
      }
  name: pinnwand
  namespace: web
spec:
  tls:
  - hosts:
      - "*.pythondiscord.com"
    secretName: pythondiscord.com-tls
  rules:
  - host: paste.pythondiscord.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: pinnwand
            port:
              number: 80