apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: vibecarbon-metabase
  namespace: vibecarbon
spec:
  entryPoints:
    - websecure
  routes:
    # Metabase uses relative asset paths so strip-prefix works correctly.
    - match: PathPrefix(`/admin/metabase`)
      kind: Rule
      priority: 20
      services:
        - name: metabase
          port: 3000
      middlewares:
        - name: admin-auth
        - name: security-headers
        - name: strip-admin-metabase-prefix
  tls:
    secretName: vibecarbon-tls