apiVersion: metallb.io/v1beta1
kind: IPAddressPool
metadata:
  name: ipv6-dynamic-pool
  namespace: metallb
spec:
  autoAssign: false
  avoidBuggyIPs: true
  addresses:
    - omitted_ipv4/24
    - omitted_ipv6/116
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyProxy
metadata:
  name: homelab-proxy-ipv6-config
spec:
  provider:
    type: Kubernetes
    kubernetes:
      envoyDeployment:
        replicas: 2
      envoyService:
        annotations:
          metallb.io/address-pool: ipv6-dynamic-pool
  ipFamily: DualStack
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: eg-ipv6
  annotations:
    cert-manager.io/issuer: letsencrypt-prod
spec:
  gatewayClassName: eg
  infrastructure:
    parametersRef:
      group: gateway.envoyproxy.io
      kind: EnvoyProxy
      name: homelab-proxy-ipv6-config
  listeners:
    - name: http
      port: 80
      protocol: HTTP
      hostname: "xxx"
      allowedRoutes:
        namespaces:
          from: All
    - name: https
      port: 443
      protocol: HTTPS
      hostname: "xxx"
      tls:
        mode: Terminate
        certificateRefs:
          - name: xxx
      allowedRoutes:
        namespaces:
          from: All
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: authentik-route
  namespace: authentik
spec:
  parentRefs:
    - name: eg
      namespace: gateway
      sectionName: https
    - name: eg-ipv6
      namespace: gateway
      sectionName: http
    - name: eg-ipv6
      namespace: gateway
      sectionName: https
  hostnames:
    - "xxx"
    - "xxx"
  rules:
    - backendRefs:
        - name: authentik-server
          namespace: authentik
          kind: Service
          port: 80