{{- if .Values.networkPolicy.enabled }}
{{- if or .Values.jellyfin.enableDLNA .Values.podPrivileges.hostNetwork }}
{{- fail "NetworkPolicy cannot be enabled when hostNetwork is enabled (DLNA mode or podPrivileges.hostNetwork). NetworkPolicy does not apply to pods using hostNetwork. Please set networkPolicy.enabled=false or disable hostNetwork." }}
{{- end }}
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: {{ include "jellyfin.fullname" . }}
  labels:
    {{- include "jellyfin.labels" . | nindent 4 }}
spec:
  podSelector:
    matchLabels:
      {{- include "jellyfin.selectorLabels" . | nindent 6 }}
  policyTypes:
    {{- toYaml .Values.networkPolicy.policyTypes | nindent 4 }}

  {{- if has "Ingress" .Values.networkPolicy.policyTypes }}
  ingress:
    # Allow traffic to Jellyfin HTTP port
    - ports:
        - protocol: TCP
          port: http
      {{- if not .Values.networkPolicy.ingress.allowExternal }}
      from:
        {{- if or .Values.networkPolicy.ingress.podSelector .Values.networkPolicy.ingress.namespaceSelector }}
        - podSelector:
            {{- toYaml .Values.networkPolicy.ingress.podSelector | nindent 12 }}
          {{- if .Values.networkPolicy.ingress.namespaceSelector }}
          namespaceSelector:
            {{- toYaml .Values.networkPolicy.ingress.namespaceSelector | nindent 12 }}
          {{- end }}
        {{- end }}
      {{- end }}

    {{- if and .Values.metrics.enabled .Values.metrics.serviceMonitor.enabled }}
    # Allow Prometheus metrics scraping
    - ports:
        - protocol: TCP
          port: {{ .Values.metrics.serviceMonitor.port }}
      from:
        - podSelector:
            {{- toYaml .Values.networkPolicy.metrics.podSelector | nindent 12 }}
          {{- if .Values.networkPolicy.metrics.namespace }}
          namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: {{ .Values.networkPolicy.metrics.namespace }}
          {{- end }}
    {{- end }}

    {{- with .Values.networkPolicy.ingress.customRules }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
  {{- end }}

  {{- if has "Egress" .Values.networkPolicy.policyTypes }}
  egress:
    {{- if .Values.networkPolicy.egress.allowDNS }}
    # Allow DNS resolution (required for Jellyfin operation)
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: {{ .Values.networkPolicy.egress.dnsNamespace }}
          podSelector:
            matchLabels:
              {{- toYaml .Values.networkPolicy.egress.dnsPodSelector | nindent 14 }}
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
    {{- end }}

    {{- if .Values.networkPolicy.egress.allowAllEgress }}
    # Allow all egress traffic (metadata providers, subtitles, images, etc.)
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
    {{- else }}
      {{- if .Values.networkPolicy.egress.restrictedEgress.allowMetadata }}
    # Allow HTTPS for metadata providers (TMDB, TheTVDB, OpenSubtitles, etc.)
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
      ports:
        - protocol: TCP
          port: 443
      {{- end }}

      {{- if .Values.networkPolicy.egress.restrictedEgress.allowInCluster }}
    # Allow pod-to-pod communication within the cluster
    - to:
        - podSelector: {}
      {{- end }}

      {{- range .Values.networkPolicy.egress.restrictedEgress.allowedCIDRs }}
    # Custom CIDR egress rule
    - to:
        - ipBlock:
            cidr: {{ . }}
      {{- end }}
    {{- end }}

    {{- with .Values.networkPolicy.egress.customRules }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
  {{- end }}
{{- end }}