From 292528ec154ae11c9a86fbb58d8b484b45ed8b5c Mon Sep 17 00:00:00 2001
From: Andrew Stoltz <andrew@flowercore.io>
Date: Fri, 24 Apr 2026 01:03:34 -0500
Subject: [PATCH] feat(fc-desktop): add /guacamole PathPrefix route to
 IngressRoute
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Single-host Guacamole routing — Traefik matches Host=desktop.iamworkin.lan
+ PathPrefix=/guacamole first (priority 20) and forwards to the
guacamole Service in the guacamole namespace on 8080. The existing
Host-only catch-all rule drops to priority 10 so Guacamole traffic
resolves to the more-specific match.

Mirrors the IngressRoute in FlowerCore.RemoteDesktop@master (merged
as part of codex/single-host-guacamole-wip). The RemoteDesktop repo
copy is deploy-ref only — ArgoCD owns the live IngressRoute via
this manifest. Without this change, GuacamolePublicUrl=
https://desktop.iamworkin.lan/guacamole returns 404 because Traefik
routes the whole Host to remotedesktop-web.

Unblocks the per-template AAT smoke against the new public URL
path + closes the final live piece of Codex's single-host routing
work.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 apps/fc-desktop/fc-desktop.yaml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/apps/fc-desktop/fc-desktop.yaml b/apps/fc-desktop/fc-desktop.yaml
index dc49ae5..786a087 100644
--- a/apps/fc-desktop/fc-desktop.yaml
+++ b/apps/fc-desktop/fc-desktop.yaml
@@ -23,8 +23,23 @@ spec:
   entryPoints:
     - websecure
   routes:
+    # Single-host Guacamole routing: Traefik forwards the /guacamole
+    # path-prefix directly to the guacamole Service in the guacamole
+    # namespace. Must precede the catch-all Host() rule so priority
+    # resolves the more-specific match first. RemoteDesktop.Web then
+    # emits launch URLs with host=desktop.iamworkin.lan + /guacamole
+    # prefix, keeping Guacamole reachable through the same public
+    # surface (GuacamolePublicUrl=https://desktop.iamworkin.lan/guacamole).
+    - match: Host(`desktop.iamworkin.lan`) && PathPrefix(`/guacamole`)
+      kind: Rule
+      priority: 20
+      services:
+        - name: guacamole
+          namespace: guacamole
+          port: 8080
     - match: Host(`desktop.iamworkin.lan`)
       kind: Rule
+      priority: 10
       services:
         - name: remotedesktop-web
           port: 8080