{% if taskserv.vpn_service.enabled %}
apiVersion: v1
kind: Service
metadata:
  name: {{ taskserv.deployment }}-{{ taskserv.vpn_service.service_name }}
  namespace: {{ taskserv.namespace }}
  labels:
    app.kubernetes.io/name: {{ taskserv.deployment }}
    app.kubernetes.io/managed-by: provisioning
    app.kubernetes.io/component: vpn
  annotations:
    librecloud.online/exposure: "vpn-private"
{% if taskserv.mtls.enabled %}
    librecloud.online/mtls: "enabled"
{% else %}
    librecloud.online/mtls: "disabled"
{% endif %}
spec:
  type: NodePort
  externalTrafficPolicy: Local
{% if taskserv.vpn_service.external_ips | length > 0 %}
  externalIPs:
{% for ip in taskserv.vpn_service.external_ips %}
    - {{ ip }}
{% endfor %}
{% endif %}
  selector:
    app.kubernetes.io/name: {{ taskserv.deployment }}
  ports:
    - name: buildkit-tls
      port: {{ taskserv.port }}
      targetPort: {{ taskserv.port }}
      nodePort: {{ taskserv.vpn_service.nodeport }}
      protocol: TCP
{% endif %}