From 790069ad390e143166d5e0f9d3cbdcaacdd03442 Mon Sep 17 00:00:00 2001
From: Nikolay Govorov <me@govorov.online>
Date: Sat, 22 Aug 2026 06:34:40 +0100
Subject: Expose Mirum gRPC through Gateway API

---
 charts/mirum/templates/server-deployment.yaml | 11 ++++++++++
 charts/mirum/templates/server-tcproute.yaml   | 22 +++++++++++++++++++
 charts/mirum/values.yaml                      | 13 ++++++++---
 3 files changed, 43 insertions(+), 3 deletions(-)
 create mode 100644 charts/mirum/templates/server-tcproute.yaml

diff --git a/charts/mirum/templates/server-deployment.yaml b/charts/mirum/templates/server-deployment.yaml
index c5cb8c8..82df4b0 100644
--- a/charts/mirum/templates/server-deployment.yaml
+++ b/charts/mirum/templates/server-deployment.yaml
@@ -76,6 +76,11 @@ spec:
             - name: config
               mountPath: /etc/mirum/secret
               readOnly: true
+            {{- with .Values.server.grpcTls.existingSecret }}
+            - name: grpc-tls
+              mountPath: /etc/mirum/grpc-tls
+              readOnly: true
+            {{- end }}
             - name: run
               mountPath: /run/mirum-server
       volumes:
@@ -83,6 +88,12 @@ spec:
           secret:
             secretName: {{ .Values.server.existingSecret }}
             defaultMode: 0440
+        {{- with .Values.server.grpcTls.existingSecret }}
+        - name: grpc-tls
+          secret:
+            secretName: {{ . }}
+            defaultMode: 0440
+        {{- end }}
         - name: run
           emptyDir: {}
       {{- with .Values.server.nodeSelector }}
diff --git a/charts/mirum/templates/server-tcproute.yaml b/charts/mirum/templates/server-tcproute.yaml
new file mode 100644
index 0000000..e639aee
--- /dev/null
+++ b/charts/mirum/templates/server-tcproute.yaml
@@ -0,0 +1,22 @@
+# SPDX-FileCopyrightText: 2026 Nikolay Govorov
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+{{- if and .Values.server.enabled .Values.server.grpcRoute.enabled }}
+apiVersion: gateway.networking.k8s.io/v1
+kind: TCPRoute
+metadata:
+  name: {{ include "mirum.fullname" . }}-grpc
+  labels:
+    {{- include "mirum.componentLabels" (dict "root" . "component" "server") | nindent 4 }}
+spec:
+  {{- with .Values.server.grpcRoute.parentRefs }}
+  parentRefs:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  rules:
+    - backendRefs:
+        - name: {{ include "mirum.fullname" . }}
+          port: {{ .Values.server.grpcPort }}
+{{- end }}
+
+# vim: set filetype=helm:
diff --git a/charts/mirum/values.yaml b/charts/mirum/values.yaml
index 3383b48..13158a2 100644
--- a/charts/mirum/values.yaml
+++ b/charts/mirum/values.yaml
@@ -13,16 +13,23 @@ server:
     tag: ""
     digest: ""
     pullPolicy: IfNotPresent
-  # Must contain config.yaml and every file referenced by that config, normally
-  # grpc.crt and grpc.key. Keep database_uri, pepper, token, and webhook_secret
-  # in this Secret rather than Helm values.
+  # Must contain config.yaml and any private files other than the gRPC
+  # certificate. Keep database_uri, pepper, token, and webhook_secret in this
+  # Secret rather than Helm values.
   existingSecret: mirum-server
+  grpcTls:
+    # Optional cert-manager-style Secret containing tls.crt and tls.key. The
+    # files are mounted at /etc/mirum/grpc-tls/ for config.yaml to reference.
+    existingSecret: ""
   webPort: 3000
   grpcPort: 2000
   route:
     enabled: false
     hostnames: []
     parentRefs: []
+  grpcRoute:
+    enabled: false
+    parentRefs: []
   resources: {}
   extraEnv: []
   podAnnotations: {}
-- 
Gilti