From 6b699e6c9a2b134805a82a091399a184539c74f8 Mon Sep 17 00:00:00 2001
From: Vadym Mudryi <vadym.mudryi@gmail.com>
Date: Thu, 15 Jan 2026 14:45:30 +0200
Subject: [PATCH] feat: Make sub-domain separator configurable;

---
 charts/opencrvs-services/README.md                    |  5 +++++
 charts/opencrvs-services/templates/_helpers.tpl       |  8 +++++++-
 .../opencrvs-services/templates/auth-deployment.yaml  |  2 +-
 .../templates/client-deployment.yaml                  |  2 +-
 .../templates/config-deployment.yaml                  |  2 +-
 .../templates/countryconfig-deployment.yaml           |  8 ++++----
 .../templates/dashboards-deployment.yaml              |  2 +-
 .../templates/events-deployment.yaml                  |  2 +-
 .../templates/gateway-deployment.yaml                 |  2 +-
 .../opencrvs-services/templates/login-deployment.yaml |  2 +-
 .../templates/webhooks-deployment.yaml                |  2 +-
 charts/opencrvs-services/values.yaml                  | 11 +++++++++++
 12 files changed, 35 insertions(+), 13 deletions(-)

diff --git a/charts/opencrvs-services/README.md b/charts/opencrvs-services/README.md
index 187e188f..6855ee7a 100644
--- a/charts/opencrvs-services/README.md
+++ b/charts/opencrvs-services/README.md
@@ -267,6 +267,11 @@ helm upgrade --install opencrvs oci://ghcr.io/opencrvs/opencrvs-services \
             <td>opencrvs.org</td>
             <td>Hostname for OpenCRVS application, without wildcard or subdomain. Example: hostname: opencrvs.localhost</td>
         </tr>
+        <tr>
+            <td>subdomain_separator</td>
+            <td><code>.</code></td>
+            <td>Separator between <code>hostname</code> and subdomains. See values.yaml for more information.</td>
+        </tr>
         <tr>
             <td>ingress.ssl_enabled</td>
             <td>true</td>
diff --git a/charts/opencrvs-services/templates/_helpers.tpl b/charts/opencrvs-services/templates/_helpers.tpl
index e89aca01..44f43172 100644
--- a/charts/opencrvs-services/templates/_helpers.tpl
+++ b/charts/opencrvs-services/templates/_helpers.tpl
@@ -47,10 +47,16 @@ Parameters:
 {{- end }}
 {{- end }}
 
+{{- define "render-external-subdomain" -}}
+{{- $service_name := .service_name }}
+{{- $http_scheme := include "http-scheme" . }}
+{{- printf "%s%s%s" $service_name ( .Values.subdomain_separator | default ".") .Values.hostname }}
+{{- end }}
+
 {{- define "render-external-url" -}}
 {{- $service_name := .service_name }}
 {{- $http_scheme := include "http-scheme" . }}
-{{- printf "%s://%s.%s" $http_scheme $service_name .Values.hostname }}
+{{- printf "%s://%s%s%s" $http_scheme $service_name ( .Values.subdomain_separator | default ".") .Values.hostname }}
 {{- end }}
 
 {{- define "service-helper" -}}
diff --git a/charts/opencrvs-services/templates/auth-deployment.yaml b/charts/opencrvs-services/templates/auth-deployment.yaml
index 16b097ad..1423cd1e 100644
--- a/charts/opencrvs-services/templates/auth-deployment.yaml
+++ b/charts/opencrvs-services/templates/auth-deployment.yaml
@@ -12,7 +12,7 @@ spec:
     - web
   {{- end }}
   routes:
-  - match: 'Host(`auth.{{ .Values.hostname }}`)'
+  - match: 'Host(`{{ include "render-external-subdomain" (dict "service_name" "auth" "Values" .Values) }}`)'
     kind: Rule
     services:
     - name: auth
diff --git a/charts/opencrvs-services/templates/client-deployment.yaml b/charts/opencrvs-services/templates/client-deployment.yaml
index 2d7c1ab4..502ded66 100644
--- a/charts/opencrvs-services/templates/client-deployment.yaml
+++ b/charts/opencrvs-services/templates/client-deployment.yaml
@@ -12,7 +12,7 @@ spec:
     - web
   {{- end }}
   routes:
-  - match: 'Host(`register.{{ .Values.hostname }}`) || Host(`{{ .Values.hostname }}`)'
+  - match: 'Host(`{{ include "render-external-subdomain" (dict "service_name" "register" "Values" .Values) }}`) || Host(`{{ .Values.hostname }}`)'
     kind: Rule
     services:
     - name: client
diff --git a/charts/opencrvs-services/templates/config-deployment.yaml b/charts/opencrvs-services/templates/config-deployment.yaml
index 73b47fbf..1f8e7f7f 100644
--- a/charts/opencrvs-services/templates/config-deployment.yaml
+++ b/charts/opencrvs-services/templates/config-deployment.yaml
@@ -12,7 +12,7 @@ spec:
     - web
   {{- end }}
   routes:
-  - match: 'Host(`config.{{ .Values.hostname }}`)'
+  - match: 'Host(`{{ include "render-external-subdomain" (dict "service_name" "config" "Values" .Values) }}`)'
     kind: Rule
     services:
     - name: config
diff --git a/charts/opencrvs-services/templates/countryconfig-deployment.yaml b/charts/opencrvs-services/templates/countryconfig-deployment.yaml
index 95d38027..60faa384 100644
--- a/charts/opencrvs-services/templates/countryconfig-deployment.yaml
+++ b/charts/opencrvs-services/templates/countryconfig-deployment.yaml
@@ -12,7 +12,7 @@ spec:
     - web
   {{- end }}
   routes:
-  - match: 'Host(`countryconfig.{{ .Values.hostname }}`) && !Path(`/email`) && !Path(`/notification`) && !Path(`/dashboards/queries.json`)'
+  - match: 'Host(`{{ include "render-external-subdomain" (dict "service_name" "countryconfig" "Values" .Values) }}`) && !Path(`/email`) && !Path(`/notification`) && !Path(`/dashboards/queries.json`)'
     kind: Rule
     services:
     - name: countryconfig
@@ -21,7 +21,7 @@ spec:
     middlewares:
       - name: sts-and-basic-response-headers
       - name: enable-compression
-  - match: 'Host(`countryconfig.{{ .Values.hostname }}`) && Path(`/email`)'
+  - match: 'Host(`{{ include "render-external-subdomain" (dict "service_name" "countryconfig" "Values" .Values) }}`) && Path(`/email`)'
     kind: Rule
     services:
     - name: countryconfig
@@ -29,7 +29,7 @@ spec:
       port: {{ .Values.countryconfig.port }}
     middlewares:
       - name: block-internal-routes
-  - match: 'Host(`countryconfig.{{ .Values.hostname }}`) && Path(`/notification`)'
+  - match: 'Host(`{{ include "render-external-subdomain" (dict "service_name" "countryconfig" "Values" .Values) }}`) && Path(`/notification`)'
     kind: Rule
     services:
     - name: countryconfig
@@ -37,7 +37,7 @@ spec:
       port: {{ .Values.countryconfig.port }}
     middlewares:
       - name: block-internal-routes
-  - match: 'Host(`countryconfig.{{ .Values.hostname }}`) && Path(`/dashboards/queries.json`)'
+  - match: 'Host(`{{ include "render-external-subdomain" (dict "service_name" "countryconfig" "Values" .Values) }}`) && Path(`/dashboards/queries.json`)'
     kind: Rule
     services:
     - name: countryconfig
diff --git a/charts/opencrvs-services/templates/dashboards-deployment.yaml b/charts/opencrvs-services/templates/dashboards-deployment.yaml
index 37189271..68f12bb8 100644
--- a/charts/opencrvs-services/templates/dashboards-deployment.yaml
+++ b/charts/opencrvs-services/templates/dashboards-deployment.yaml
@@ -15,7 +15,7 @@ spec:
     - web
   {{- end }}
   routes:
-  - match: 'Host(`metabase.{{ .Values.hostname }}`)'
+  - match: 'Host(`{{ include "render-external-subdomain" (dict "service_name" "metabase" "Values" .Values) }}`)'
     kind: Rule
     services:
     - name: dashboards
diff --git a/charts/opencrvs-services/templates/events-deployment.yaml b/charts/opencrvs-services/templates/events-deployment.yaml
index f778975c..649e2070 100644
--- a/charts/opencrvs-services/templates/events-deployment.yaml
+++ b/charts/opencrvs-services/templates/events-deployment.yaml
@@ -12,7 +12,7 @@ spec:
     - web
   {{- end }}
   routes:
-  - match: 'Host(`events.{{ .Values.hostname }}`)'
+  - match: 'Host(`{{ include "render-external-subdomain" (dict "service_name" "events" "Values" .Values) }}`)'
     kind: Rule
     services:
     - name: events
diff --git a/charts/opencrvs-services/templates/gateway-deployment.yaml b/charts/opencrvs-services/templates/gateway-deployment.yaml
index 14106621..37263af3 100644
--- a/charts/opencrvs-services/templates/gateway-deployment.yaml
+++ b/charts/opencrvs-services/templates/gateway-deployment.yaml
@@ -12,7 +12,7 @@ spec:
     - web
   {{- end }}
   routes:
-  - match: 'Host(`gateway.{{ .Values.hostname }}`)'
+  - match: 'Host(`{{ include "render-external-subdomain" (dict "service_name" "gateway" "Values" .Values) }}`)'
     kind: Rule
     services:
     - name: gateway
diff --git a/charts/opencrvs-services/templates/login-deployment.yaml b/charts/opencrvs-services/templates/login-deployment.yaml
index c4cdfd76..7a2dedde 100644
--- a/charts/opencrvs-services/templates/login-deployment.yaml
+++ b/charts/opencrvs-services/templates/login-deployment.yaml
@@ -12,7 +12,7 @@ spec:
     - web
   {{- end }}
   routes:
-  - match: 'Host(`login.{{ .Values.hostname }}`) || Host(`{{ .Values.hostname }}`)'
+  - match: 'Host(`{{ include "render-external-subdomain" (dict "service_name" "login" "Values" .Values) }}`) || Host(`{{ .Values.hostname }}`)'
     kind: Rule
     services:
     - name: login
diff --git a/charts/opencrvs-services/templates/webhooks-deployment.yaml b/charts/opencrvs-services/templates/webhooks-deployment.yaml
index f102686f..679e9b74 100644
--- a/charts/opencrvs-services/templates/webhooks-deployment.yaml
+++ b/charts/opencrvs-services/templates/webhooks-deployment.yaml
@@ -12,7 +12,7 @@ spec:
     - web
   {{- end }}
   routes:
-  - match: 'Host(`webhooks.{{ .Values.hostname }}`)'
+  - match: 'Host(`{{ include "render-external-subdomain" (dict "service_name" "webhooks" "Values" .Values) }}`)'
     kind: Rule
     services:
     - name: webhooks
diff --git a/charts/opencrvs-services/values.yaml b/charts/opencrvs-services/values.yaml
index 2c2e76b7..1c9f4f3d 100644
--- a/charts/opencrvs-services/values.yaml
+++ b/charts/opencrvs-services/values.yaml
@@ -169,6 +169,17 @@ postgres:
 # All OpenCRVS services will be available under domain:
 hostname: opencrvs.localhost
 
+# subdomain_separator: separator between hostname and subdomains
+# generic form: <subdomain><subdomain_separator><hostname>
+# OpenCRVS can be deployed in different ways:
+# - as set of subdomains to hostname, examples:
+#            - auth.opencrvs.localhost
+#            - register.opencrvs.localhost
+# - as set of variations to main domain, 
+#   in this variant wildcard certificate is needed only to one domain, examples:
+#            - auth-opencrvs.localhost
+#            - register-opencrvs.localhost
+subdomain_separator: "."
 
 ingress:
   # Access OpenCRVS services at https://<hostname>/