# Service Proxy Configuration Example
# This file demonstrates the configuration options for service-proxy.

server:
  addr: "0.0.0.0"
  port: 8080

metrics:
  enabled: false
  port: 8081
  path: /metrics

# Audit logging configuration
# Logs all proxy requests to a file for compliance and debugging
audit:
  enabled: true
  filePath: /var/log/audit.log
  bufferSize: 4096          # Write buffer size in bytes (default: 4096, max: 1048576)
  channelSize: 1000         # Async channel size (default: 1000, max: 100000)
  flushInterval: 5s         # Flush interval (default: 5s, min: 100ms, max: 1m)
  includeGetRequests: false # Default: false, exclude GET requests from audit logs
  maxBodySize: 256          # Maximum request body size to log; <= 0 disables request body logging.
  # sensitiveQueryParams: ["token", "apiKey"] # Additional query params to redact (merged with defaults)
  # sensitiveBodyFields: ["password"]        # Additional body fields to redact (merged with defaults)

clusterRoutes:
  - name: pd-api
    match:
      prefix: /pd
    backend:
      serviceNamePattern: "^db-[a-z0-9]+-pd$"
      scheme: https
      port: 2379
    tls:
      enabled: true
      secretRef:
        name: "db-cluster-client-secret"
    timeout: 30s

  - name: tibr-api
    # Path parameters in curly braces (e.g., {name}) match single path segments.
    # Example: /proxy/clusters/1/tibr/demo-tibr/api matches with name="demo-tibr"
    match:
      prefix: /tibr/{name}
    backend:
      # Template can reference path parameters to build dynamic service names
      serviceNameTemplate: "{name}-tibr-headless"
      scheme: https
      port: 19500
    tls:
      enabled: true
      insecureSkipVerify: true  # Use only for internal services with self-signed certificates
    timeout: 30s

  - name: dm-api
    # Example: /proxy/cluster/1/dm/2064540458686427136/api matches with id="2064540458686427136"
    match:
      prefix: /dm/{id}
    backend:
      serviceNameTemplate: "dbcluster-{id}-dm-master"
      scheme: https
      port: 8261
    tls:
      enabled: true
      secretRef:
        name: "db-cluster-client-secret"
    timeout: 30s

# Service routes - for arbitrary K8s services
# URL pattern: /proxy/services/{service}/namespaces/{namespace}/ports/{port}/*
#serviceRoutes:
#  - name: cluster-proxy
#    match:
#      prefix: /proxy-cluster-proxy
#    tls:
#      enabled: true
#      secretRef:
#        name: "custom-client-cert"
#    timeout: 60s