---
# In order to effectively use this file you must familiarize youself with the
# the stucture of the config.xml structure of the HAProxy in pfSense.  Most of
# the values are just directly passed through.
apiVersion: v1
kind: ConfigMap
metadata:
  namespace: networking
  name: declarative-example
  labels:
    pfsense.org/type: declarative
data:
  data: |
    # Example with most arguments
    # resources:
    #   - type: backend
    #     ha_servers:
    #       # declare dynamic nodes by using the backing service
    #       - type: node-service
    #         # serviceNamespace: optional, uses namespace of the ConfigMap by default
    #         # service must be type NodePort or LoadBalancer
    #         serviceName: traefik-ingress-service
    #         servicePort: 80
    #         # pass through directly to mimic config.xml structure
    #         definition:
    #           status: active
    #           forwardto:
    #           ssl:
    #           weight:
    #           sslserververify:
    #           verifyhost:
    #           ssl-server-ca:
    #           ssl-server-crl:
    #           ssl-server-clientcert:
    #           cookie:
    #           maxconn:
    #           advanced:
    #       # declare static nodes
    #       - type: node-static
    #         # pass through directly to mimic config.xml structure
    #         definition:
    #           status: active
    #           name: node04
    #           address: 172.29.2.14
    #           port: 80
    #           forwardto:
    #           ssl:
    #           weight:
    #           sslserververify:
    #           verifyhost:
    #           ssl-server-ca:
    #           ssl-server-crl:
    #           ssl-server-clientcert:
    #           cookie:
    #           maxconn:
    #           advanced:
    #     # pass through directly to mimic config.xml structure
    #     definition:
    #       a_acl:
    #       a_actionitems:
    #       advanced:
    #       advanced_backend:
    #       name: traefik
    #       balance: leastconn
    #       balance_urilen:
    #       balance_uridepth:
    #       balance_uriwhole:
    #       transparent_clientip:
    #       transparent_interface:
    #       check_type: Basic
    #       checkinter:
    #       log-health-checks:
    #       httpcheck_method:
    #       monitor_uri:
    #       monitor_httpversion:
    #       monitor_username:
    #       monitor_domain:
    #       monitor_agentport:
    #       agent_check:
    #       agent_port:
    #       agent_inter:
    #       connection_timeout:
    #       server_timeout: 10800000
    #       retries:
    #       stats_enabled:
    #       stats_username:
    #       stats_password:
    #       stats_uri:
    #       stats_scope:
    #       stats_realm:
    #       stats_admin:
    #       stats_node:
    #       stats_desc:
    #       stats_refresh:
    #       persist_stick_expire:
    #       persist_stick_tablesize:
    #       persist_stick_length:
    #       persist_stick_cookiename:
    #       persist_sticky_type: none
    #       persist_cookie_enabled:
    #       persist_cookie_name:
    #       persist_cookie_mode: passive
    #       persist_cookie_cachable:
    #       strict_transport_security:
    #       cookie_attribute_secure:
    #       email_level:
    #       email_to:
    #       errorfiles:
    #   - type: frontend
    #     # pass through directly to mimic config.xml structure
    #     # many more options available, review your config.xml for more detail
    #     definition:
    #       name: some-frontend-name
    #       type: http
    #       forwardfor: yes
    #       status: active
    #       backend_serverpool: some-backend-name
    #       a_extaddr:
    #         item:
    #           - extaddr: wan_ipv4
    #             extaddr_port: 443
    #             extaddr_ssl: yes
    resources:
      - files:
        item:
          - name: k8s-maintenance
            content: SFRUUC8xLjAgNTAzIE1haW50ZW5hbmNlDQpDYWNoZS1Db250cm9sOiBuby1jYWNoZQ0KQ29ubmVjdGlvbjogY2xvc2UNCkNvbnRlbnQtVHlwZTogdGV4dC9odG1sDQpSZXRyeS1BZnRlcjogMzANCg0KPCFkb2N0eXBlIGh0bWw+DQo8dGl0bGU+U2VydmljZSBNYWludGVuYW5jZTwvdGl0bGU+DQo8c3R5bGU+DQogIGJvZHkgeyB0ZXh0LWFsaWduOiBjZW50ZXI7IHBhZGRpbmc6IDIwcHg7IH0NCiAgQG1lZGlhIChtaW4td2lkdGg6IDc2OHB4KXsNCiAgICBib2R5eyBwYWRkaW5nLXRvcDogMTUwcHg7IH0NCiAgfQ0KICBoMSB7IGZvbnQtc2l6ZTogNTBweDsgfQ0KICBib2R5IHsgZm9udDogMjBweCBIZWx2ZXRpY2EsIHNhbnMtc2VyaWY7IGNvbG9yOiAjMzMzOyB9DQogIGFydGljbGUgeyBkaXNwbGF5OiBibG9jazsgdGV4dC1hbGlnbjogbGVmdDsgbWF4LXdpZHRoOiA2NTBweDsgbWFyZ2luOiAwIGF1dG87IH0NCiAgYSB7IGNvbG9yOiAjZGM4MTAwOyB0ZXh0LWRlY29yYXRpb246IG5vbmU7IH0NCiAgYTpob3ZlciB7IGNvbG9yOiAjMzMzOyB0ZXh0LWRlY29yYXRpb246IG5vbmU7IH0NCjwvc3R5bGU+DQoNCjxhcnRpY2xlPg0KICAgIDxoMT5XZSZyc3F1bztsbCBiZSBiYWNrIHNvb24hPC9oMT4NCiAgICA8ZGl2Pg0KICAgICAgICA8cD5Tb3JyeSBmb3IgdGhlIGluY29udmVuaWVuY2UgYnV0IHdlJnJzcXVvO3JlIHBlcmZvcm1pbmcgc29tZSBtYWludGVuYW5jZSBhdCB0aGUgbW9tZW50LiBXZSZyc3F1bztsbCBiZSBiYWNrIG9ubGluZSBzaG9ydGx5ITwvcD4NCiAgICAgICAgPHA+Jm1kYXNoOyBUaGUgSzhTIFRlYW08L3A+DQogICAgPC9kaXY+DQo8L2FydGljbGU+
      - type: backend
        definition:
          name: traefik-443
          monitor_uri: /healthz
          httpcheck_method: HEAD
          check_type: HTTP
          checkinter: 5000
          log-health-checks:
          # monitor_httpversion: HTTP/1.1\r\nHost:\ www.froberg.org
          connection_timeout: 240000
          server_timeout: 240000
          errorfiles:
            item:
              - errorcode: 503
                errorfile: k8s-maintenance  # Needs to be predefined
        ha_servers:
          # declare dynamic nodes by using the backing service
          - type: node-service
            # serviceNamespace: optional, uses namespace of the ConfigMap by default
            # service must be type NodePort or LoadBalancer
            serviceNamespace: networking
            serviceName: traefik
            servicePort: 443
            definition:
              name: traefik-ingeress-443-100
              status: active
              ssl: yes
              checkssl: yes
      - type: backend
        definition:
          name: traefik-80
          monitor_uri: /healthz
          httpcheck_method: HEAD
          check_type: HTTP
          checkinter: 5000
          log-health-checks:
          # monitor_httpversion: HTTP/1.1\r\nHost:\ www.froberg.org
          connection_timeout: 240000
          server_timeout: 240000
          errorfiles:
            item:
              - errorcode: 503
                errorfile: k8s-maintenance  # Needs to be predefined
        ha_servers:
          # declare dynamic nodes by using the backing service
          - type: node-service
            # serviceNamespace: optional, uses namespace of the ConfigMap by default
            # service must be type NodePort or LoadBalancer
            serviceNamespace: networking
            serviceName: traefik
            servicePort: 80
            definition:
              name: traefik-ingeress-80-100
              status: active
      - type: frontend
        definition:
          name: https-443
          type: tcp
          status: active
          dcertadv: no-tlsv10 no-sslv3 no-tls-tickets
          ssl_crtlist_advanced: alpn h2,http/1.1
          backend_serverpool: traefik-443
          a_extaddr:
            item:
              - extaddr: wan_ipv4
                extaddr_port: 443
                extaddr_ssl: yes
      - type: frontend
        definition:
          name: http-80
          type: http
          status: active
          backend_serverpool: traefik-80
          a_extaddr:
            item:
              - extaddr: wan_ipv4
                extaddr_port: 80
