apiVersion: v1
kind: ConfigMap
metadata:
  namespace: networking
  name: kubernetes-pfsense-controller-config
data:
  config: |
    controller-id: "lab-cluster"
    enabled: true
    pfsense:
      url: ${PFSENSE_URL}
      insecure: ${PFSENSE_INSECURE}
      username: ${PFSENSE_USERNAME}
      password: ${PFSENSE_PASSWORD}
    plugins:
      metallb:
        enabled: true
        nodeLabelSelector:
        nodeFieldSelector:
        configMap: "metallb-system/config"
        # pick 1 implementation
        #bgp-implementation: openbgp
        # bgp-implementation: frr
        #options:
        #  openbgp:
        #    # pass through to config.xml
        #    template:
        #      md5sigkey:
        #      md5sigpass:
        #      groupname: metallb
        #      row:
        #        - parameters: announce all
        #          parmvalue:
        #  frr:
        #    template:
        #      peergroup: metallb
      haproxy-declarative:
        enabled: true
      haproxy-ingress-proxy:
        enabled: true
        ingressLabelSelector:
        ingressFieldSelector:
        # works in conjunction with the ingress annotation 'haproxy-ingress-proxy.pfsense.org/enabled'
        # if defaultEnabled is empty or true, you can disable specific ingresses by setting the annotation to false
        # if defaultEnabled is false, you can enable specific ingresses by setting the annotation to true
        defaultEnabled: false
        defaultFrontend: https-443
        defaultBackend: traefik-443
        # by default anything is allowed
        # allowedHostRegex: "/.${SECRET_DOMAIN}$$/"
      pfsense-dns-services:
        enabled: true
        serviceLabelSelector:
        serviceFieldSelector:
        allowedHostRegex: "/.${SECRET_DOMAIN}$$/"
        dnsBackends:
          dnsmasq:
            enabled: false
          unbound:
            enabled: true
      pfsense-dns-ingresses:
        enabled: true
        ingressLabelSelector:
        ingressFieldSelector:
        # works in conjunction with the ingress annotation 'dns.pfsense.org/enabled'
        # if defaultEnabled is empty or true, you can disable specific ingresses by setting the annotation to false
        # if defaultEnabled is false, you can enable specific ingresses by setting the annotation to true
        defaultEnabled: true
        allowedHostRegex: "/.${SECRET_DOMAIN}$$/"
        dnsBackends:
          dnsmasq:
            enabled: false
          unbound:
            enabled: true
      pfsense-dns-haproxy-ingress-proxy:
        enabled: false
        allowedHostRegex: "/.${SECRET_DOMAIN}$$/"
        dnsBackends:
          dnsmasq:
            enabled: false
          unbound:
            enabled: true
        frontends:
          http-80:
            hostname: http-80.k8s
          https-443:
            hostname: https-443.k8s