# Vault connection
vault_addr: "http://VAULT_IP:VAULT_PORT"

# Directory paths
haproxy_certs_dir: "/etc/haproxy/certs"
haproxy_cert_path: "{{ haproxy_pem_path }}"
haproxy_pem_path: "{{ haproxy_certs_dir }}/haproxy.pem"
haproxy_ca_path: "{{ haproxy_certs_dir }}/haproxy_ca.crt"

# Systemd service names
haproxy_service: "haproxy"

# HAProxy tuning
haproxy_global_maxconn: 4096
haproxy_timeout_connect_ms: 5000
haproxy_timeout_client_ms: 60000
haproxy_timeout_server_ms: 60000
haproxy_enable_hsts: true

vault_agent_templates:
  - src: "haproxy.pem.ctmpl"
    dest: "{{ haproxy_pem_path }}"
    service: "haproxy"
  - src: "haproxy_ca.ctmpl"
    dest: "{{ haproxy_ca_path }}"
    service: "haproxy"

# === Services routed internally through HAProxy ===
securemtls_services:
  vault:
    hostname: vault.local.DOMAIN_PLACEHOLDER
    balance: roundrobin
    mode: http
    timeout_connect: 5s
    timeout_server: 30s
    default_server_inter: 3s
    default_server_rise: 2
    default_server_fall: 3
    backend_servers:
      - address: VAULT_IP
        port: VAULT_PORT
        proto: http
    headers:
      - "http-request set-header Host vault.local.DOMAIN_PLACEHOLDER"
      - "http-request set-header X-Forwarded-Proto https"
    rewrites:
      - "http-response replace-header Location ^http://VAULT_IP:VAULT_PORT/(.*) https://vault.local.DOMAIN_PLACEHOLDER/\\1"

  technitium:
    hostname: "technitium.local.DOMAIN_PLACEHOLDER"
    backend_mode: http
    backend_servers:
      - address: TECHNITIUM_IP
        port: TECHNITIUM_PORT
        proto: "http"