# Certbot/Let's Encrypt Configuration Example
#
# Demonstrates:
# - Automatic SSL certificate generation with Let's Encrypt
# - HTTP to HTTPS redirect
# - Certificate renewal
#
# Prerequisites:
# 1. Public IP address with ports 80 and 443 accessible
# 2. DNS records pointing to your server:
#    example.com -> your-server-ip
#    www.example.com -> your-server-ip
#
# 3. Set environment variable:
#    EASYHAPROXY_CERTBOT_EMAIL=your-email@example.com
#
# 4. Mount this config:
#    -v ./conf/config-certbot.yml:/etc/haproxy/static/config.yml
#
# 5. Persist certificates:
#    -v ./certs/certbot:/certs/certbot
#
# How it works:
# - EasyHAProxy requests certificates from Let's Encrypt via HTTP-01 challenge
# - Certificates are stored in /certs/certbot/
# - Certificates auto-renew when needed
#
# Note: Let's Encrypt has rate limits. Use staging environment for testing:
#       EASYHAPROXY_CERTBOT_AUTOCONFIG=staging

stats:
  username: admin
  password: password
  port: 1936

customerrors: true

easymapping:
  # HTTP Port 80
  # Required for ACME HTTP-01 challenge and redirect
  - port: 80
    hosts:
      # Domain with certbot enabled
      example.com:
        containers:
          - webapp:8080
        # Enable certbot for this domain
        certbot: true
        # Redirect HTTP to HTTPS after cert is issued
        redirect_ssl: true

      # Additional domain with certbot
      app.example.com:
        containers:
          - app:3000
        certbot: true
        redirect_ssl: true

      # Domain without certbot (uses custom certificate)
      custom.example.com:
        containers:
          - custom-app:8080
        # No certbot - expects certificate at /certs/haproxy/custom.example.com.pem

  # HTTPS Port 443
  # Serves HTTPS traffic with auto-generated certificates
  - port: 443
    ssl: true
    hosts:
      example.com:
        containers:
          - webapp:8080
        # Certificate path (auto-generated by certbot)
        # /certs/certbot/example.com/fullchain.pem

      app.example.com:
        containers:
          - app:3000

      # Custom certificate example
      custom.example.com:
        containers:
          - custom-app:8080
        # Place your certificate at:
        # /certs/haproxy/custom.example.com.pem

# Multiple domains with different backends
# Certbot will request separate certificates for each domain