# ==============================================================================
# EXAMPLE: Multiple Plugins Combined
# ==============================================================================
#
# WHAT THIS DEMONSTRATES:
# - Using multiple security plugins together
# - Different plugin combinations for different services
# - Cloudflare + path blocking for public sites
# - JWT validation + path blocking for APIs
# - IP whitelist for admin panels
# - Layered security approach
#
# REQUIREMENTS (run these first):
# ```bash
# # Generate SSL certificates and JWT keys (from project root)
# cd ../.. && ./tests_e2e/generate-keys.sh && cd tests_e2e/docker
#
# # Download Cloudflare IPs (idempotent - overwrites if exists)
# curl -s https://www.cloudflare.com/ips-v4 > cloudflare_ips.lst
# echo "" >> cloudflare_ips.lst
# curl -s https://www.cloudflare.com/ips-v6 >> cloudflare_ips.lst
#
#
# HOW TO START:
# ```bash
# docker compose -f docker-compose-plugins-combined.yml up -d
# ```
#
# HOW TO VERIFY IT'S WORKING:
# ```bash
# # Test public website (Cloudflare + path blocking)
# curl -k -H "Host: website.local"  http://127.0.0.1/
# # Expected: 200 OK
# curl -k -H "Host: website.local"  http://127.0.0.1/admin
# # Expected: HTTP 404 - Path blocked
#
# # Test protected API (JWT required)
# curl -k -H "Host: api.local"  http://127.0.0.1/
# # Expected: HTTP 403 - Missing Authorization header
# # Generate JWT at https://jwt.io (see jwt-validator example for details)
# TOKEN="eyJhbGc..."  # Replace with your token
# curl -H "Host: api.local" -H "Authorization: Bearer $TOKEN" http://127.0.0.1/
# # Expected: 200 OK
#
# # Test admin panel (IP whitelist)
# curl -k -H "Host: admin.local"  http://127.0.0.1/
# # Expected: 200 OK from localhost
#
# # View HAProxy stats
# # URL: http://localhost:1936
# # Username: admin
# # Password: password
# # You should see 3 backends with different security configurations
# ```
#
# CLEAN UP:
# ```bash
# docker compose -f docker-compose-plugins-combined.yml down
# ```
#
# ==============================================================================

services:
  haproxy:
    build:
      context: ../../
      dockerfile: build/Dockerfile
    image: byjg/easy-haproxy:local
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./cloudflare_ips.lst:/etc/haproxy/cloudflare_ips.lst:ro
      - ./jwt_pubkey.pem:/etc/haproxy/jwt_keys/api_pubkey.pem:ro
    environment:
      EASYHAPROXY_DISCOVER: docker
      HAPROXY_CUSTOMERRORS: "true"
      HAPROXY_USERNAME: admin
      HAPROXY_PASSWORD: password
      HAPROXY_STATS_PORT: 1936
    ports:
      - "80:80/tcp"
      - "1936:1936/tcp"

  # Public website with Cloudflare + path blocking
  website:
    image: byjg/static-httpserver
    environment:
      TITLE: "Public Website"
    labels:
      easyhaproxy.http.host: website.local
      easyhaproxy.http.port: 80
      easyhaproxy.http.localport: 8080

      # Combine Cloudflare IP restoration + deny pages
      easyhaproxy.http.plugins: cloudflare,deny_pages

      # Block admin paths, config files, etc.
      easyhaproxy.http.plugin.deny_pages.paths: /admin,/wp-admin,/wp-login.php,/.env,/config
      easyhaproxy.http.plugin.deny_pages.status_code: 404

  # Protected API with JWT validation + path blocking
  api:
    image: byjg/static-httpserver
    environment:
      TITLE: "Protected API"
    labels:
      easyhaproxy.http.host: api.local
      easyhaproxy.http.port: 80
      easyhaproxy.http.localport: 8080

      # JWT validation + block internal endpoints
      easyhaproxy.http.plugins: jwt_validator,deny_pages

      # JWT configuration
      easyhaproxy.http.plugin.jwt_validator.algorithm: RS256
      easyhaproxy.http.plugin.jwt_validator.issuer: https://auth.example.com/
      easyhaproxy.http.plugin.jwt_validator.audience: https://api.example.com
      easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem

      # Block internal/debug endpoints
      easyhaproxy.http.plugin.deny_pages.paths: /internal,/debug,/metrics
      easyhaproxy.http.plugin.deny_pages.status_code: 403

  # Admin panel with strict IP restrictions
  admin:
    image: byjg/static-httpserver
    environment:
      TITLE: "Admin Panel"
    labels:
      easyhaproxy.http.host: admin.local
      easyhaproxy.http.port: 80
      easyhaproxy.http.localport: 8080

      # IP whitelist only (strictest security)
      easyhaproxy.http.plugins: ip_whitelist

      # Only allow local and private networks (including Docker bridge)
      easyhaproxy.http.plugin.ip_whitelist.allowed_ips: 127.0.0.1,192.168.0.0/16,10.0.0.0/8,172.16.0.0/12
      easyhaproxy.http.plugin.ip_whitelist.status_code: 403