# IP Whitelist Plugin Example for Docker Swarm
#
# This example demonstrates restricting access to specific IP addresses in Swarm
#
# Prerequisites:
# 1. Docker Swarm initialized:
#    docker swarm init
#
# 2. Create overlay network:
#    docker network create --driver overlay --attachable easyhaproxy
#
# 3. Update allowed_ips label with your actual IP addresses/networks
#
# 4. Deploy the stack:
#    docker stack deploy -c ip-whitelist.yml admin
#
# 5. Test from allowed IP:
#    curl http://<swarm-ip>/
#    # Response: Success (200 OK)
#
# 6. Test from non-allowed IP:
#    # Response: HTTP 403 Forbidden

version: "3.7"

services:
  haproxy:
    image: byjg/easy-haproxy:4.6.0
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.role == manager
    environment:
      EASYHAPROXY_DISCOVER: swarm
      HAPROXY_USERNAME: admin
      HAPROXY_PASSWORD: password
      HAPROXY_STATS_PORT: 1936
    ports:
      - "80:80/tcp"
      - "1936:1936/tcp"
    networks:
      - easyhaproxy

  # Admin panel with IP restrictions
  admin:
    image: byjg/static-httpserver
    environment:
      TITLE: "Admin Panel - IP Restricted"
    deploy:
      replicas: 3
      labels:
        easyhaproxy.http.host: "admin.example.com"
        easyhaproxy.http.port: "80"
        easyhaproxy.http.localport: "8080"

        # Enable IP whitelist plugin
        easyhaproxy.http.plugins: "ip_whitelist"

        # Allow specific IPs and networks
        # UPDATE THIS with your actual office/VPN IPs!
        easyhaproxy.http.plugin.ip_whitelist.allowed_ips: "203.0.113.0/24,198.51.100.0/24,10.0.0.0/8"

        # Status code to return for blocked IPs
        easyhaproxy.http.plugin.ip_whitelist.status_code: "403"
    networks:
      - easyhaproxy

networks:
  easyhaproxy:
    external: true