# ==============================================================================
# EXAMPLE: IP Whitelist Plugin
# ==============================================================================
#
# WHAT THIS DEMONSTRATES:
# - Restricting access to specific IP addresses or CIDR ranges
# - Single IP, CIDR notation, and multiple IP support
# - Custom HTTP status code for blocked requests
# - Admin panel or sensitive application protection
#
# # IMPORTANT: Update the easyhaproxy.http.plugin.ip_whitelist.allowed_ips with your actual IPs!
# # Default allows localhost and private networks for testing
# ```
#
# HOW TO START:
# ```bash
# docker compose -f docker-compose-ip-whitelist.yml up -d
# ```
#
# HOW TO VERIFY IT'S WORKING:
# ```bash
# # Test from localhost (127.0.0.1 is whitelisted)
# curl -k -H "Host: admin.local" http://127.0.0.1/
# # Expected: 200 OK - Access granted
#
# # Test from non-whitelisted IP
# # You'll need to test from another machine or temporarily remove your IP
# # from the allowed_ips list to see the 403 Forbidden response
#
# # View HAProxy stats to see blocked requests
# # URL: http://localhost:1936
# # Username: admin
# # Password: password
# ```
#
# CLEAN UP:
# ```bash
# docker compose -f docker-compose-ip-whitelist.yml down
# ```
#
# ==============================================================================

services:
  haproxy:
    build:
      context: ../../
      dockerfile: build/Dockerfile
    image: byjg/easy-haproxy:local
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    healthcheck:
      test: ["CMD", "curl", "-f", "-u", "admin:password", "http://localhost:1936"]
      interval: 10s
      timeout: 5s
      start_period: 30s
      retries: 3
    environment:
      EASYHAPROXY_DISCOVER: docker
      HAPROXY_CUSTOMERRORS: "true"
      HAPROXY_USERNAME: admin
      HAPROXY_PASSWORD: password
      HAPROXY_STATS_PORT: 1936
    ports:
      - "80:80/tcp"
      - "1936:1936/tcp"

  # Admin panel with IP whitelist
  admin:
    image: byjg/static-httpserver
    environment:
      TITLE: "Admin Panel - IP Restricted"
    labels:
      easyhaproxy.http.host: admin.local
      easyhaproxy.http.port: 80
      easyhaproxy.http.localport: 8080

      # Enable IP whitelist plugin
      easyhaproxy.http.plugins: ip_whitelist

      # Allow localhost and private networks
      # UPDATE THIS with your actual IPs/networks!
      easyhaproxy.http.plugin.ip_whitelist.allowed_ips: 127.0.0.1,192.168.0.0/16,10.0.0.0/8,172.16.0.0/12

      # Status code to return for blocked IPs
      easyhaproxy.http.plugin.ip_whitelist.status_code: 403