tunnel

type AdoptTunnelOptions struct {
	// TunnelID is the ID of the tunnel to adopt
	TunnelID string
	// TunnelName is the expected tunnel name
	TunnelName string
	// AccountID is the Cloudflare account ID
	AccountID string
	// Source identifies the K8s resource
	Source service.Source
	// CredentialsRef references the CloudflareCredentials to use
	CredentialsRef v1alpha2.CredentialsReference
}

type CreateTunnelOptions struct {
	// TunnelName is the name of the tunnel to create
	TunnelName string
	// AccountID is the Cloudflare account ID
	AccountID string
	// ConfigSrc specifies the configuration source
	ConfigSrc string
	// Source identifies the K8s resource
	Source service.Source
	// CredentialsRef references the CloudflareCredentials to use
	CredentialsRef v1alpha2.CredentialsReference
}

type DeleteTunnelOptions struct {
	// TunnelID is the ID of the tunnel to delete
	TunnelID string
	// TunnelName is the name of the tunnel (for SyncState naming)
	TunnelName string
	// AccountID is the Cloudflare account ID
	AccountID string
	// Source identifies the K8s resource
	Source service.Source
	// CredentialsRef references the CloudflareCredentials to use
	CredentialsRef v1alpha2.CredentialsReference
	// CleanupRoutes indicates whether to delete associated routes
	CleanupRoutes bool
}

type IngressRule struct {
	// Hostname is the public hostname for this rule (e.g., "app.example.com")
	Hostname string `json:"hostname,omitempty"`
	// Path is the URL path to match (e.g., "/api/*")
	Path string `json:"path,omitempty"`
	// Service is the backend service URL (e.g., "http://svc.ns.svc:80")
	Service string `json:"service"`
	// OriginRequest contains optional origin request configuration
	OriginRequest *OriginRequestConfig `json:"originRequest,omitempty"`
}

type LifecycleAction string

type LifecycleConfig struct {
	// Action is the lifecycle operation to perform
	Action LifecycleAction `json:"action"`

	// TunnelName is the name of the tunnel (required for create/adopt)
	TunnelName string `json:"tunnelName,omitempty"`

	// TunnelID is the existing tunnel ID (required for delete/adopt)
	TunnelID string `json:"tunnelId,omitempty"`

	// ConfigSrc specifies the configuration source (local/cloudflare)
	// If "cloudflare", the tunnel uses remotely managed config
	ConfigSrc string `json:"configSrc,omitempty"`

	// ExistingTunnelID is the tunnel ID to adopt (for adopt action)
	ExistingTunnelID string `json:"existingTunnelId,omitempty"`
}

type LifecycleResult struct {
	// TunnelID is the Cloudflare tunnel ID
	TunnelID string `json:"tunnelId"`

	// TunnelName is the tunnel name
	TunnelName string `json:"tunnelName"`

	// TunnelToken is the token used by cloudflared to authenticate
	TunnelToken string `json:"tunnelToken,omitempty"`

	// Credentials is the base64-encoded tunnel credentials JSON
	Credentials string `json:"credentials,omitempty"`

	// AccountTag is the Cloudflare account tag (from credentials)
	AccountTag string `json:"accountTag,omitempty"`
}

type LifecycleService struct {
	*service.BaseService
}

type OriginRequestConfig struct {
	// ConnectTimeout is the timeout for establishing a connection to origin
	ConnectTimeout *time.Duration `json:"connectTimeout,omitempty"`
	// TLSTimeout is the timeout for TLS handshake with origin
	TLSTimeout *time.Duration `json:"tlsTimeout,omitempty"`
	// TCPKeepAlive is the TCP keepalive interval
	TCPKeepAlive *time.Duration `json:"tcpKeepAlive,omitempty"`
	// NoHappyEyeballs disables Happy Eyeballs for IPv4/v6 fallback
	NoHappyEyeballs *bool `json:"noHappyEyeballs,omitempty"`
	// KeepAliveConnections is the max number of idle connections to keep open
	KeepAliveConnections *int `json:"keepAliveConnections,omitempty"`
	// KeepAliveTimeout is the timeout for idle connections
	KeepAliveTimeout *time.Duration `json:"keepAliveTimeout,omitempty"`
	// HTTPHostHeader overrides the Host header sent to origin
	HTTPHostHeader *string `json:"httpHostHeader,omitempty"`
	// OriginServerName overrides the hostname for TLS verification
	OriginServerName *string `json:"originServerName,omitempty"`
	// CAPool is the path to CA certificates for origin verification
	CAPool *string `json:"caPool,omitempty"`
	// NoTLSVerify disables TLS certificate verification for origin
	NoTLSVerify *bool `json:"noTlsVerify,omitempty"`
	// HTTP2Origin enables HTTP/2 to origin (requires HTTPS)
	HTTP2Origin *bool `json:"http2Origin,omitempty"`
	// DisableChunkedEncoding disables chunked transfer encoding
	DisableChunkedEncoding *bool `json:"disableChunkedEncoding,omitempty"`
	// BastionMode enables bastion/jump host mode
	BastionMode *bool `json:"bastionMode,omitempty"`
	// ProxyAddress is the address for SOCKS proxy
	ProxyAddress *string `json:"proxyAddress,omitempty"`
	// ProxyPort is the port for SOCKS proxy
	ProxyPort *uint `json:"proxyPort,omitempty"`
	// ProxyType is the proxy type (e.g., "socks")
	ProxyType *string `json:"proxyType,omitempty"`
}

type RegisterRulesOptions struct {
	// TunnelID is the Cloudflare tunnel ID
	TunnelID string
	// AccountID is the Cloudflare account ID
	AccountID string
	// Source identifies the K8s resource contributing this configuration
	Source service.Source
	// Rules contains the ingress rules
	Rules []IngressRule
	// Priority determines conflict resolution (lower = higher priority)
	Priority int
	// CredentialsRef references the CloudflareCredentials to use
	CredentialsRef v1alpha2.CredentialsReference
}

type RegisterSettingsOptions struct {
	// TunnelID is the Cloudflare tunnel ID
	TunnelID string
	// AccountID is the Cloudflare account ID
	AccountID string
	// Source identifies the K8s resource contributing this configuration
	Source service.Source
	// Settings contains the tunnel settings
	Settings TunnelSettings
	// CredentialsRef references the CloudflareCredentials to use
	CredentialsRef v1alpha2.CredentialsReference
}

type Service struct {
	*service.BaseService
}

type TunnelConfig struct {
	// Settings contains tunnel-level settings (only from Tunnel/ClusterTunnel)
	Settings *TunnelSettings `json:"settings,omitempty"`
	// Rules contains ingress rules (from Ingress, TunnelBinding, Gateway)
	Rules []IngressRule `json:"rules,omitempty"`
}

type TunnelSettings struct {
	// WarpRouting controls whether WARP routing is enabled
	WarpRouting *WarpRoutingConfig `json:"warpRouting,omitempty"`
	// FallbackTarget is the service URL for unmatched requests (e.g., "http_status:404")
	FallbackTarget string `json:"fallbackTarget,omitempty"`
	// GlobalOriginRequest contains global origin request settings
	GlobalOriginRequest *OriginRequestConfig `json:"globalOriginRequest,omitempty"`
}

type WarpRoutingConfig struct {
	// Enabled controls whether WARP routing is enabled
	Enabled bool `json:"enabled"`
}