auxiliaryfiles

type CRTListFile struct {
	// Path is the absolute file path to the crt-list file.
	// Example: "/etc/haproxy/crt-lists/crt-list.txt"
	Path string

	// Content is the crt-list file contents (one certificate entry per line).
	// Format: <cert-path> [ssl-options] [sni-filter]
	// Example: "/etc/haproxy/ssl/cert.pem [ocsp-update on] example.com"
	Content string `json:"-"`
}

type FileItem interface {
	// GetIdentifier returns the path or filename the file is stored under.
	GetIdentifier() string

	// GetContent returns the file content.
	GetContent() string
}

type GeneralFile struct {
	// Filename is the base file name (used as API 'id').
	// Example: "400.http"
	Filename string

	// Path is the absolute file path where the file is stored.
	// This is computed from the configured GeneralStorageDir + Filename.
	// Example: "/etc/haproxy/general/400.http"
	Path string

	// Content is the file contents as a string. This maps to the 'file' field in
	// multipart parts of an apply.
	// json:"-" on every aux Content keeps key material out of /debug/vars; the
	// tls-ticket-keys STEK file is a general file, so this is not SSL-only.
	Content string `json:"-"`

	// IsCaFile marks this general file as an SSL CA / trust bundle referenced by
	// the config as `ca-file <path>` (frontend client-cert verify or backend mTLS
	// server verify). When set, a CONTENT-only update can be applied to the live
	// worker via the runtime API (`add ssl ca-file` + commit, which replaces the
	// file with the payload) without a reload — it is what makes the plan file
	// kind `ca` rather than `general`. Metadata only: GetContent (used for
	// diffing) ignores it, so it never causes a spurious diff against the
	// content-keyed current state.
	IsCaFile bool

	// ReloadOnPush carries the CRD's files[].reloadOnPush (or the 4th argument
	// to fileRegistry.Register). Nil — the zero value — means true, so a file
	// built without thinking about this flag keeps reloading. Read it through
	// ReloadsOnPush. Metadata only: GetContent ignores it, so it never causes a
	// spurious diff against the content-keyed current state.
	ReloadOnPush *bool
}

type MapFile struct {
	// Path is the absolute file path to the map file.
	// Example: "/etc/haproxy/maps/domains.map"
	Path string

	// Content is the map file contents (one key-value pair per line).
	Content string `json:"-"`
}

type SSLCaFile struct {
	// Path is the file path or name of the CA file.
	// Example: "ca-bundle.pem" or "/etc/haproxy/ssl/ca/trusted-cas.pem"
	Path string

	// Content is the PEM-encoded CA certificate data.
	// Can contain multiple CA certificates concatenated together.
	Content string `json:"-"`
}

type SSLCertificate struct {
	// Path is the absolute file path to the certificate.
	// Example: "/etc/haproxy/certs/example.com.pem"
	Path string

	// Content is the PEM-encoded certificate and key data.
	Content string `json:"-"`
}

type SecretFile struct {
	// Path is the plan path, e.g. "secrets/sso.client-secret".
	Path string

	Content string `json:"-"`

	// Seal is SealContent of Content. Every identity a reader without Secret
	// access can see hashes the seal, never the content.
	Seal string
}