controller

type Config struct {
	// AccountID is the Cloudflare account ID. If empty, it will be auto-detected
	// from the API token (requires token to have access to exactly one account).
	AccountID string

	// TunnelID is the Cloudflare Tunnel ID (required).
	TunnelID string

	// APIToken is the Cloudflare API token with Tunnel permissions (required).
	APIToken string

	// ClusterDomain is the Kubernetes cluster domain for service DNS resolution.
	// Defaults to "cluster.local".
	ClusterDomain string

	// GatewayClassName is the name of the GatewayClass to watch.
	// Only Gateways referencing this class will be reconciled.
	GatewayClassName string

	// ControllerName is the controller name reported in GatewayClass status.
	ControllerName string

	// MetricsAddr is the address for the Prometheus metrics endpoint.
	MetricsAddr string

	// HealthAddr is the address for health and readiness probe endpoints.
	HealthAddr string

	// LeaderElect enables leader election for high availability.
	// Required when running multiple replicas.
	LeaderElect bool

	// LeaderElectNS is the namespace for the leader election lease.
	LeaderElectNS string

	// LeaderElectName is the name of the leader election lease.
	LeaderElectName string

	// ManageCloudflared enables automatic cloudflared deployment via Helm.
	ManageCloudflared bool

	// TunnelToken is the Cloudflare Tunnel token for remote-managed mode.
	// Required when ManageCloudflared is true.
	TunnelToken string

	// CloudflaredNS is the namespace for cloudflared deployment.
	CloudflaredNS string

	// CloudflaredProto is the transport protocol (auto, quic, http2).
	CloudflaredProto string

	// AWGSecretName is the secret containing AWG VPN configuration.
	// If set, enables AWG sidecar for cloudflared.
	AWGSecretName string

	// AWGInterfaceName is the AWG network interface name.
	AWGInterfaceName string
}

type GatewayReconciler struct {
	client.Client

	// Scheme is the runtime scheme for API type registration.
	Scheme *runtime.Scheme

	// GatewayClassName is the name of the GatewayClass to watch.
	GatewayClassName string

	// ControllerName is reported in Gateway status conditions.
	ControllerName string

	// TunnelID is the Cloudflare Tunnel ID, used for status address.
	TunnelID string

	// HelmManager handles cloudflared deployment. If nil, cloudflared
	// management is disabled and must be deployed separately.
	HelmManager *helm.Manager

	// TunnelToken is passed to cloudflared for tunnel authentication.
	TunnelToken string

	// CloudflaredNS is the namespace for cloudflared deployment.
	CloudflaredNS string

	// Protocol is the cloudflared transport protocol (auto, quic, http2).
	Protocol string

	// AWGSecretName enables AWG sidecar if set.
	AWGSecretName string

	// AWGInterfaceName is the AWG network interface name.
	AWGInterfaceName string
}

type HTTPRouteReconciler struct {
	client.Client

	// Scheme is the runtime scheme for API type registration.
	Scheme *runtime.Scheme

	// CFClient is the Cloudflare API client for tunnel configuration.
	CFClient *cloudflare.Client

	// AccountID is the Cloudflare account ID.
	AccountID string

	// TunnelID is the Cloudflare Tunnel ID to configure.
	TunnelID string

	// ClusterDomain is used for building service URLs (e.g., "cluster.local").
	ClusterDomain string

	// GatewayClassName filters which routes to process.
	GatewayClassName string

	// ControllerName is reported in HTTPRoute status.
	ControllerName string
}