traefik

type Adapter struct {
	// contains filtered or unexported fields
}

type Config struct {
	// Managed means Pando runs Traefik itself (R-174): the default. False is
	// a Traefik somebody else runs, which Pando only writes route files for —
	// an install that already has Traefik on :80 and :443 for other things.
	// A pointer so an unset value is the default rather than false.
	Managed *bool `json:"managed,omitempty"`

	// Delivery is how routes reach Traefik: shared_mount, files in Dir, which
	// Traefik mounts (Docker, the default); or kubernetes_api, IngressRoute
	// objects in Namespace (the Kubernetes runtime, kubernetes.go). Core says
	// which the runtime offers, and Edge refuses a mismatch.
	Delivery string `json:"delivery,omitempty"`

	// Namespace holds the IngressRoutes, with delivery kubernetes_api.
	Namespace string `json:"namespace,omitempty"`

	// Kubeconfig connects to the cluster from outside it, with delivery
	// kubernetes_api. Empty is the cluster Pando runs in.
	Kubeconfig string `json:"kubeconfig,omitempty"`

	// APIQPS and APIBurst limit the requests a second made to the cluster's
	// API with delivery kubernetes_api, and how many may be made at once
	// above that. Unset, client-go allows 5 and 10.
	APIQPS   int `json:"api_qps,omitempty"`
	APIBurst int `json:"api_burst,omitempty"`

	// Dir is the directory Traefik's file provider watches. Pando writes one
	// file per app here and Traefik picks them up; there is no API call and no
	// reload signal.
	Dir string `json:"dir"`

	// BaseDomain is what a subdomain app's hostname is carved out of, when the
	// route request does not carry one.
	BaseDomain string `json:"base_domain,omitempty"`

	// For a Traefik somebody else runs: the entrypoint routers attach to and
	// the ACME resolver it has configured. Empty CertResolver means Pando asks
	// for no certificate and Traefik serves whatever it already has — the
	// honest behavior when issuance is the edge's business (O-5). A Traefik
	// Pando runs has its own entrypoints and resolver, and ignores both.
	EntryPoint   string `json:"entrypoint,omitempty"`
	CertResolver string `json:"cert_resolver,omitempty"`

	// Image is the Traefik image. Pinned by Pando's release; set to override.
	Image string `json:"image,omitempty"`

	// HTTPPort and HTTPSPort are the host ports Traefik takes.
	HTTPPort  int `json:"http_port,omitempty"`
	HTTPSPort int `json:"https_port,omitempty"`

	// ConsoleHostname is the hostname the console is served on over HTTPS.
	// Every hostname that is not an app's reaches the console anyway; this is
	// the one a certificate is asked for on its behalf.
	ConsoleHostname string `json:"console_hostname,omitempty"`

	// Certificates is how Traefik gets them (R-169): "http" (HTTP-01, per
	// hostname), "dns" (DNS-01, a wildcard for the base domain), or "none".
	// Neither challenge is a silent default: none serves plain HTTP on :80,
	// and the adapter says so.
	Certificates string `json:"certificates,omitempty"`

	// ACMEEmail is the address Let's Encrypt registers the account to.
	ACMEEmail string `json:"acme_email,omitempty"`

	// DNSProvider is the DNS-01 provider's code, as Traefik names it.
	DNSProvider string `json:"dns_provider,omitempty"`

	// Credentials arrive from encrypted storage (R-190), never from config.
	Credentials struct {
		// DNS is the provider's credentials as KEY=value lines, one per line.
		DNS string `json:"dns_credentials,omitempty"`
	} `json:"credentials,omitempty"`
}