resolved

type AccessLog struct {
	Enabled bool
	Format  string // "json"
	Writer  io.Writer
	Name    string // human label for the writer

	// SampleRate is the fraction of successful requests to record, in (0,1].
	// Errors (status >= 500) and client errors (4xx) are logged regardless;
	// sampling only suppresses successful requests at high volume.
	SampleRate float64
}

type AutoTLS struct {
	Domains []string
	Email   string
	Storage string
	DNS01   *CloudflareDNS01
}

type Backend struct {
	Address string
	Weight  int
	Backup  bool
}

type CloudflareDNS01 struct {
	APIToken string
	ZoneID   string // optional; empty means auto-discover
}

type CompressAlgo int

type Config struct {
	Listeners     []*Listener
	Upstreams     map[string]*Pool
	Routes        []*Route
	Defaults      Defaults
	Observability Observability
	Shutdown      Shutdown
}

type Defaults struct {
	ReadHeaderTimeout time.Duration
	ReadTimeout       time.Duration
	WriteTimeout      time.Duration
	IdleTimeout       time.Duration
	MaxHeaderBytes    int
}

type HealthCheck struct {
	Enabled   bool
	Path      string
	Interval  time.Duration
	Timeout   time.Duration
	Healthy   int
	Unhealthy int
}

type Listener struct {
	Addr     string
	Scheme   string // "http" or "https"
	Redirect string // non-empty: this listener is a redirect-only listener

	AutoTLS     *AutoTLS   // nil unless this is an HTTPS listener with ACME
	StaticTLS   *StaticTLS // nil unless this is an HTTPS listener with static certs
	EnableHTTP2 bool
	HTTP3Addr   string // empty unless HTTP/3 is enabled

	// BehindCloudflare indicates the listener is fronted by Cloudflare. The
	// runtime suppresses TLS-ALPN-01 challenges (HTTP-01 only) and trusts
	// CF-Connecting-IP / True-Client-IP for client IP attribution.
	BehindCloudflare bool
}

type Metrics struct {
	Enabled bool
	Kind    string // "prometheus"
	Addr    string
	Path    string
}

type Middleware struct {
	Type MiddlewareType

	// Timeout
	Timeout time.Duration

	// RateLimit
	RateLimitPerSecond float64
	RateLimitKey       RateLimitKey

	// Retry
	RetryMax        int
	RetryOnStatuses []int

	// Cache
	CacheTTL time.Duration

	// Compress
	CompressAlgos []CompressAlgo

	// BodyLimit
	BodyLimitBytes int64

	// RequestID
	RequestIDHeader     string
	RequestIDFromHeader string

	// SecurityHeaders — each empty string means "do not emit this header".
	SecHSTS               string
	SecCSP                string
	SecFrameOptions       string
	SecContentTypeOptions bool
	SecReferrerPolicy     string
	SecPermissionsPolicy  string

	// CORS
	CORSOrigins        []string
	CORSAllowAllOrigin bool // explicit "*" in Origins
	CORSMethods        []string
	CORSHeaders        []string
	CORSExposeHeaders  []string
	CORSCredentials    bool
	CORSMaxAge         time.Duration

	// BasicAuth — users is a username -> bcrypt hash map.
	BasicAuthRealm string
	BasicAuthUsers map[string]string

	// IP allow/deny — only one direction is populated per middleware.
	IPCIDRs []string // canonical "1.2.3.0/24"
}

type MiddlewareType int

type Observability struct {
	AccessLog AccessLog
	Metrics   Metrics
	Tracing   Tracing
}

type Pool struct {
	Name        string
	Backends    []Backend
	Strategy    Strategy
	HealthCheck HealthCheck
	Transport   Transport
}

type RateLimitKey int

type Route struct {
	Pattern    string
	Host       string
	Upstream   *Pool  // nil for static-file routes
	StaticDir  string // empty for proxy routes
	Middleware []Middleware
}

type Shutdown struct {
	GracePeriod    time.Duration
	DrainListeners bool
}

type StaticTLS struct {
	CertFile string
	KeyFile  string
}

type Strategy int

type Tracing struct {
	Enabled     bool
	Kind        string // "otlp"
	Endpoint    string
	ServiceName string
	Insecure    bool
	SampleRate  float64
}

type Transport struct {
	MaxIdleConnsPerHost int
	IdleConnTimeout     time.Duration
	DialTimeout         time.Duration
	TLSHandshakeTimeout time.Duration
}