#!/usr/bin/env herodo
// TLS Options Configuration Examples
// This example shows how to configure TLS settings for Traefik routes

let namespace = "production";

// Create a KubernetesManager for the namespace
let km = kubernetes(namespace);
print(`Connected to namespace: ${namespace(km)}`);

// ============================================
// Standard TLS Configuration
// ============================================

// Modern TLS configuration (TLS 1.2+)
let modern_tls = tls_option("modern-tls", namespace)
    .min_version("VersionTLS12")
    .sni_strict(true)
    .build();

print("--- Modern TLS Options ---");
print(to_yaml(modern_tls));

// ============================================
// Strict TLS Configuration
// ============================================

// Strict TLS with specific cipher suites
let strict_tls = tls_option("strict-tls", namespace)
    .min_version("VersionTLS13")
    .cipher_suites([
        "TLS_AES_256_GCM_SHA384",
        "TLS_CHACHA20_POLY1305_SHA256",
        "TLS_AES_128_GCM_SHA256"
    ])
    .sni_strict(true)
    .build();

print("\n--- Strict TLS Options (TLS 1.3 only) ---");
print(to_yaml(strict_tls));

// ============================================
// Legacy TLS Configuration
// ============================================

// Legacy compatibility (still supports TLS 1.2)
let legacy_tls = tls_option("legacy-tls", namespace)
    .min_version("VersionTLS12")
    .cipher_suites([
        "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
        "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
        "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
    ])
    .build();

print("\n--- Legacy TLS Options (TLS 1.2+) ---");
print(to_yaml(legacy_tls));

// ============================================
// mTLS Configuration (Client Certificates)
// ============================================

// Mutual TLS requiring client certificates
let mtls_config = tls_option("mtls-strict", namespace)
    .min_version("VersionTLS12")
    .client_auth("RequireAndVerifyClientCert", ["client-ca-secret"])
    .sni_strict(true)
    .build();

print("\n--- mTLS Configuration ---");
print(to_yaml(mtls_config));

// Optional client certificate verification
let mtls_optional = tls_option("mtls-optional", namespace)
    .min_version("VersionTLS12")
    .client_auth("VerifyClientCertIfGiven", ["client-ca-secret"])
    .build();

print("\n--- mTLS Optional Configuration ---");
print(to_yaml(mtls_optional));

// ============================================
// Using TLS Options with HTTP Routes
// ============================================

print("\n=== HTTP Route with Custom TLS Options ===\n");

// Create an HTTP route that uses the strict TLS options
let secure_api = http_route("secure-api", namespace)
    .hostname("api.example.com")
    .service("api-service", 8080)
    .tls_secret("api-tls-cert")
    // Note: TLS options are referenced in the route
    .build();

print("Secure API Route:");
print(to_yaml(secure_api));

// ============================================
// Apply TLS options to cluster
// ============================================

// Uncomment to apply:
// apply_tls_option(km, modern_tls);
// apply_tls_option(km, strict_tls);
// apply_tls_option(km, mtls_config);
// print("TLS options applied!");

print("\n=== TLS Configuration Complete ===");
print("Remember to:");
print("1. Create the required TLS secrets with certificates");
print("2. Reference TLS options in your IngressRoute configurations");
print("3. For mTLS, ensure client CA certificates are in place");
