# Verbatim /etc/haproxy/haproxy.cfg from gateway-ops, read read-only over the ssh key by
# ./scripts/capture-gateway-config.sh (AGENTS.md invariant 7: verify against the
# deployed upstream, never guess its shape).
# Nothing here is rewritten: it is this fleet's ingress map, and the domains in it are
# the data — an inbound name and the target it routes to are what these config sections
# exist to report. Key material appears only as the file paths the proxy reads.
defaults
    log     stdout local0 info
    mode    tcp
    option  tcplog
    timeout connect 10s
    timeout client  30s
    timeout server  30s
    timeout tunnel  3600s
    default-server init-addr last,libc,none

frontend haproxy-22
    bind :::22 v4v6
    default_backend gitea-2222

frontend haproxy-2000
    bind :::2000 v4v6
    default_backend sec-gitea-2000

frontend haproxy-5201
    bind :::5201 v4v6
    default_backend iperf3-5201

frontend haproxy-8080
    bind :::8080 v4v6
    default_backend unifi-external-8080

frontend haproxy-25565
    bind :::25565 v4v6
    default_backend testcraft-25565

frontend haproxy-25566
    bind :::25566 v4v6
    default_backend nimcraft-25566

backend gitea-2222
    server gitea reeseapps-gitea.reeselink.com:2222 check inter 5s

backend sec-gitea-2000
    server sec-gitea stackexpected-gitea.reeselink.com:2222 check inter 5s

backend iperf3-5201
    server iperf3 web.reeselink.com:5201 check inter 5s

backend unifi-external-8080
    server unifi unifi-external.reeselink.com:8080 check inter 5s

backend testcraft-25565
    server mc1 minecraft.reeselink.com:25565 check inter 5s

backend nimcraft-25566
    server mc2 minecraft.reeselink.com:25566 check inter 5s