# Installer Networking Configuration Fragment

[[elements]]
border_bottom = false
border_top = true
name = "installer_networking_section_header"
title = "🌐 Networking Configuration"
type = "section_header"

# Network Interface Configuration
[[elements]]
default = "0.0.0.0"
help = "Bind address for all services (0.0.0.0 = listen on all interfaces)"
name = "bind_address"
nickel_path = ["installer", "networking", "bind_address"]
prompt = "Bind Address"
required = true
type = "text"

[[elements]]
default = "provisioning.local"
help = "Primary hostname for services"
name = "primary_hostname"
nickel_path = ["installer", "networking", "primary_hostname"]
prompt = "Primary Hostname"
required = true
type = "text"

[[elements]]
default = ""
help = "Additional hostnames/aliases (comma-separated)"
name = "additional_hostnames"
nickel_path = ["installer", "networking", "additional_hostnames"]
prompt = "Additional Hostnames"
type = "text"

# DNS Configuration
[[elements]]
default = true
help = "Configure DNS for provisioning services"
name = "configure_dns"
nickel_path = ["installer", "networking", "dns", "configure"]
prompt = "Configure DNS"
type = "confirm"

[[elements]]
condition = "configure_dns == true"
default = "127.0.0.1"
help = "DNS server address"
name = "dns_server"
nickel_path = ["installer", "networking", "dns", "server"]
prompt = "DNS Server"
type = "text"

[[elements]]
condition = "configure_dns == true"
default = 53
help = "DNS server port"
max = 65535
min = 1
name = "dns_port"
nickel_path = ["installer", "networking", "dns", "port"]
prompt = "DNS Port"
type = "number"

# TLS/HTTPS Configuration
[[elements]]
default = false
help = "Enable TLS/HTTPS for service communication"
name = "enable_tls"
nickel_path = ["installer", "networking", "tls", "enabled"]
prompt = "Enable TLS"
type = "confirm"

[[elements]]
condition = "enable_tls == true"
default = "self_signed"
help = "TLS certificate source"
name = "tls_certificate_source"
nickel_path = ["installer", "networking", "tls", "certificate_source"]
options = ["self_signed", "letsencrypt", "vault", "provided"]
prompt = "TLS Certificate Source"
type = "select"

[[elements]]
condition = "enable_tls == true && tls_certificate_source == 'letsencrypt'"
default = ""
help = "Let's Encrypt email for certificate registration"
name = "letsencrypt_email"
nickel_path = ["installer", "networking", "tls", "letsencrypt_email"]
prompt = "Let's Encrypt Email"
required = true
type = "text"

[[elements]]
condition = "enable_tls == true && tls_certificate_source == 'provided'"
default = "/etc/provisioning/certs/server.crt"
help = "Path to provided certificate file"
name = "tls_certificate_path"
nickel_path = ["installer", "networking", "tls", "certificate_path"]
prompt = "Certificate Path"
type = "text"

[[elements]]
condition = "enable_tls == true && tls_certificate_source == 'provided'"
default = "/etc/provisioning/certs/server.key"
help = "Path to provided private key file"
name = "tls_key_path"
nickel_path = ["installer", "networking", "tls", "key_path"]
prompt = "Private Key Path"
type = "text"

# Firewall Configuration
[[elements]]
default = true
help = "Configure firewall rules for provisioning services"
name = "configure_firewall"
nickel_path = ["installer", "networking", "firewall", "configure"]
prompt = "Configure Firewall"
type = "confirm"

[[elements]]
condition = "configure_firewall == true"
default = "iptables"
help = "Firewall backend"
name = "firewall_backend"
nickel_path = ["installer", "networking", "firewall", "backend"]
options = ["iptables", "firewalld", "ufw"]
prompt = "Firewall Backend"
type = "select"

[[elements]]
condition = "configure_firewall == true"
default = true
help = "Enable inbound rate limiting"
name = "firewall_rate_limit_enabled"
nickel_path = ["installer", "networking", "firewall", "rate_limiting", "enabled"]
prompt = "Enable Rate Limiting"
type = "confirm"

[[elements]]
condition = "firewall_rate_limit_enabled == true"
default = 100
help = "Maximum requests per minute per IP"
min = 1
name = "firewall_rate_limit_rpm"
nickel_path = ["installer", "networking", "firewall", "rate_limiting", "requests_per_minute"]
prompt = "Rate Limit (req/min)"
type = "number"

# Load Balancer Configuration
[[elements]]
default = false
help = "Install and configure load balancer"
name = "install_load_balancer"
nickel_path = ["installer", "networking", "load_balancer", "enabled"]
prompt = "Install Load Balancer"
type = "confirm"

[[elements]]
condition = "install_load_balancer == true"
default = "nginx"
help = "Load balancer software"
name = "load_balancer_type"
nickel_path = ["installer", "networking", "load_balancer", "type"]
options = ["nginx", "haproxy", "traefik"]
prompt = "Load Balancer Type"
type = "select"

[[elements]]
condition = "install_load_balancer == true"
default = 80
help = "Load balancer HTTP port (range: ${constraint.common.server.port.min}-${constraint.common.server.port.max})"
max = "${constraint.common.server.port.max}"
min = "${constraint.common.server.port.min}"
name = "load_balancer_http_port"
nickel_path = ["installer", "networking", "load_balancer", "http_port"]
prompt = "Load Balancer HTTP Port"
type = "number"

[[elements]]
condition = "install_load_balancer == true"
default = 443
help = "Load balancer HTTPS port (range: ${constraint.common.server.port.min}-${constraint.common.server.port.max})"
max = "${constraint.common.server.port.max}"
min = "${constraint.common.server.port.min}"
name = "load_balancer_https_port"
nickel_path = ["installer", "networking", "load_balancer", "https_port"]
prompt = "Load Balancer HTTPS Port"
type = "number"

[[elements]]
condition = "install_load_balancer == true"
default = "round_robin"
help = "Load balancing algorithm"
name = "load_balancer_algorithm"
nickel_path = ["installer", "networking", "load_balancer", "algorithm"]
options = ["round_robin", "least_connections", "ip_hash", "weighted"]
prompt = "Load Balancing Algorithm"
type = "select"

# Ingress Configuration (for Kubernetes)
[[elements]]
default = false
help = "Configure Kubernetes Ingress"
name = "configure_ingress"
nickel_path = ["installer", "networking", "ingress", "configure"]
prompt = "Configure Ingress"
type = "confirm"

[[elements]]
condition = "configure_ingress == true"
default = "nginx"
help = "Ingress controller type"
name = "ingress_controller"
nickel_path = ["installer", "networking", "ingress", "controller"]
options = ["nginx", "istio", "traefik"]
prompt = "Ingress Controller"
type = "select"

[[elements]]
condition = "configure_ingress == true"
default = ""
help = "Ingress domain name"
name = "ingress_domain"
nickel_path = ["installer", "networking", "ingress", "domain"]
prompt = "Ingress Domain"
required = true
type = "text"

# Proxy Configuration
[[elements]]
default = false
help = "Configure HTTP proxy for outbound connections"
name = "enable_http_proxy"
nickel_path = ["installer", "networking", "proxy", "enabled"]
prompt = "Enable HTTP Proxy"
type = "confirm"

[[elements]]
condition = "enable_http_proxy == true"
default = ""
help = "HTTP proxy URL (e.g., http://proxy.example.com:3128)"
name = "http_proxy_url"
nickel_path = ["installer", "networking", "proxy", "http_url"]
prompt = "HTTP Proxy URL"
required = true
type = "text"

[[elements]]
condition = "enable_http_proxy == true"
default = ""
help = "HTTPS proxy URL"
name = "https_proxy_url"
nickel_path = ["installer", "networking", "proxy", "https_url"]
prompt = "HTTPS Proxy URL"
type = "text"

[[elements]]
condition = "enable_http_proxy == true"
default = ""
help = "No proxy list (hosts to bypass proxy, comma-separated)"
name = "no_proxy_list"
nickel_path = ["installer", "networking", "proxy", "no_proxy"]
prompt = "No Proxy List"
type = "text"

# Network Monitoring
[[elements]]
default = false
help = "Enable network traffic monitoring"
name = "enable_traffic_monitoring"
nickel_path = ["installer", "networking", "monitoring", "enabled"]
prompt = "Enable Traffic Monitoring"
type = "confirm"

[[elements]]
condition = "enable_traffic_monitoring == true"
default = 60
help = "Traffic monitoring interval in seconds"
min = 5
name = "traffic_monitoring_interval"
nickel_path = ["installer", "networking", "monitoring", "interval_seconds"]
prompt = "Monitoring Interval (seconds)"
type = "number"
