# Network Defaults - Network configuration defaults
# Version: 1.0.0
#
# Scenario: Network configuration best practices
# Use case: Multi-tier network architecture

{
  network_defaults = {
    network = {
      docker_networks = {
        frontend = {
          name = "frontend-network",
          driver = 'bridge,
          driver_opts = {
            "com.docker.network.bridge.name" = "br-frontend",
            "com.docker.network.bridge.enable_icc" = "true",
            "com.docker.network.bridge.enable_ip_masquerade" = "true",
          },
          ipam = {
            driver = "default",
            config = [{
              subnet = "172.20.0.0/16",
              gateway = "172.20.0.1",
              ip_range = "172.20.0.0/24",
            }],
          },
          internal = false,
          attachable = true,
          enable_ipv6 = false,
          labels = {
            "com.docker.network.tier" = "frontend",
          },
        },

        backend = {
          name = "backend-network",
          driver = 'bridge,
          driver_opts = {
            "com.docker.network.bridge.name" = "br-backend",
            "com.docker.network.bridge.enable_icc" = "true",
            "com.docker.network.bridge.enable_ip_masquerade" = "true",
          },
          ipam = {
            driver = "default",
            config = [{
              subnet = "172.21.0.0/16",
              gateway = "172.21.0.1",
              ip_range = "172.21.0.0/24",
            }],
          },
          internal = true,
          attachable = false,
          enable_ipv6 = false,
          labels = {
            "com.docker.network.tier" = "backend",
          },
        },

        database = {
          name = "database-network",
          driver = 'bridge,
          driver_opts = {
            "com.docker.network.bridge.name" = "br-database",
            "com.docker.network.bridge.enable_icc" = "true",
            "com.docker.network.bridge.enable_ip_masquerade" = "false",
          },
          ipam = {
            driver = "default",
            config = [{
              subnet = "172.22.0.0/16",
              gateway = "172.22.0.1",
              ip_range = "172.22.0.0/24",
            }],
          },
          internal = true,
          attachable = false,
          enable_ipv6 = false,
          labels = {
            "com.docker.network.tier" = "database",
          },
        },
      },

      kubernetes_policies = [
        {
          name = "default-deny-all",
          pod_selector = {
            matchLabels = {},
          },
          policy_types = ['Ingress, 'Egress],
          ingress = [],
          egress = [],
        },
        {
          name = "allow-dns",
          pod_selector = {
            matchLabels = {},
          },
          policy_types = ['Egress],
          egress = [{
            to = [{
              namespace_selector = {
                matchLabels = {
                  "kubernetes.io/metadata.name" = "kube-system",
                },
              },
            }],
            ports = [
              {
                port = 53,
                protocol = 'UDP,
              },
              {
                port = 53,
                protocol = 'TCP,
              },
            ],
          }],
        },
        {
          name = "allow-frontend-to-backend",
          pod_selector = {
            matchLabels = {
              tier = "frontend",
            },
          },
          policy_types = ['Egress],
          egress = [{
            to = [{
              pod_selector = {
                matchLabels = {
                  tier = "backend",
                },
              },
            }],
            ports = [{
              port = 8080,
              protocol = 'TCP,
            }],
          }],
        },
        {
          name = "allow-backend-to-database",
          pod_selector = {
            matchLabels = {
              tier = "backend",
            },
          },
          policy_types = ['Egress],
          egress = [{
            to = [{
              pod_selector = {
                matchLabels = {
                  tier = "database",
                },
              },
            }],
            ports = [{
              port = 5432,
              protocol = 'TCP,
            }],
          }],
        },
      ],

      dns_servers = ["1.1.1.1", "8.8.8.8"],
      dns_search = ["example.com", "internal.example.com"],
    },
  },
}
