version: 1

security:
  requireProtectionOnPublicListen: true

gateway:
  enabled: true
  listen: 0.0.0.0:8080
  access:
    allowCIDRs: [0.0.0.0/0]
    trustedProxies: []
  auth:
    mode: usernamePassword
    username: "${PROXY_POOL_GATEWAY_USERNAME}"
    password: "${PROXY_POOL_GATEWAY_PASSWORD}"
  limits:
    maxConcurrentConnections: 20000
    requestsPerMinutePerClient: 60000
  transport:
    maxIdleConns: 20000
    maxIdleConnsPerHost: 32
    maxConnsPerHost: 32
    tunnelBufferBytes: 32768
  retry:
    maxAttempts: 2
    retryMethods: [GET, HEAD]
  destinationPolicy:
    denyPrivateNetworks: true
    denyLoopback: true
    denyLinkLocal: true
    denyCIDRs: [169.254.169.254/32]

distribution:
  enabled: true
  listen: 0.0.0.0:8081
  access:
    allowCIDRs: [10.0.0.0/8]
    trustedProxies: [10.0.0.0/8]
  auth:
    mode: apiKey
    header: X-API-Key
    token: "${PROXY_POOL_EXTRACT_TOKEN}"
  limits:
    requestsPerMinute: 6000
    requestsPerMinutePerClient: 600
  clientIdentification:
    mode: sourceIP
  extraction:
    fulfillment: partial
    maxCountPerRequest: 100
    minRemainingTTL: 30s
    maxHealthCheckAge: 30s
    reserveForGateway: 1000
    idempotencyTTL: 5m

admin:
  enabled: true
  listen: 0.0.0.0:8082
  access:
    allowCIDRs: [10.0.0.0/8]
  auth:
    mode: apiKey
    header: X-Admin-Key
    token: "${PROXY_POOL_ADMIN_TOKEN}"

controlPlane:
  enabled: true
  listen: 0.0.0.0:8443
  protocolVersion: 1
  heartbeatInterval: 10s
  sessionTTL: 30s
  maxStaleAge: 30s
  maxMessageBytes: 4194304
  maxRuntimeCounters: 100000
  maxConcurrentStreams: 1000
  tls:
    mode: mtls
    certFile: /run/proxy-pool-tls/server/tls.crt
    keyFile: /run/proxy-pool-tls/server/tls.key
    clientCAFile: /run/proxy-pool-tls/server/ca.crt
    trustDomain: proxy-pool.local
    environment: development
  gatewayTLS:
    certFile: /run/proxy-pool-tls/client/tls.crt
    keyFile: /run/proxy-pool-tls/client/tls.key
    serverCAFile: /run/proxy-pool-tls/client/ca.crt
  checkerTLS:
    certFile: /run/proxy-pool-tls/client/tls.crt
    keyFile: /run/proxy-pool-tls/client/tls.key
    serverCAFile: /run/proxy-pool-tls/client/ca.crt

metrics:
  enabled: true
  listen: 0.0.0.0:9090

storage:
  postgresURL: "${PROXY_POOL_POSTGRES_URL}"
  redisURL: "${PROXY_POOL_REDIS_URL}"

routing:
  - name: gateway-default
    enabled: true
    purpose: gateway
    upstreams: [provider-a, provider-b]
    strategy:
      type: sequential
      switchAfterEmptyFetch: 5
      endBehavior: stayLast
    onUnavailable:
      action: reject
  - name: extract-default
    enabled: true
    purpose: extract
    upstreams: [provider-a, provider-b]
    strategy:
      type: sequential
      switchAfterEmptyFetch: 5
      endBehavior: stayLast
    onUnavailable:
      action: reject

upstreams:
  provider-a:
    enabled: true
    exposure: [gateway, extract]
    provider:
      billingMode: fetch
      protocols: [http]
    api:
      url: https://provider-a.invalid/api/proxies
      method: GET
      auth:
        type: apiKey
        location: header
        name: Authorization
        value: "${PROVIDER_A_TOKEN}"
      template: '{{ . }}'
    proxyAuth:
      type: response
    pool:
      maxSize: 5000
      shrinkDelay: 30s
    capacity:
      maxConcurrencyPerProxy: 20
    refill:
      reconcileInterval: 1s
      minimumAvailableSlots: 8000
      targetAvailableSlots: 12000
    lifecycle:
      ttl: 5m
      allocationSafetyMargin: 20s
    fetch:
      estimatedIPsPerCall: 100
      requestInterval: 1s
      timeout: 3s
      maxAttempts: 3
      maxInFlight: 1
      maxTotal: 100000
      maxResponseBytes: 4194304
      templateTimeout: 100ms
      retry: {initial: 500ms, max: 30s, jitter: 20}
    check:
      interval: 30s
      jitter: 20
      maxInFlight: 200
      timeout: 3s
      maxAttempts: 2
      maxConsecutiveFailures: 3
      urls: [https://example.com/]
  provider-b:
    enabled: true
    exposure: [gateway, extract]
    provider:
      billingMode: fetch
      protocols: [http]
    api:
      url: https://provider-b.invalid/api/proxies
      method: GET
      auth:
        type: apiKey
        location: header
        name: Authorization
        value: "${PROVIDER_B_TOKEN}"
      template: '{{ . }}'
    proxyAuth:
      type: response
    pool:
      maxSize: 5000
      shrinkDelay: 30s
    capacity:
      maxConcurrencyPerProxy: 20
    refill:
      reconcileInterval: 1s
      minimumAvailableSlots: 8000
      targetAvailableSlots: 12000
    lifecycle:
      ttl: 5m
      allocationSafetyMargin: 20s
    fetch:
      estimatedIPsPerCall: 100
      requestInterval: 1s
      timeout: 3s
      maxAttempts: 3
      maxInFlight: 1
      maxTotal: 100000
      maxResponseBytes: 4194304
      templateTimeout: 100ms
      retry: {initial: 500ms, max: 30s, jitter: 20}
    check:
      interval: 30s
      jitter: 20
      maxInFlight: 200
      timeout: 3s
      maxAttempts: 2
      maxConsecutiveFailures: 3
      urls: [https://example.com/]