pub struct GatewayConfig {
    pub entrypoints: HashMap<String, EntrypointConfig>,
    pub routers: HashMap<String, RouterConfig>,
    pub services: HashMap<String, ServiceConfig>,
    pub middlewares: HashMap<String, MiddlewareConfig>,
    pub providers: ProviderConfig,
    pub management: ManagementConfig,
    pub observability: ObservabilityConfig,
    pub shutdown_timeout_secs: u64, // default: 30
}

shutdown_timeout_secs {
  shutdown_timeout_secs = 30
}

// Load from a .acl file
let config = GatewayConfig::from_file("gateway.acl").await?;

// Parse from an ACL string
let config = GatewayConfig::from_acl(acl_content)?;

// Validate cross-references and value constraints
config.validate()?;

middlewares "auth-jwt" {
  type  = "jwt"
  value = env("JWT_SECRET")
}

entrypoints "websecure" {
  address = "0.0.0.0:443"
  tls {
    cert_file = env("TLS_CERT_PATH")
    key_file  = env("TLS_KEY_PATH")
  }
}

pub struct EntrypointConfig {
    pub address: String,                       // required, "host:port"
    pub protocol: Protocol,                    // http (default) | tcp | udp
    pub tls: Option<TlsConfig>,                // optional
    pub max_connections: Option<u32>,          // TCP only, default: unlimited
    pub tcp_allowed_ips: Vec<String>,          // TCP only, default: []
    pub udp_session_timeout_secs: Option<u64>, // UDP only, default: 30 at the listener
    pub udp_max_sessions: Option<usize>,       // UDP only, default: 10000 at the listener
}

# HTTP listener
entrypoints "web" {
  address = "0.0.0.0:80"
}

# HTTPS listener with static TLS
entrypoints "websecure" {
  address = "0.0.0.0:443"
  tls {
    cert_file   = "/etc/certs/cert.pem"
    key_file    = "/etc/certs/key.pem"
    min_version = "1.3"
  }
}

# TCP listener with connection limit + IP allowlist
entrypoints "postgres" {
  address         = "0.0.0.0:5432"
  protocol        = "tcp"
  max_connections = 1000
  tcp_allowed_ips = ["10.0.0.0/8", "192.168.1.0/24"]
}

# UDP listener
entrypoints "dns" {
  address                  = "0.0.0.0:53"
  protocol                 = "udp"
  udp_session_timeout_secs = 60
  udp_max_sessions         = 5000
}

pub struct TlsConfig {
    pub cert_file: String,                 // PEM cert chain
    pub key_file: String,                  // PEM private key
    pub min_version: String,               // "1.2" (default) or "1.3"
    pub acme: bool,                        // default: false
    pub acme_email: Option<String>,        // required when acme = true
    pub acme_domains: Vec<String>,         // default: [] (derives from Host rules)
    pub acme_staging: bool,                // default: false
    pub acme_storage_path: Option<String>, // default: /etc/gateway/acme
}

entrypoints "websecure" {
  address = "0.0.0.0:443"
  tls {
    cert_file         = "/etc/certs/cert.pem"
    key_file          = "/etc/certs/key.pem"
    acme              = true
    acme_email        = "admin@example.com"
    acme_domains      = ["example.com", "api.example.com"]
    acme_staging      = false
    acme_storage_path = "/etc/gateway/acme"
  }
}

pub struct RouterConfig {
    pub rule: String,             // required, Traefik-style matcher
    pub service: String,          // required, must exist
    pub entrypoints: Vec<String>, // default: [] (= all entrypoints)
    pub middlewares: Vec<String>, // default: []
    pub priority: i32,            // default: 0
}

routers "api" {
  rule        = "Host(`api.example.com`) && PathPrefix(`/v1`)"
  service     = "api-service"
  entrypoints = ["websecure"]
  middlewares = ["auth-jwt", "rate-limit"]
  priority    = 100
}

routers "web" {
  rule        = "Host(`www.example.com`)"
  service     = "web-service"
  entrypoints = ["web", "websecure"]
}

pub struct ServiceConfig {
    pub load_balancer: LoadBalancerConfig,
    pub scaling: Option<ScalingConfig>,
    pub revisions: Vec<RevisionConfig>,
    pub rollout: Option<RolloutConfig>,
    pub mirror: Option<MirrorConfig>,
    pub failover: Option<FailoverConfig>,
}

pub struct LoadBalancerConfig {
    pub strategy: Strategy,                  // round-robin (default) | weighted | least-connections | random
    pub request_timeout: String,             // default: "30s"
    pub servers: Vec<ServerConfig>,          // default: []
    pub health_check: Option<HealthCheckConfig>,
    pub sticky: Option<StickyConfig>,
}

services "api-service" {
  load_balancer {
    strategy        = "weighted"
    request_timeout = "30s"
    servers = [
      { url = "http://127.0.0.1:8001", weight = 3 },
      { url = "http://127.0.0.1:8002", weight = 1 }
    ]

    health_check {
      path                = "/health"
      interval            = "10s"
      timeout             = "5s"
      unhealthy_threshold = 3
      healthy_threshold   = 1
    }

    sticky {
      cookie = "srv_id"
    }
  }
}

pub struct MirrorConfig {
    pub service: String, // required, must exist in services
    pub percentage: u8,  // 0-100, default: 100
}

services "api-service" {
  load_balancer {
    strategy = "round-robin"
    servers  = [{ url = "http://127.0.0.1:8001" }]
  }
  mirror {
    service    = "shadow-backend"
    percentage = 10
  }
}

pub struct FailoverConfig {
    pub service: String, // required, must exist in services
}

services "api-service" {
  load_balancer {
    strategy = "round-robin"
    servers  = [{ url = "http://127.0.0.1:8001" }]
  }
  failover {
    service = "backup-pool"
  }
}

pub struct ScalingConfig {
    pub min_replicas: u32,            // default: 0 (scale-to-zero)
    pub max_replicas: u32,            // default: 10
    pub container_concurrency: u32,   // default: 0 (unlimited)
    pub target_utilization: f64,      // default: 0.7, in (0.0, 1.0]
    pub scale_down_delay_secs: u64,   // default: 300
    pub buffer_timeout_secs: u64,     // default: 30
    pub buffer_size: usize,           // default: 100
    pub buffer_enabled: bool,         // default: false
    pub executor: String,             // "box" (default) | "k8s"
}

services "ai-model" {
  load_balancer {
    servers = [{ url = "http://127.0.0.1:9000" }]
  }
  scaling {
    min_replicas          = 0
    max_replicas          = 20
    container_concurrency = 4
    target_utilization    = 0.7
    scale_down_delay_secs = 120
    buffer_enabled        = true
    buffer_size           = 200
    buffer_timeout_secs   = 30
    executor              = "box"
  }
}

pub struct RevisionConfig {
    pub name: String,               // required
    pub traffic_percent: u32,       // 0-100, default: 100
    pub servers: Vec<ServerConfig>, // default: []
    pub strategy: Strategy,         // default: round-robin
}

pub struct RolloutConfig {
    pub from: String,              // required, must name an existing revision
    pub to: String,               // required, must name an existing revision
    pub step_percent: u32,        // default: 10
    pub step_interval_secs: u64,  // default: 60
    pub error_rate_threshold: f64,// default: 0.05
    pub latency_threshold_ms: u64,// default: 5000
}

services "api-service" {
  revisions = [
    {
      name            = "v1"
      traffic_percent = 80
      servers         = [{ url = "http://127.0.0.1:8001" }]
    },
    {
      name            = "v2"
      traffic_percent = 20
      servers         = [{ url = "http://127.0.0.1:8002" }]
    }
  ]

  rollout {
    from                 = "v1"
    to                   = "v2"
    step_percent         = 10
    step_interval_secs   = 60
    error_rate_threshold = 0.05
    latency_threshold_ms = 5000
  }
}

pub struct MiddlewareConfig {
    pub middleware_type: String,             // ACL key: "type", required
    pub header: Option<String>,              // api-key / jwt
    pub keys: Vec<String>,                   // api-key
    pub value: Option<String>,               // jwt secret
    pub username: Option<String>,            // basic-auth
    pub password: Option<String>,            // basic-auth
    pub rate: Option<u64>,                   // rate-limit / rate-limit-redis
    pub burst: Option<u64>,                  // rate-limit / rate-limit-redis
    pub allowed_origins: Vec<String>,        // cors
    pub allowed_methods: Vec<String>,        // cors
    pub allowed_headers: Vec<String>,        // cors
    pub max_age: Option<u64>,                // cors
    pub request_headers: HashMap<String, String>,  // headers
    pub response_headers: HashMap<String, String>, // headers
    pub prefixes: Vec<String>,               // strip-prefix
    pub max_retries: Option<u32>,            // retry
    pub retry_interval_ms: Option<u64>,      // retry
    pub allowed_ips: Vec<String>,            // ip-allow
    pub forward_auth_url: Option<String>,    // forward-auth
    pub forward_auth_response_headers: Vec<String>, // forward-auth
    pub redis_url: Option<String>,           // rate-limit-redis
    pub max_body_bytes: Option<u64>,         // body-limit
    pub failure_threshold: Option<u32>,      // circuit-breaker
    pub cooldown_secs: Option<u64>,          // circuit-breaker
    pub success_threshold: Option<u32>,      // circuit-breaker
}

middlewares "auth-jwt" {
  type  = "jwt"
  value = env("JWT_SECRET")
}

middlewares "api-key" {
  type   = "api-key"
  header = "X-API-Key"
  keys   = ["key-abc", "key-def"]
}

middlewares "rate-limit" {
  type  = "rate-limit"
  rate  = 100
  burst = 50
}

middlewares "cors" {
  type            = "cors"
  allowed_origins = ["https://example.com"]
  allowed_methods = ["GET", "POST", "PUT", "DELETE"]
  allowed_headers = ["Content-Type", "Authorization"]
  max_age         = 3600
}

middlewares "strip-apps" {
  type     = "strip-prefix"
  prefixes = ["/apps/*"]
}

middlewares "circuit-breaker" {
  type              = "circuit-breaker"
  failure_threshold = 3
  cooldown_secs     = 60
  success_threshold = 2
}

middlewares "edge-auth" {
  type                          = "forward-auth"
  forward_auth_url              = "http://auth-svc:8080/verify"
  forward_auth_response_headers = ["X-User-Id", "X-User-Roles"]
}

pub struct ObservabilityConfig {
    pub metrics_enabled: bool,    // default: true
    pub access_log_enabled: bool, // default: true
    pub tracing_enabled: bool,    // default: true
}

observability {
  metrics_enabled    = true
  access_log_enabled = true
  tracing_enabled    = true
}

pub struct ManagementConfig {
    pub enabled: bool,                  // default: false
    pub address: String,                // default: "127.0.0.1:9090"
    pub path_prefix: String,            // default: "/api/gateway"
    pub auth_token_env: Option<String>, // default: "A3S_GATEWAY_ADMIN_TOKEN"
    pub allowed_ips: Vec<String>,       // default: ["127.0.0.1", "::1"]
    pub tls: Option<ManagementTlsConfig>,
}

pub struct ManagementTlsConfig {
    pub cert_file: String,              // required
    pub key_file: String,              // required
    pub client_ca_file: Option<String>, // default: none
    pub require_client_cert: bool,      // default: false
    pub min_version: String,            // "1.2" (default) or "1.3"
}

management {
  enabled        = true
  address        = "127.0.0.1:9090"
  path_prefix    = "/api/gateway"
  auth_token_env = "A3S_GATEWAY_ADMIN_TOKEN"
  allowed_ips    = ["127.0.0.1", "::1"]

  tls {
    cert_file           = "/etc/a3s/admin/server.crt"
    key_file            = "/etc/a3s/admin/server.key"
    client_ca_file      = "/etc/a3s/admin/client-ca.crt"
    require_client_cert = true
    min_version         = "1.3"
  }
}

providers {
  file {
    watch     = true
    directory = "/etc/gateway/conf.d/"
  }
}

providers {
  discovery {
    poll_interval_secs = 30
    timeout_secs       = 5
    seeds = [
      { url = "http://10.0.0.5:8080" },
      { url = "http://10.0.0.6:8080" }
    ]
  }
}

providers {
  docker {
    host               = "/var/run/docker.sock"
    label_prefix       = "a3s"
    poll_interval_secs = 10
  }
}

providers {
  kubernetes {
    namespace           = "default"
    label_selector      = "app=my-service"
    watch_interval_secs = 30
    ingress_route_crd   = true
  }
}

let new_config = GatewayConfig::from_file("gateway.acl").await?;
gateway.reload(new_config).await?;

shutdown_timeout_secs {
  shutdown_timeout_secs = 30
}

# Observability
observability {
  metrics_enabled    = true
  access_log_enabled = true
  tracing_enabled    = true
}

# Entrypoints
entrypoints "web" {
  address = "0.0.0.0:80"
}

entrypoints "websecure" {
  address = "0.0.0.0:443"
  tls {
    cert_file = "/etc/certs/cert.pem"
    key_file  = "/etc/certs/key.pem"
  }
}

# Routers
routers "api" {
  rule        = "Host(`api.example.com`) && PathPrefix(`/v1`)"
  service     = "api-service"
  entrypoints = ["websecure"]
  middlewares = ["auth-jwt", "rate-limit", "cors"]
  priority    = 100
}

routers "web" {
  rule        = "Host(`www.example.com`)"
  service     = "web-service"
  entrypoints = ["web", "websecure"]
}

# Services
services "api-service" {
  load_balancer {
    strategy        = "least-connections"
    request_timeout = "30s"
    servers = [
      { url = "http://127.0.0.1:8001" },
      { url = "http://127.0.0.1:8002" }
    ]
    health_check {
      path     = "/health"
      interval = "10s"
    }
  }
}

services "web-service" {
  load_balancer {
    strategy = "round-robin"
    servers  = [{ url = "http://127.0.0.1:3000" }]
  }
}

# Middlewares
middlewares "auth-jwt" {
  type  = "jwt"
  value = env("JWT_SECRET")
}

middlewares "rate-limit" {
  type  = "rate-limit"
  rate  = 100
  burst = 50
}

middlewares "cors" {
  type            = "cors"
  allowed_origins = ["https://example.com"]
  allowed_methods = ["GET", "POST"]
}

# Management API
management {
  enabled        = true
  auth_token_env = "A3S_GATEWAY_ADMIN_TOKEN"
}

# Providers
providers {
  file {
    watch = true
  }
}