# 1) build (or use an existing release binary)
cargo build --release

# 2) create the admin password hash → paste it into the config
./target/release/lbrust hash-password
#   output: $argon2id$...   →  put it in [admin] password_hash

# 3) validate, then run
./target/release/lbrust -c config/example.toml --test
./target/release/lbrust -c config/example.toml run

# signals
SIGHUP          # reload config from file (no restart)
SIGINT/SIGTERM  # graceful shutdown + connection drain

[global]          # process behavior: workers, maxconn, drain
[defaults]        # defaults for frontends/backends
[[frontend]]      # many allowed — each bind listens for traffic
[[backend]]       # many allowed — server pool + balancer
  [[backend.server]]  # a server inside a backend
[log]             # mode, level, escalation
[log.file]        # THE log file: compact & full records, rotation + retention
[log.capture]     # capture parameters for full mode
[monitor]         # resource sampling, capacity alerts, webhook (hot-reload)
[monitor.thresholds]  # CPU/mem/maxconn/disk/fd alert levels
[admin]           # admin GUI/API

[global]
workers = 0            # 0 = automatic (use physical core count)
maxconn = 200000       # total active connection cap (admission control)
backlog = 4096         # listen queue — match it with somaxconn
drain_timeout = "30s"  # time to drain active conns on shutdown/restart

[defaults]
mode = "tcp"                 # "tcp" | "http" (L7: rules, cookie sticky) | "udp" (datagram)
balance = "roundrobin"       # roundrobin | leastconn | source
timeout_connect = "5s"       # batas waktu connect ke backend
timeout_client  = "60s"      # idle timeout, client side
timeout_server  = "60s"      # idle timeout, backend side
retries = 1                  # retry another server on connect failure

[[frontend]]
name = "app_in"
bind = ["*:9000"]            # "*:PORT" | "IP:PORT" | "[::]:PORT"
default_backend = "app"
# mode = "tcp"               # override defaults.mode
# forceclose = true          # force Connection: close (needed for per-request rules)
# rule = [ ... ]             # see the Routing rules section

# TLS termination — see the SSL/TLS section
# [frontend.tls]
# crt = "/etc/lbrust/fullchain.pem"
# key = "/etc/lbrust/privkey.pem"

[[backend]]
name = "app"
balance = "roundrobin"       # override defaults.balance
# sticky = { type = "source_ip", hash = "xxhash64" }
# sticky = { type = "source_ip", xff = true }   # key = first X-Forwarded-For
#                                               # IP (behind proxy; http mode)
# sticky = { type = "cookie", name = "SRV", ttl = "30m",
#            httponly = true, secure = true, path = "/" }

  [[backend.server]]
  addr = "10.0.0.1:8080"     # IP:port atau hostname (DNS di-refresh tiap check)
  weight = 2                 # 1..=100 (default 1)
  maxconn = 10000            # 0 = unlimited per server
  # cookie = "s1"            # sticky id (default: addr)
  # disabled = true          # present in config but disabled

  [[backend.server]]
  addr = "10.0.0.2:8080"
  check = { type = "tcp", interval = "2s", timeout = "1s",
            rise = 2, fall = 3 }
  # check = { type = "http", path = "/healthz", ... }

  # TLS ke backend (HAProxy: `server ... ssl ...`)
  # ssl = { verify = false }                       # verify none — self-signed internal
  # ssl = { verify = true, cafile = "/etc/ca.pem" } # verifikasi penuh + CA bundle

[[frontend]]
name = "web"
bind = ["*:80"]
default_backend = "app"

rule = [
  { if = "path_beg(\"/api\")",   backend = "api" },
  { if = "path_end(\".png\")",   backend = "static" },
  { if = "host(\"example.com\")", backend = "vhost" },
  { if = "method(\"POST\")",     backend = "write" },
  { if = "hdr(\"x-beta\", \"1\")", backend = "beta" },
  { if = "not path_beg(\"/admin\")", backend = "public" },
]

# 1) Cookie-based (http mode) — the LB hands the client a cookie
sticky = { type = "cookie", name = "SRV", ttl = "30m",
           httponly = true, secure = true, path = "/" }

# 2) Source-IP hashing (tcp/http mode) — client = source IP
sticky = { type = "source_ip", hash = "xxhash64" }

# 2b) Behind a proxy? Key on the FIRST X-Forwarded-For IP instead
#     (falls back to the peer IP when the header is missing; http mode)
sticky = { type = "source_ip", xff = true }

[[backend]]
name = "app"
balance = "roundrobin"
# key = 1st XFF entry; header missing/invalid → peer (TCP source) IP
sticky = { type = "source_ip", xff = true }

[[backend.server]]
addr = "10.0.0.1:8080"
check = { type = "tcp", interval = "2s", timeout = "1s",
          rise = 2, fall = 3 }

# HTTP check — 2xx/3xx responses are considered healthy
check = { type = "http", path = "/healthz",
          interval = "2s", timeout = "1s", rise = 2, fall = 3 }

[defaults]
mode = "tcp"
udp_idle_timeout = "30s"      # flow closed after this long with no datagram
                               # in EITHER direction (min: any positive duration)

[[frontend]]
name = "dns-udp"
bind = ["*:53"]                # or ["*:53/udp"] host:port — mode decides the protocol
mode = "udp"                   # tcp | http | udp
default_backend = "dns"

[[backend]]
name = "dns"
balance = "roundrobin"         # roundrobin | leastconn | source

  [[backend.server]]
  addr = "10.0.0.53:53"
  check = { type = "udp", interval = "2s", timeout = "1s",
            rise = 2, fall = 3 }   # probe datagram health check

        client ──datagram──▶ [lbrust :53, mode udp] ──▶ server A (flow 1)
             ▲                                          server B (flow 2 …)
             └──reply────────── flow dibuang setelah udp_idle_timeout

[[frontend]]
name = "app_in"
bind = ["*:9000"]
default_backend = "app"

# ── IP access control (checked in this order) ──
# entries: "IP", "CIDR" (all ports), "IP:port", "CIDR:port",
#          "IP:from-to" (inclusive), "[2001:db8::1]:443" (IPv6 + port)
deny  = ["203.0.113.9:8080", "198.51.100.0/24:443"]  # 1) blacklist — always rejected
allow = ["10.0.0.0/8", "10.0.0.5:443"]              # 2) whitelist — if set, ONLY these
                                                     #    (empty = everyone allowed)

# ── Rate limit: token bucket per frontend + per client IP ──
ratelimit = {
  rate       = 5000,    # new connections/sec, all clients (0 = off)
  burst      = 10000,   # bucket capacity (default = rate)
  per_ip     = 100,     # new connections/sec per client IP (0 = off)
  per_ip_burst = 200,   # per-IP bucket capacity (default = per_ip)
}

[[frontend]]
name = "tls_in"
bind = ["*:443"]
mode = "tcp"                      # sni_routes works in tcp mode only
default_backend = "be_default"    # used when no SNI / no match
sni_routes = { "api.example.com" = "be_api",
               "*.example.com"   = "be_web" }   # wildcard = subdomains only

[[frontend]]
name = "app_in"
bind = ["*:9000"]
mode = "http"
default_backend = "app"

# ── WAF-lite: presets + size limits ──
waf = {
  enabled    = true,
  presets    = ["sqli", "xss", "traversal", "bad_ua", "null_byte"],
  max_url    = "8KB",    # path + query length (0 = no limit)
  max_header = "16KB",   # total request header bytes
  max_body   = "1MB",    # Content-Length (0 = no limit)
}

# ── custom rules on top of the presets (case-insensitive substring) ──
waf_deny = [
  { where = "path",   contains = "/.env" },
  { where = "query",  contains = "etc/passwd" },
  { where = "header", contains = "union select" },
]

[log]
level = "info"               # error|warn|info|debug|trace
mode = "compact"             # compact | full (togglable from the GUI at runtime)
escalate_on_error = true     # errors are logged in FULL detail, even in compact mode
error_status_min = 500
format = "json"              # json | text
stdout = false               # duplicate every access record to stdout
                             # (containers: docker/journald collect stdout)
syslog = ""                  # RFC5424 target: "/dev/log" (unix datagram)
                             # or UDP "host:port" e.g. "127.0.0.1:514"

[log.file]                   # ONE file for both compact and full records
enabled = true
path = "logs/access.log"
rotate = "daily"             # hourly | daily | size
# max_size = "500MB"         # used when rotate = "size"
retention_days = 14          # delete archives older than this…
retention_size = "2GB"       # …AND/OR when the total exceeds this
compress = true              # gzip archives
queue_capacity = 8192        # queue full → drop + counter, proxy keeps running

[log.capture]                # applies when a FULL record is written
max_body_bytes = "8KB"       # body capture limit
capture_request_body = true
capture_response_body = false
redact_headers = ["authorization", "proxy-authorization", "x-api-key"]
body_content_types = ["application/json",
                      "application/x-www-form-urlencoded", "text/*"]
sample_rate = 1.0            # 0..1 — sampling rate for full mode

[monitor]
enabled = true
interval = "5s"              # sampling rate (min 500ms) — also the chart resolution
debounce = 3                 # consecutive samples before an alert fires/resolve
                             # (anti-flap: 3 × 5s = 15s sustained)

[monitor.thresholds]         # all percent 0..=100 — customize freely
cpu_warn = 80                # system CPU ≥ 80% → warn, ≥ cpu_crit → critical
cpu_crit = 95
mem_warn = 85                # used memory %
mem_crit = 95
maxconn_warn = 80            # active connections as % of global.maxconn
maxconn_crit = 95
disk_warn = 10               # log volume FREE space ≤ 10% → warn (inverted!)
disk_crit = 5                # …≤ 5% → critical
fd_warn = 80                 # open files as % of ulimit -n
fd_crit = 95
reject_warn = 60             # rejected connections per MINUTE (not percent)
reject_crit = 600

[monitor.webhook]            # POST JSON on alert fire/resolve
enabled = false
url = "https://hooks.slack.com/services/XXX"   # http:// or https://
min_interval = "5m"          # cooldown per alert (escalation always sends)
timeout = "5s"

{
  "text": "[lbrust] crit maxconn: Connections CRITICAL: 96.2% of maxconn (96200/100000) — …",
  "content": "…same…",
  "source": "lbrust",
  "event": "fire",            // or "resolve"
  "level": "crit",            // warn | crit | ok
  "alert": "maxconn",
  "message": "…", "advice": "…",
  "value": 96.2, "threshold": 95,
  "ts": 1762500000, "host": "lb-01"
}

[monitor]
# ... (see Resources & alerts)
history_path = "logs/metrics-history.jsonl"   # "" = disabled (memory only)
history_interval = "60s"                      # min 1s — one JSON point per line
history_retention_days = 7                    # trimmed on startup + every 6h

# prometheus resource metrics
lb_sys_cpu_percent  lb_sys_mem_used_bytes  lb_proc_rss_bytes
lb_proc_open_fds    lb_proc_fd_limit       lb_maxconn_utilization_percent
lb_alerts_active    lb_alert{id="cpu",level="warn"} 1

        internet ──TLS──▶ [terminator :443] ──HTTP/TCP──▶ [lbrust :9000] ──▶ backend

# nginx — TLS terminator in front of lbrust
server {
    listen 443 ssl http2;
    server_name example.com;

    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:9000;   # ← lbrust bind
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# redirect HTTP → HTTPS
server {
    listen 80;
    server_name example.com;
    return 301 https://$host$request_uri;
}

# free certificates with Let's Encrypt (certbot)
sudo certbot --nginx -d example.com
# or standalone if nginx is not running yet:
sudo certbot certonly --standalone -d example.com
# auto-renewal (enabled by default): certbot renew --dry-run

        internet ──TLS──▶ [lbrust :443, mode tcp] ──TLS──▶ [backend TLS sendiri]

[[frontend]]
name = "tls_passthrough"
bind = ["*:443"]
default_backend = "secure_app"   # backend must terminate TLS itself

[[frontend]]
name = "web"
bind = ["*:443"]
default_backend = "app"

[frontend.tls]
crt = "/etc/lbrust/fullchain.pem"   # cert chain + key (combined, HAProxy style)
# key = "/etc/lbrust/privkey.pem"   # optional if the .crt file already includes the key

# combine cert + key (HAProxy `crt` style)
cat fullchain.pem privkey.pem > /etc/lbrust/fullchain.pem
chmod 600 /etc/lbrust/fullchain.pem

[admin]
enabled = true
bind = "127.0.0.1:9464"      # localhost only — never expose it directly
session_ttl = "8h"
password_hash = "$argon2id$v=19$m=19456,t=2,p=1$..."  # dari `lbrust hash-password`
login_max_attempts = 5       # failed attempts…
login_window = "60s"         # …within this window → blocked

# reach the admin UI from another machine via SSH tunnel (safe, no open port)
ssh -L 9464:127.0.0.1:9464 user@lb-server
# then open http://127.0.0.1:9464 locally

# /etc/sysctl.d/99-lbrust.conf — lalu: sysctl --system

# listen queue — match it with global.backlog
net.core.somaxconn = 65535
net.core.netdev_max_backlog = 65535

# ephemeral ports for backend connections (the LB opens many)
net.ipv4.ip_local_port_range = 1024 65535
net.ipv4.tcp_tw_reuse = 1

# buffer TCP
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216

# file descriptors (the LB holds thousands of sockets)
fs.file-max = 2097152
fs.nr_open = 2097152

# per-process limit (systemd: add it to the unit file)
ulimit -n 1048576
# systemd unit:
#   LimitNOFILE=1048576

# verify after start
cat /proc/$(pgrep -f 'lbrust run')/limits | grep 'open files'