routes.yml

# Route Configuration
#
# Header Manipulation Guide:
# ========================
# Each route can modify HTTP headers using the 'headers' section:
#
# headers:
#   add:                          # Add or overwrite response headers
#     Header-Name: "Header-Value"
#     Cache-Control: "max-age=3600"
#     X-Custom-Header: "custom-value"
#   remove:                       # Remove headers from response
#     - "Server"                  # Hide server information
#     - "X-Powered-By"           # Remove framework identification
#     - "X-Debug-Info"           # Remove debug headers
#
# Common Use Cases:
# - Security headers (X-Frame-Options, CSP, HSTS)
# - Cache control headers
# - CORS headers
# - API versioning headers
# - Remove server identification for security
# - Custom application headers
#
# Security Best Practices:
# - Always remove 'Server' and 'X-Powered-By' headers
# - Add security headers for public endpoints
# - Use appropriate cache headers for different content types
# - Set CORS headers only where needed

routes:
  # Admin Panel with Basic Authentication
  - path: "/admin/*"
    method: "*"
    targets:
      - url: "http://backend1:80"
        weight: 1
    type: "http"
    timeout: "30s"
    retry_count: 2
    strip_path: true
    auth:
      type: "basic"
      username: "admin"
      password: "secret123"
      realm: "Admin Area"

  # Load Balanced API endpoints
  - path: "/api/*"
    method: "*"
    targets:
      - url: "http://backend1:80"
        weight: 3
      - url: "http://backend2:80"
        weight: 2
    type: "http"
    timeout: "15s"
    retry_count: 3
    strip_path: false
    load_balancer:
      strategy: "round_robin"
      health_check:
        enabled: true
        path: "/"
        interval: "30s"
        timeout: "5s"
        healthy_threshold: 2
        unhealthy_threshold: 3

  # WebSocket handling
  - path: "/ws/*"
    method: "*"
    targets:
      - url: "ws://websocket-backend:4001"
        weight: 1
    type: "websocket"
    timeout: "300s"
    retry_count: 1
    strip_path: true
    websocket:
      enable_compression: true
      read_buffer_size: 4096
      write_buffer_size: 4096
      handshake_timeout: "10s"

  # Static content with load balancing
  - path: "/static/*"
    method: "GET"
    targets:
      - url: "http://backend1:80"
        weight: 1
      - url: "http://backend2:80"
        weight: 1
    type: "http"
    timeout: "30s"
    retry_count: 2
    strip_path: false
    headers:
      add:
        Cache-Control: "public, max-age=3600"

  # Header Manipulation Examples - Add custom headers and remove server headers
  - path: "/secure-api/*"
    method: "*"
    targets:
      - url: "http://backend1:80"
        weight: 1
    type: "http"
    timeout: "30s"
    retry_count: 2
    strip_path: false
    headers:
      add:
        # Security headers
        X-Frame-Options: "DENY"
        X-Content-Type-Options: "nosniff"
        X-XSS-Protection: "1; mode=block"
        Strict-Transport-Security: "max-age=31536000; includeSubDomains"
        Content-Security-Policy: "default-src 'self'"
        # API specific headers
        X-API-Version: "v2.1"
        X-Rate-Limit: "1000"
        X-Custom-Header: "proxy-processed"
        # CORS headers
        Access-Control-Allow-Origin: "https://example.com"
        Access-Control-Allow-Methods: "GET, POST, PUT, DELETE"
        Access-Control-Allow-Headers: "Content-Type, Authorization"
      remove:
        # Remove server identification headers for security
        - "Server"
        - "X-Powered-By"
        - "X-AspNet-Version"
        - "X-AspNetMvc-Version"
        # Remove internal backend headers
        - "X-Backend-Server"
        - "X-Internal-IP"

  # Public API with minimal security headers
  - path: "/public-api/*"
    method: "*"
    targets:
      - url: "http://backend2:80"
        weight: 1
    type: "http"
    timeout: "15s"
    retry_count: 1
    strip_path: true
    headers:
      add:
        # Basic security headers for public endpoints
        X-Content-Type-Options: "nosniff"
        X-Frame-Options: "SAMEORIGIN"
        # Cache control for API responses
        Cache-Control: "no-cache, no-store, must-revalidate"
        Pragma: "no-cache"
        Expires: "0"
        # Custom identification
        X-Proxy-Name: "FastHTTP-Reverse-Proxy"
        X-Request-ID: "${request_id}"  # Note: This would need custom implementation
      remove:
        # Hide server details
        - "Server"
        - "X-Powered-By"

  # File Downloads with appropriate headers
  - path: "/downloads/*"
    method: "GET"
    targets:
      - url: "http://file-server:80"
        weight: 1
    type: "http"
    timeout: "300s"  # Longer timeout for file downloads
    retry_count: 1
    strip_path: false
    headers:
      add:
        # Download-specific headers
        Content-Disposition: "attachment"
        X-Content-Type-Options: "nosniff"
        # Cache control for downloads
        Cache-Control: "private, max-age=0"
        # Security headers
        X-Frame-Options: "DENY"
        X-XSS-Protection: "1; mode=block"
      remove:
        # Remove headers that might interfere with downloads
        - "X-Powered-By"
        - "Server"
        - "X-Debug-Info"

  # Health check for individual backends
  - path: "/health/backend1"
    method: "GET"
    targets:
      - url: "http://backend1:80"
        weight: 1
    type: "http"
    timeout: "10s"
    retry_count: 1
    strip_path: true

  - path: "/health/backend2"
    method: "GET"
    targets:
      - url: "http://backend2:80"
        weight: 1
    type: "http"
    timeout: "10s"
    retry_count: 1
    strip_path: true

  # Development Environment with Debug Headers
  - path: "/dev-api/*"
    method: "*"
    targets:
      - url: "http://dev-backend:80"
        weight: 1
    type: "http"
    timeout: "30s"
    retry_count: 1
    strip_path: true
    headers:
      add:
        # Development-specific headers
        X-Environment: "development"
        X-Debug-Mode: "enabled"
        X-Timestamp: "${timestamp}"  # Note: Custom implementation needed
        # CORS for development (more permissive)
        Access-Control-Allow-Origin: "*"
        Access-Control-Allow-Methods: "GET, POST, PUT, DELETE, OPTIONS, PATCH"
        Access-Control-Allow-Headers: "Content-Type, Authorization, X-Requested-With"
        Access-Control-Max-Age: "86400"
        # Cache prevention for development
        Cache-Control: "no-cache, no-store, must-revalidate, max-age=0"
        Pragma: "no-cache"
        Expires: "Thu, 01 Jan 1970 00:00:00 GMT"
      remove:
        # Keep minimal for debugging but remove sensitive info
        - "X-Internal-Token"
        - "X-Database-Host"

  # Production API with strict security headers
  - path: "/prod-api/*"
    method: "*"
    targets:
      - url: "http://prod-backend:80"
        weight: 1
    type: "http"
    timeout: "15s"
    retry_count: 3
    strip_path: true
    headers:
      add:
        # Strict security headers for production
        Strict-Transport-Security: "max-age=63072000; includeSubDomains; preload"
        Content-Security-Policy: "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; media-src 'none'; object-src 'none'; child-src 'none'; frame-ancestors 'none'; form-action 'self'; base-uri 'self'"
        X-Frame-Options: "DENY"
        X-Content-Type-Options: "nosniff"
        X-XSS-Protection: "1; mode=block"
        Referrer-Policy: "strict-origin-when-cross-origin"
        Permissions-Policy: "geolocation=(), microphone=(), camera=(), payment=(), usb=(), magnetometer=(), accelerometer=(), gyroscope=()"
        # API versioning and rate limiting
        X-API-Version: "v3.0"
        X-Rate-Limit-Policy: "strict"
        # Custom production headers
        X-Served-By: "FastHTTP-Proxy-Prod"
        X-Response-Time: "${response_time}"  # Note: Custom implementation needed
      remove:
        # Remove all identifying and debug headers in production
        - "Server"
        - "X-Powered-By"
        - "X-AspNet-Version"
        - "X-AspNetMvc-Version"
        - "X-Debug-Info"
        - "X-Backend-Server"
        - "X-Internal-IP"
        - "X-Runtime"
        - "X-Request-Id"
        - "X-Backend-Response-Time"

  # Image/Media serving with optimized headers
  - path: "/media/*"
    method: "GET"
    targets:
      - url: "http://media-server:80"
        weight: 1
    type: "http"
    timeout: "60s"
    retry_count: 2
    strip_path: false
    headers:
      add:
        # Optimized caching for media files
        Cache-Control: "public, max-age=31536000, immutable"  # 1 year cache
        ETag: "${file_hash}"  # Note: Custom implementation needed
        # Security headers for media
        X-Content-Type-Options: "nosniff"
        X-Frame-Options: "SAMEORIGIN"
        # Performance headers
        Vary: "Accept-Encoding"
        # CORS for media (if needed for web fonts, etc.)
        Access-Control-Allow-Origin: "https://cdn.example.com"
      remove:
        # Remove unnecessary headers for media files
        - "Server"
        - "X-Powered-By"
        - "Set-Cookie"  # Media files shouldn't set cookies

  # WebSocket with custom headers
  - path: "/realtime/*"
    method: "*"
    targets:
      - url: "ws://realtime-backend:4002"
        weight: 1
    type: "websocket"
    timeout: "300s"
    retry_count: 1
    strip_path: true
    websocket:
      enable_compression: true
      read_buffer_size: 8192
      write_buffer_size: 8192
      handshake_timeout: "15s"
    headers:
      add:
        # WebSocket-specific headers during handshake
        X-WebSocket-Protocol: "v1.0"
        X-Real-IP: "${client_ip}"  # Note: Custom implementation needed
        X-Forwarded-Proto: "wss"
        # Security headers for WebSocket handshake
        X-Frame-Options: "SAMEORIGIN"
        X-Content-Type-Options: "nosniff"
      remove:
        # Clean up handshake response
        - "Server"
        - "X-Powered-By"

  # API Gateway with comprehensive header management
  - path: "/gateway/*"
    method: "*"
    targets:
      - url: "http://api-gateway:80"
        weight: 1
    type: "http"
    timeout: "30s"
    retry_count: 2
    strip_path: true
    headers:
      add:
        # Gateway identification
        X-Gateway: "FastHTTP-Reverse-Proxy"
        X-Gateway-Version: "1.0.0"
        # Request tracing
        X-Trace-Id: "${trace_id}"  # Note: Custom implementation needed
        X-Span-Id: "${span_id}"   # Note: Custom implementation needed
        # Security headers
        X-Frame-Options: "DENY"
        X-Content-Type-Options: "nosniff"
        X-XSS-Protection: "1; mode=block"
        # CORS configuration
        Access-Control-Allow-Origin: "https://app.example.com"
        Access-Control-Allow-Credentials: "true"
        Access-Control-Allow-Methods: "GET, POST, PUT, DELETE, OPTIONS"
        Access-Control-Allow-Headers: "Content-Type, Authorization, X-Trace-Id"
        Access-Control-Expose-Headers: "X-Total-Count, X-Rate-Limit-Remaining"
        # Custom business headers
        X-Client-Version: "${client_version}"  # Note: Custom implementation needed
        X-Feature-Flags: "${feature_flags}"   # Note: Custom implementation needed
      remove:
        # Remove backend implementation details
        - "Server"
        - "X-Powered-By"
        - "X-Runtime"
        - "X-Database-Queries"
        - "X-Memory-Usage"
        - "X-Backend-Host"

  # Legacy API with compatibility headers
  - path: "/v1/*"
    method: "*"
    targets:
      - url: "http://legacy-backend:80"
        weight: 1
    type: "http"
    timeout: "45s"  # Legacy systems might be slower
    retry_count: 1
    strip_path: false
    headers:
      add:
        # Legacy compatibility headers
        X-API-Version: "v1.0"
        X-Deprecated: "true"
        X-Deprecation-Date: "2024-12-31"
        X-Migration-Guide: "https://docs.example.com/migrate-v2"
        # Basic security (less strict for legacy)
        X-Frame-Options: "SAMEORIGIN"
        X-Content-Type-Options: "nosniff"
        # Cache control for legacy responses
        Cache-Control: "no-cache, must-revalidate"
        # Warning header for deprecated API
        Warning: "299 - \"Deprecated API\""
      remove:
        # Remove modern headers that legacy clients might not understand
        - "Strict-Transport-Security"  # Might not be supported
        - "Content-Security-Policy"   # Might break legacy clients
        - "Server"
        - "X-Powered-By"

  # Health checks with monitoring headers
  - path: "/monitoring/*"
    method: "GET"
    targets:
      - url: "http://monitoring-backend:80"
        weight: 1
    type: "http"
    timeout: "10s"
    retry_count: 1
    strip_path: true
    headers:
      add:
        # Monitoring-specific headers
        X-Health-Check: "proxy"
        X-Monitoring-Source: "fasthttp-proxy"
        X-Check-Timestamp: "${timestamp}"  # Note: Custom implementation needed
        # Prevent caching of health checks
        Cache-Control: "no-cache, no-store, must-revalidate"
        Pragma: "no-cache"
        Expires: "0"
        # Basic security
        X-Content-Type-Options: "nosniff"
      remove:
        # Keep monitoring responses clean
        - "Server"
        - "X-Powered-By"
        - "Set-Cookie"

  # Default Route (catch-all) - Forward everything to backend1
  - path: "/*"
    method: "*"
    targets:
      - url: "http://backend1:80"
        weight: 1
    type: "http"
    timeout: "30s"
    retry_count: 1
    strip_path: false
    headers:
      add:
        # Basic headers for all unmatched requests
        X-Proxy: "FastHTTP-Reverse-Proxy"
        X-Forwarded-By: "proxy"
      remove:
        # Basic security cleanup
        - "Server"
        - "X-Powered-By"