ingress

const (
	// AnnotationProtocol specifies the backend protocol: http, https, tcp, udp, ssh, rdp, smb, wss, ws
	// Can be used on both Ingress and Service resources.
	// Priority: Ingress annotation > Service annotation > appProtocol > port name > default
	AnnotationProtocol = AnnotationPrefix + "protocol"

	// AnnotationProtocolPrefix is the prefix for port-specific protocol annotations.
	// Usage: cloudflare.com/protocol-{port} = http|https|...
	// Example: cloudflare.com/protocol-9091 = http
	AnnotationProtocolPrefix = AnnotationPrefix + "protocol-"

	// AnnotationNoTLSVerify disables TLS verification for HTTPS origins ("true" or "false")
	AnnotationNoTLSVerify = AnnotationPrefix + "no-tls-verify"

	// AnnotationHTTP2Origin enables HTTP/2 to origin ("true" or "false")
	AnnotationHTTP2Origin = AnnotationPrefix + "http2-origin"

	// AnnotationCAPool specifies the Secret name containing CA certificate for backend verification
	AnnotationCAPool = AnnotationPrefix + "ca-pool"
)

const (
	// AnnotationProxyAddress specifies the proxy address for bastion mode
	AnnotationProxyAddress = AnnotationPrefix + "proxy-address"

	// AnnotationProxyPort specifies the proxy port for bastion mode
	AnnotationProxyPort = AnnotationPrefix + "proxy-port"

	// AnnotationProxyType specifies the proxy type: "" (none) or "socks"
	AnnotationProxyType = AnnotationPrefix + "proxy-type"
)

const (
	// AnnotationConnectTimeout specifies connection timeout (e.g., "30s")
	AnnotationConnectTimeout = AnnotationPrefix + "connect-timeout"

	// AnnotationTLSTimeout specifies TLS handshake timeout (e.g., "10s")
	AnnotationTLSTimeout = AnnotationPrefix + "tls-timeout"

	// AnnotationKeepAliveTimeout specifies keep-alive timeout (e.g., "90s")
	AnnotationKeepAliveTimeout = AnnotationPrefix + "keep-alive-timeout"

	// AnnotationKeepAliveConnections specifies max idle connections
	AnnotationKeepAliveConnections = AnnotationPrefix + "keep-alive-connections"
)

const (
	// AnnotationOriginServerName overrides the hostname used for TLS verification
	AnnotationOriginServerName = AnnotationPrefix + "origin-server-name"

	// AnnotationHTTPHostHeader overrides the Host header sent to origin
	AnnotationHTTPHostHeader = AnnotationPrefix + "http-host-header"
)

const (
	// AnnotationDisableDNS disables DNS record creation for this Ingress ("true" to disable)
	AnnotationDisableDNS = AnnotationPrefix + "disable-dns"

	// AnnotationDNSProxied controls whether DNS is proxied through Cloudflare ("true" or "false")
	AnnotationDNSProxied = AnnotationPrefix + "dns-proxied"
)

const (
	// AnnotationDisableChunkedEncoding disables chunked transfer encoding
	AnnotationDisableChunkedEncoding = AnnotationPrefix + "disable-chunked-encoding"

	// AnnotationBastionMode enables bastion mode
	AnnotationBastionMode = AnnotationPrefix + "bastion-mode"
)

const (
	// ControllerName is the name registered with IngressClass
	ControllerName = "cloudflare-operator.io/ingress-controller"

	// FinalizerName is the finalizer added to managed Ingresses
	FinalizerName = "ingress.cloudflare-operator.io/finalizer"

	// ManagedByAnnotation marks resources managed by this controller
	ManagedByAnnotation = "cloudflare.com/managed-by"

	// ManagedByValue is the value for ManagedByAnnotation
	ManagedByValue = "cloudflare-operator-ingress"

	// IngressClassAnnotation is the legacy annotation for ingress class
	IngressClassAnnotation = "kubernetes.io/ingress.class"
)

const AnnotationPrefix = "cloudflare.com/"