# Telemt API gateway — copy to config.yaml and mount into the container.
#
# Semantics: client calls  GET /api/{alias}/health
#            forwarded to   GET {base_url}/v1/health

listen: ":8080"

# If true, IP whitelist is not enforced (development only).
allow_all: false

# CIDR allowlist when allow_all is false. Empty list denies all clients.
whitelist_cidrs:
  - "127.0.0.1/32"
  - "::1/128"
  # Docker bridge (adjust to your environment):
  # - "172.16.0.0/12"

# When the direct TCP peer is in these CIDRs, client IP for whitelist is taken
# from X-Forwarded-For (first hop) or X-Real-IP (e.g. behind nginx).
# trusted_proxies:
#   - "10.0.0.0/8"
trusted_proxies: []

servers:
  - alias: main_srv
    base_url: http://127.0.0.1:9091
    # Default path prefix on upstream (Telemt Control API uses /v1).
    path_prefix: /v1
    # Optional: name of environment variable whose value is sent as Authorization
    # to this upstream (exact string, Telemt auth_header semantics).
    # authorization_env: TELEMT_API_AUTH