import type { WorkspaceConfig } from "@wrnexus/cli/workspace";

// Map each app to the domains it serves. `wrnexus gateway` runs them all behind
// one port and routes by Host header (add these hosts to your /etc/hosts).
const config: WorkspaceConfig = {
  defaultEnvironment: "development",
  environments: {
    development: {
      protocol: "http",
      rootDomain: "localhost",
      port: 3000,
      runtime: "development",
      hmr: true,
      build: false,
      migrate: false,
    },
    staging: {
      protocol: "https",
      rootDomain: "staging.example.com",
      port: 443,
      runtime: "production",
      hmr: false,
      build: true,
      migrate: true,
    },
    production: {
      protocol: "https",
      rootDomain: "example.com",
      port: 443,
      runtime: "production",
      hmr: false,
      build: true,
      migrate: true,
    },
  },
  // Gateway-wide security (all optional):
  security: {
    trustedHostsOnly: true, // reject requests for unknown domains
    rateLimit: { max: 300, windowMs: 60_000 }, // per client IP
    headers: true, // baseline security headers at the edge
    accessLog: true, // log host → app, method, path, status
  },
  apps: [
    { name: "web", dir: "apps/web", domains: ["localhost", "web.localhost"] },
    {
      name: "admin",
      dir: "apps/admin",
      domains: ["admin.localhost"],
      // Lock the admin app down at the edge (pick one):
      auth: { basic: { user: "admin", pass: "change-me" } },
      // auth: { allowIps: ["127.0.0.1", "::1"] },
      // auth: { forward: { url: "http://localhost:4001/api/verify" } }, // SSO
    },
  ],
};

export default config;