/**
 * NFTables Route Helper Functions
 *
 * This module provides utility functions for creating NFTables-based route configurations
 * for high-performance packet forwarding at the kernel level.
 */
import { createHttpToHttpsRedirect } from './https-helpers.js';
/**
 * Create an NFTables-based route for high-performance packet forwarding
 * @param nameOrDomains Name or domain(s) to match
 * @param target Target host and port
 * @param options Additional route options
 * @returns Route configuration object
 */
export function createNfTablesRoute(nameOrDomains, target, options = {}) {
    // Determine if this is a name or domain
    let name;
    let domains;
    if (Array.isArray(nameOrDomains) || (typeof nameOrDomains === 'string' && nameOrDomains.includes('.'))) {
        domains = nameOrDomains;
        name = Array.isArray(nameOrDomains) ? nameOrDomains[0] : nameOrDomains;
    }
    else {
        name = nameOrDomains;
        domains = undefined; // No domains
    }
    // Create route match
    const match = {
        domains,
        ports: options.ports || 80
    };
    // Create route action
    const action = {
        type: 'forward',
        targets: [{
                host: target.host,
                port: target.port
            }],
        forwardingEngine: 'nftables',
        nftables: {
            protocol: options.protocol || 'tcp',
            preserveSourceIP: options.preserveSourceIP,
            maxRate: options.maxRate,
            priority: options.priority,
            tableName: options.tableName,
            useIPSets: options.useIPSets,
            useAdvancedNAT: options.useAdvancedNAT
        }
    };
    // Add TLS options if needed
    if (options.useTls) {
        action.tls = {
            mode: 'passthrough'
        };
    }
    // Create the route config
    const routeConfig = {
        name,
        match,
        action
    };
    // Add security if allowed or blocked IPs are specified
    if (options.ipAllowList?.length || options.ipBlockList?.length) {
        routeConfig.security = {
            ipAllowList: options.ipAllowList,
            ipBlockList: options.ipBlockList
        };
    }
    return routeConfig;
}
/**
 * Create an NFTables-based TLS termination route
 * @param nameOrDomains Name or domain(s) to match
 * @param target Target host and port
 * @param options Additional route options
 * @returns Route configuration object
 */
export function createNfTablesTerminateRoute(nameOrDomains, target, options = {}) {
    // Create basic NFTables route
    const route = createNfTablesRoute(nameOrDomains, target, {
        ...options,
        ports: options.ports || 443,
        useTls: false
    });
    // Set TLS termination
    route.action.tls = {
        mode: 'terminate',
        certificate: options.certificate || 'auto'
    };
    return route;
}
/**
 * Create a complete NFTables-based HTTPS setup with HTTP redirect
 * @param nameOrDomains Name or domain(s) to match
 * @param target Target host and port
 * @param options Additional route options
 * @returns Array of two route configurations (HTTPS and HTTP redirect)
 */
export function createCompleteNfTablesHttpsServer(nameOrDomains, target, options = {}) {
    // Create the HTTPS route using NFTables
    const httpsRoute = createNfTablesTerminateRoute(nameOrDomains, target, {
        ...options,
        ports: options.httpsPort || 443
    });
    // Determine the domain(s) for HTTP redirect
    const domains = typeof nameOrDomains === 'string' && !nameOrDomains.includes('.')
        ? undefined
        : nameOrDomains;
    // Extract the HTTPS port for the redirect destination
    const httpsPort = typeof options.httpsPort === 'number'
        ? options.httpsPort
        : Array.isArray(options.httpsPort) && typeof options.httpsPort[0] === 'number'
            ? options.httpsPort[0]
            : 443;
    // Create the HTTP redirect route (this uses standard forwarding, not NFTables)
    const httpRedirectRoute = createHttpToHttpsRedirect(domains, // Type cast needed since domains can be undefined now
    httpsPort, {
        match: {
            ports: options.httpPort || 80,
            domains: domains // Type cast needed since domains can be undefined now
        },
        name: `HTTP to HTTPS Redirect for ${Array.isArray(domains) ? domains.join(', ') : domains || 'all domains'}`
    });
    return [httpsRoute, httpRedirectRoute];
}
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmZ0YWJsZXMtaGVscGVycy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uLy4uL3RzL3Byb3hpZXMvc21hcnQtcHJveHkvdXRpbHMvcm91dGUtaGVscGVycy9uZnRhYmxlcy1oZWxwZXJzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOzs7OztHQUtHO0FBR0gsT0FBTyxFQUFFLHlCQUF5QixFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFFL0Q7Ozs7OztHQU1HO0FBQ0gsTUFBTSxVQUFVLG1CQUFtQixDQUNqQyxhQUFnQyxFQUNoQyxNQUFtRCxFQUNuRCxVQVlJLEVBQUU7SUFFTix3Q0FBd0M7SUFDeEMsSUFBSSxJQUFZLENBQUM7SUFDakIsSUFBSSxPQUFzQyxDQUFDO0lBRTNDLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLE9BQU8sYUFBYSxLQUFLLFFBQVEsSUFBSSxhQUFhLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUN2RyxPQUFPLEdBQUcsYUFBYSxDQUFDO1FBQ3hCLElBQUksR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxhQUFhLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLGFBQWEsQ0FBQztJQUN6RSxDQUFDO1NBQU0sQ0FBQztRQUNOLElBQUksR0FBRyxhQUFhLENBQUM7UUFDckIsT0FBTyxHQUFHLFNBQVMsQ0FBQyxDQUFDLGFBQWE7SUFDcEMsQ0FBQztJQUVELHFCQUFxQjtJQUNyQixNQUFNLEtBQUssR0FBZ0I7UUFDekIsT0FBTztRQUNQLEtBQUssRUFBRSxPQUFPLENBQUMsS0FBSyxJQUFJLEVBQUU7S0FDM0IsQ0FBQztJQUVGLHNCQUFzQjtJQUN0QixNQUFNLE1BQU0sR0FBaUI7UUFDM0IsSUFBSSxFQUFFLFNBQVM7UUFDZixPQUFPLEVBQUUsQ0FBQztnQkFDUixJQUFJLEVBQUUsTUFBTSxDQUFDLElBQUk7Z0JBQ2pCLElBQUksRUFBRSxNQUFNLENBQUMsSUFBSTthQUNsQixDQUFDO1FBQ0YsZ0JBQWdCLEVBQUUsVUFBVTtRQUM1QixRQUFRLEVBQUU7WUFDUixRQUFRLEVBQUUsT0FBTyxDQUFDLFFBQVEsSUFBSSxLQUFLO1lBQ25DLGdCQUFnQixFQUFFLE9BQU8sQ0FBQyxnQkFBZ0I7WUFDMUMsT0FBTyxFQUFFLE9BQU8sQ0FBQyxPQUFPO1lBQ3hCLFFBQVEsRUFBRSxPQUFPLENBQUMsUUFBUTtZQUMxQixTQUFTLEVBQUUsT0FBTyxDQUFDLFNBQVM7WUFDNUIsU0FBUyxFQUFFLE9BQU8sQ0FBQyxTQUFTO1lBQzVCLGNBQWMsRUFBRSxPQUFPLENBQUMsY0FBYztTQUN2QztLQUNGLENBQUM7SUFFRiw0QkFBNEI7SUFDNUIsSUFBSSxPQUFPLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDbkIsTUFBTSxDQUFDLEdBQUcsR0FBRztZQUNYLElBQUksRUFBRSxhQUFhO1NBQ3BCLENBQUM7SUFDSixDQUFDO0lBRUQsMEJBQTBCO0lBQzFCLE1BQU0sV0FBVyxHQUFpQjtRQUNoQyxJQUFJO1FBQ0osS0FBSztRQUNMLE1BQU07S0FDUCxDQUFDO0lBRUYsdURBQXVEO0lBQ3ZELElBQUksT0FBTyxDQUFDLFdBQVcsRUFBRSxNQUFNLElBQUksT0FBTyxDQUFDLFdBQVcsRUFBRSxNQUFNLEVBQUUsQ0FBQztRQUMvRCxXQUFXLENBQUMsUUFBUSxHQUFHO1lBQ3JCLFdBQVcsRUFBRSxPQUFPLENBQUMsV0FBVztZQUNoQyxXQUFXLEVBQUUsT0FBTyxDQUFDLFdBQVc7U0FDakMsQ0FBQztJQUNKLENBQUM7SUFFRCxPQUFPLFdBQVcsQ0FBQztBQUNyQixDQUFDO0FBRUQ7Ozs7OztHQU1HO0FBQ0gsTUFBTSxVQUFVLDRCQUE0QixDQUMxQyxhQUFnQyxFQUNoQyxNQUFtRCxFQUNuRCxVQVlJLEVBQUU7SUFFTiw4QkFBOEI7SUFDOUIsTUFBTSxLQUFLLEdBQUcsbUJBQW1CLENBQy9CLGFBQWEsRUFDYixNQUFNLEVBQ047UUFDRSxHQUFHLE9BQU87UUFDVixLQUFLLEVBQUUsT0FBTyxDQUFDLEtBQUssSUFBSSxHQUFHO1FBQzNCLE1BQU0sRUFBRSxLQUFLO0tBQ2QsQ0FDRixDQUFDO0lBRUYsc0JBQXNCO0lBQ3RCLEtBQUssQ0FBQyxNQUFNLENBQUMsR0FBRyxHQUFHO1FBQ2pCLElBQUksRUFBRSxXQUFXO1FBQ2pCLFdBQVcsRUFBRSxPQUFPLENBQUMsV0FBVyxJQUFJLE1BQU07S0FDM0MsQ0FBQztJQUVGLE9BQU8sS0FBSyxDQUFDO0FBQ2YsQ0FBQztBQUVEOzs7Ozs7R0FNRztBQUNILE1BQU0sVUFBVSxpQ0FBaUMsQ0FDL0MsYUFBZ0MsRUFDaEMsTUFBbUQsRUFDbkQsVUFhSSxFQUFFO0lBRU4sd0NBQXdDO0lBQ3hDLE1BQU0sVUFBVSxHQUFHLDRCQUE0QixDQUM3QyxhQUFhLEVBQ2IsTUFBTSxFQUNOO1FBQ0UsR0FBRyxPQUFPO1FBQ1YsS0FBSyxFQUFFLE9BQU8sQ0FBQyxTQUFTLElBQUksR0FBRztLQUNoQyxDQUNGLENBQUM7SUFFRiw0Q0FBNEM7SUFDNUMsTUFBTSxPQUFPLEdBQUcsT0FBTyxhQUFhLEtBQUssUUFBUSxJQUFJLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUM7UUFDL0UsQ0FBQyxDQUFDLFNBQVM7UUFDWCxDQUFDLENBQUMsYUFBYSxDQUFDO0lBRWxCLHNEQUFzRDtJQUN0RCxNQUFNLFNBQVMsR0FBRyxPQUFPLE9BQU8sQ0FBQyxTQUFTLEtBQUssUUFBUTtRQUNyRCxDQUFDLENBQUMsT0FBTyxDQUFDLFNBQVM7UUFDbkIsQ0FBQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxJQUFJLE9BQU8sT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsS0FBSyxRQUFRO1lBQzVFLENBQUMsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQztZQUN0QixDQUFDLENBQUMsR0FBRyxDQUFDO0lBRVYsK0VBQStFO0lBQy9FLE1BQU0saUJBQWlCLEdBQUcseUJBQXlCLENBQ2pELE9BQWMsRUFBRSxzREFBc0Q7SUFDdEUsU0FBUyxFQUNUO1FBQ0UsS0FBSyxFQUFFO1lBQ0wsS0FBSyxFQUFFLE9BQU8sQ0FBQyxRQUFRLElBQUksRUFBRTtZQUM3QixPQUFPLEVBQUUsT0FBYyxDQUFDLHNEQUFzRDtTQUMvRTtRQUNELElBQUksRUFBRSw4QkFBOEIsS0FBSyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxJQUFJLGFBQWEsRUFBRTtLQUM3RyxDQUNGLENBQUM7SUFFRixPQUFPLENBQUMsVUFBVSxFQUFFLGlCQUFpQixDQUFDLENBQUM7QUFDekMsQ0FBQyJ9