<%

def routing_api_port
  if_p('routing_api.port') do |prop|
    return prop
  end.else do
    if_link('routing_api') do |link|
      return link.p('routing_api.mtls_port')
    end
  end
  raise RuntimeError, 'Routing API port not found in properties nor in routing_api Link. This value can be specified using the routing_api.port property.'
end

def reserved_system_component_ports
  if_p('reserved_system_component_ports') do |prop|
    return prop.map(&:to_i)
  end.else do
    if_link('routing_api') do |link|
      link.if_p('routing_api.reserved_system_component_ports') do |prop|
        return prop.map(&:to_i)
      end
    end
  end
  return []
end

def parse_ip (ip, var_name)
  unless ip.empty?
    ip = ip.split(":")[0]
      begin
        parsed = IPAddr.new ip
      rescue  => e
        raise "Invalid #{var_name} '#{ip}': #{e}"
      end
  end
end

parse_ip(p('tcp_router.debug_address'), 'tcp_router.debug_address')
%>
oauth:
  token_endpoint: <%= p("uaa.token_endpoint") %>
  client_name: "tcp_router"
  client_secret: <%= p("tcp_router.oauth_secret") %>
  port: <%= p("uaa.tls_port") %>
  skip_ssl_validation: <%= p("skip_ssl_validation") %>
  <% if p("uaa.ca_cert") != "" %>
  ca_certs: "/var/vcap/jobs/tcp_router/config/certs/uaa/ca.crt"
  <% end %>

routing_api:
  uri: <%= p("routing_api.uri") %>
  port: <%= routing_api_port %>
  auth_disabled: <%= p("routing_api.auth_disabled") %>
  client_cert_path: "/var/vcap/jobs/tcp_router/config/certs/routing-api/client.crt"
  ca_cert_path: "/var/vcap/jobs/tcp_router/config/certs/routing-api/ca_cert.crt"
  client_private_key_path: "/var/vcap/jobs/tcp_router/config/keys/routing-api/client.key"

haproxy_pid_file: "/var/vcap/data/tcp_router/config/haproxy.pid"
isolation_segments: <%= p("tcp_router.isolation_segments") %>
reserved_system_component_ports: <%=  reserved_system_component_ports %>

drain_wait: <%= p('tcp_router.drain_wait') %>s

<%
    backend_tls_enabled = p('tcp_router.backend_tls.enabled')

    if backend_tls_enabled
      ca_cert =     p('tcp_router.backend_tls.ca_cert', '').strip
      client_cert = p('tcp_router.backend_tls.client_cert', '').strip
      client_key =  p('tcp_router.backend_tls.client_key', '').strip

      if ca_cert == ''
        raise 'tcp_router.backend_tls.enabled was set to true, but tcp_router.backend_tls.ca_cert was not provided'
      end

      if client_cert == '' and client_key != ''
        raise 'tcp_router.backend_tls.enabled was set to true, tcp_router.backend_tls.client_key was set, but tcp_router.backend_tls.client_cert was not provided'
      end

      if client_key == '' and client_cert != ''
        raise 'tcp_router.backend_tls.enabled was set to true, tcp_router.backend_tls.client_cert was set, but tcp_router.backend_tls.client_key was not provided'
      end
    end
-%>

backend_tls:
  enabled: <%= backend_tls_enabled %>
<% if backend_tls_enabled %>
  ca_cert_path: "/var/vcap/jobs/tcp_router/config/certs/tcp-router/backend/ca.crt"
<% if client_cert != '' and client_key != '' %>
  client_cert_and_key_path: "/var/vcap/jobs/tcp_router/config/keys/tcp-router/backend/client_cert_and_key.pem"
<% end %>
<% end -%>
