# 太一声明式资源模板
#
# 替换示例域名和上游地址，用 `tiyi crs list` 核对 CRS 版本，先执行
# `tiyi diff -f apply.yaml`，确认后再执行 `tiyi apply -f apply.yaml`。
#
# spec 会完整替换 apply 管理的字段，不是 merge patch。从文件中删除文档并不会
# 删除已存在的资源。

apiVersion: tiyi.io/v1
kind: Policy
metadata:
  name: app-baseline
spec:
  engineState: "on"          # on | detection_only | off
  blockingMode: anomaly    # anomaly | self_contained
  crsRulesetRef: "4.25.1" # 已存在的 CRS ID 或版本
  status: active           # draft | active | archived
---
apiVersion: tiyi.io/v1
kind: Upstream
metadata:
  name: app-pool
spec:
  backends:
    - url: http://127.0.0.1:9000
      weight: 100
  loadBalance: round_robin
  # path 留空时关闭主动探测；启用后，每个后端都必须通过 Controller 的提交预检。
  healthCheck:
    path: ""
    method: GET
    expectedStatus: 200
    intervalSeconds: 30
    timeoutSeconds: 5
    unhealthyThreshold: 3
    healthyThreshold: 2
    followRedirects: false
    expectedBody: ""
    host: ""
  status: active           # active | disabled
---
apiVersion: tiyi.io/v1
kind: Site
metadata:
  name: app-example
spec:
  primaryHost: app.example.com
  aliases:
    - www.app.example.com
  upstreamRef: app-pool
  # upstreamRef 与 upstreamsInline 二选一，不能同时填写。
  tls:
    mode: none             # none | uploaded | managed_acme
    # 启用 TLS 时再添加 certRef/minVersion 和 httpBehavior。证书需先用
    # `tiyi cert upload` 或 `tiyi cert issue` 单独创建。
  waf:
    enabled: true
    policyRef: app-baseline
    mode: blocking
  botProtection:
    mode: "off"               # off | browser_check | human_verification
    challengeTtlSeconds: 120
    clearanceTtlSeconds: 3600
    proofDifficulty: 16
    bindNetwork: true
    exemptPaths:
      - /healthz
    trustedIpListRefs: []
  status: active           # active | disabled
---
apiVersion: tiyi.io/v1
kind: IpList
metadata:
  name: office-addresses
spec:
  description: 办公出口地址
  entries:
    - cidr: 203.0.113.0/24
      description: 主办公区
    - cidr: 2001:db8:100::/48
      description: 主办公区 IPv6
      expireAt: 2026-12-31T00:00:00Z

# IpList apply 只管理地址数据。需要另外创建 IP 列表绑定才会产生允许、拒绝或观察
# 行为。geo:* 会被拒绝；国家/地区防护请使用 Country Access。

# 当前 apply 无法按名称解析 Bot 可信列表；先创建地址列表，再在站点 Bot 设置中绑定。