name: HAProxy Config Check

on:
  pull_request:
    paths:
      - "haproxy/**"
      - "docs/haproxy-kalinamall.cfg"
      - ".github/workflows/haproxy-lint.yml"
  push:
    branches:
      - main
    paths:
      - "haproxy/**"
      - "docs/haproxy-kalinamall.cfg"
      - ".github/workflows/haproxy-lint.yml"

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install haproxy
        run: |
          sudo apt-get update
          sudo apt-get install -y haproxy

      - name: Prepare include files and dummy cert
        run: |
          sudo mkdir -p /etc/haproxy /etc/haproxy/certs
          sudo cp haproxy/haproxy.cfg /etc/haproxy/haproxy.cfg
          echo "127.0.0.1/32" | sudo tee /etc/haproxy/allowed_ips.lst >/dev/null
          echo "127.0.0.1/32" | sudo tee /etc/haproxy/allowed_ips_knock.lst >/dev/null
          openssl req -x509 -nodes -newkey rsa:2048 \
            -keyout /tmp/tls.key \
            -out /tmp/tls.crt \
            -days 1 \
            -subj "/CN=git.papatramp.ru"
          cat /tmp/tls.crt /tmp/tls.key | sudo tee /etc/haproxy/certs/papatramp.pem >/dev/null

      - name: Validate haproxy cfg
        run: |
          sudo haproxy -c -f /etc/haproxy/haproxy.cfg

      - name: Validate kalinamall perimeter + Gitea HAProxy example
        run: |
          sudo haproxy -c -f docs/haproxy-kalinamall.cfg