{
  "slug": "netbird-reverse-proxy-service",
  "kind": "terraform",
  "metadata": {
    "name": "NetBird Reverse Proxy Service",
    "description": "Creates a NetBird reverse proxy service with one backend target and configurable authentication.",
    "tags": [
      "netbird",
      "terraform",
      "reverse-proxy"
    ],
    "icon": {
      "provider": "selfhst",
      "id": "netbird"
    },
    "draft": false,
    "version": {
      "name": "0.0.17",
      "source_dep_name": "manual/netbird-reverse-proxy-service"
    }
  },
  "variables": [
    {
      "title": "General",
      "name": "general",
      "items": [
        {
          "name": "service_name",
          "type": "str",
          "title": "Service Name",
          "required": true,
          "config": {
            "placeholder": "web-app"
          }
        },
        {
          "name": "domain_mode",
          "type": "enum",
          "title": "Domain Mode",
          "required": true,
          "default": "free",
          "config": {
            "options": [
              "free",
              "custom"
            ]
          }
        },
        {
          "name": "custom_domain",
          "type": "str",
          "title": "Custom Domain",
          "required": true,
          "description": "Validated custom domain for the reverse proxy service.",
          "needs": [
            "domain_mode=custom"
          ],
          "config": {
            "placeholder": "app.example.com"
          }
        },
        {
          "name": "service_enabled",
          "type": "bool",
          "title": "Enabled",
          "required": false,
          "default": true
        },
        {
          "name": "pass_host_header",
          "type": "bool",
          "title": "Pass Host Header",
          "required": false,
          "default": false,
          "description": "Pass the original client Host header through to the backend."
        },
        {
          "name": "rewrite_redirects",
          "type": "bool",
          "title": "Rewrite Redirects",
          "required": false,
          "default": false,
          "description": "Rewrite backend redirect locations to the public-facing service domain."
        }
      ]
    },
    {
      "title": "Target",
      "name": "target",
      "items": [
        {
          "name": "target_type",
          "type": "enum",
          "title": "Target Type",
          "required": true,
          "default": "peer",
          "description": "Target type for the backend service.",
          "config": {
            "options": [
              "peer",
              "host",
              "domain",
              "subnet"
            ]
          }
        },
        {
          "name": "target_peer_name",
          "type": "str",
          "title": "Peer Name",
          "required": true,
          "description": "Existing NetBird peer name to resolve via `data \"netbird_peer\"` when `target_type=peer`.",
          "needs": [
            "target_type=peer"
          ],
          "config": {
            "placeholder": "web-app"
          }
        },
        {
          "name": "target_network_name",
          "type": "str",
          "title": "Network Name",
          "required": true,
          "description": "Existing NetBird network name that contains the selected host, domain, or subnet resource.",
          "needs": [
            "target_type=host,domain,subnet"
          ],
          "config": {
            "placeholder": "production-network"
          }
        },
        {
          "name": "target_host_name",
          "type": "str",
          "title": "Host Resource Name",
          "required": true,
          "description": "Existing NetBird network resource name for a host target.",
          "needs": [
            "target_type=host"
          ],
          "config": {
            "placeholder": "internal-app-host"
          }
        },
        {
          "name": "target_domain_name",
          "type": "str",
          "title": "Domain Resource Name",
          "required": true,
          "description": "Existing NetBird network resource name for a domain target.",
          "needs": [
            "target_type=domain"
          ],
          "config": {
            "placeholder": "app.example.internal"
          }
        },
        {
          "name": "target_subnet_name",
          "type": "str",
          "title": "Subnet Resource Name",
          "required": true,
          "description": "Existing NetBird network resource name for a subnet target.",
          "needs": [
            "target_type=subnet"
          ],
          "config": {
            "placeholder": "corp-lan"
          }
        },
        {
          "name": "target_port",
          "type": "int",
          "title": "Target Port",
          "required": true,
          "default": 8080,
          "description": "Backend port for the target.",
          "config": {
            "placeholder": "8080"
          }
        },
        {
          "name": "target_protocol",
          "type": "enum",
          "title": "Target Protocol",
          "required": true,
          "default": "http",
          "config": {
            "options": [
              "http",
              "https"
            ]
          }
        },
        {
          "name": "target_enabled",
          "type": "bool",
          "title": "Target Enabled",
          "required": false,
          "default": true
        },
        {
          "name": "target_host",
          "type": "str",
          "title": "Resolved Host",
          "required": false,
          "description": "Optional backend IP or domain override for the target. Subnet targets need a host IP within the CIDR range.",
          "config": {
            "placeholder": "10.20.30.40"
          }
        },
        {
          "name": "target_path",
          "type": "str",
          "title": "Path Prefix",
          "required": false,
          "description": "Optional URL path prefix for the backend target.",
          "config": {
            "placeholder": "/"
          }
        }
      ]
    },
    {
      "title": "Authentication",
      "name": "authentication",
      "items": [
        {
          "name": "auth_mode",
          "type": "enum",
          "title": "Authentication Mode",
          "required": true,
          "default": "link",
          "description": "Authentication method exposed by the reverse proxy service.",
          "config": {
            "options": [
              "link",
              "none",
              "password",
              "pin",
              "bearer"
            ]
          }
        },
        {
          "name": "auth_password",
          "type": "secret",
          "title": "Password",
          "required": true,
          "description": "Shared password for password-based access.",
          "needs": [
            "auth_mode=password"
          ]
        },
        {
          "name": "auth_pin",
          "type": "secret",
          "title": "PIN",
          "required": true,
          "description": "Shared PIN for PIN-based access.",
          "needs": [
            "auth_mode=pin"
          ]
        },
        {
          "name": "bearer_distribution_group_names",
          "type": "str",
          "title": "Bearer Distribution Groups",
          "required": false,
          "description": "Comma-separated existing NetBird group names allowed for bearer-auth access.",
          "needs": [
            "auth_mode=bearer"
          ],
          "config": {
            "placeholder": "SRE,Incident Response",
            "textarea": true
          }
        }
      ]
    }
  ]
}