# HAProxy target sidecar — Bundle 10 of the 2026-05-02 deployment-target audit.
#
# Minimal SSL-terminating config that boots green with the starter cert
# written by target-tls-init. The k6 connector-tier scenarios connect at
# sustained 100 conns/min and measure handshake-completion latency.

global
    log stdout local0 warning
    maxconn 4096
    # Bundle 10: starter cert+key live at /usr/local/etc/haproxy/certs/.
    # HAProxy expects a SINGLE PEM file containing cert + key concatenated;
    # the target-tls-init container writes target.pem in that combined form.
    ssl-default-bind-options ssl-min-ver TLSv1.2

defaults
    log global
    mode http
    option dontlognull
    timeout connect 5s
    timeout client 30s
    timeout server 30s

frontend https-in
    bind *:443 ssl crt /usr/local/etc/haproxy/certs/target.pem
    default_backend ok

backend ok
    # Static 200 OK — handshake-only loadtest doesn't exercise the backend.
    http-request return status 200 content-type text/plain string "ok\n"