# Whitebox Configuration
# ========================
#
# This YAML file configures monitoring scopes for external VPN services.
# Each scope defines an HTTP probe with validation rules.

xray:
  # Reuse of started xray instances across probes.
  #
  # This is what keeps memory flat. xray-core's xhttp, grpc and hysteria
  # transports cache per-connection state in package-level maps keyed by a
  # pointer that is allocated per instance, and never evict from them, so
  # building one instance per probe leaks a permanent entry per probe.
  instance_cache:
    enabled: true

    # Idle time after which an unused instance is closed. A value comfortably
    # above the Prometheus scrape interval keeps steady-state targets warm
    ttl: 10m

    # Maximum cached instances, roughly "how many distinct connection URIs are
    # scraped". Kept modest because each one holds a started xray instance and
    # its open connections. In-flight probes are never evicted to satisfy it.
    #
    # Wireguard and amneziawg outbounds are never cached at all - their tunnel
    # device is bound to the context of the probe that built it
    max_entries: 64

scopes:
  # Default monitoring scope (fallback)
  default:
    timeout: 5s

    http:
      max_redirects: 5
      method: GET

      # Custom request headers
      headers:
        User-Agent: "whitebox/1.0.0"
        Accept: "text/plain,*/*"

      # Request body (mutually exclusive with body_file)
      # body: '{"status": "alive"}'

      # File containing request body
      # body_file: "./request-payload.json"

  # Example check alive scope
  check_alive:
    timeout: 5s

    http:
      max_redirects: 5
      method: POST

      headers:
        # Environment variables interpolation
        Authorization: "Bearer ${BEARER_AUTH:-dXNlcjpwYXNz}"
        Content-Type: "application/json"

      body: '{"ping": true}'

      # Response validation rules
      fail_if:
        # Fail if SSL/TLS handshake is performed
        - mod: ssl

        # Fail if HTTP status is NOT 200
        - mod: status_code_matches
          val: "200"
          inv: true

        # Fail if response body does NOT contain "alive" or "healthy"
        - mod: body_matches_regexp
          val: "alive|healthy"
          inv: true

        # Fail if JSON response.status != "ok" (CEL expression)
        - mod: body_json_matches_cel
          val: 'response.status == "ok"'
          inv: true

        # Fail if "Server" header does NOT match nginx/apache patterns
        - mod: header_matches_regexp
          val: "Server:\\s?nginx|Server:\\s?apache"
          inv: true