{% extends "base.html" %}
{% block title %}Settings{% endblock %}
{% block content %}
<div class="page-head">
  <div>
    <h1>Settings</h1>
    <p class="muted">Listener-wide HAProxy options. Saved settings are staged like route changes.</p>
  </div>
</div>

{% if errors %}
<div class="banner banner-error" role="alert"><ul>{% for e in errors %}<li>{{ e }}</li>{% endfor %}</ul></div>
{% endif %}

<form class="card form" method="post" action="/settings">
  <input type="hidden" name="csrf" value="{{ user.csrf }}">
  <div class="field">
    <label for="bind_address">Listen address</label>
    <input id="bind_address" name="bind_address" value="{{ options.bind_address }}">
    <p class="hint"><code>*</code> listens on every address. Use one IPv4 address to keep HAProxy off other interfaces.</p>
  </div>
  <label class="check"><input type="checkbox" name="http_redirect_unmatched" value="1" {{ 'checked' if options.http_redirect_unmatched == '1' }}> On port 80, redirect hostnames with no HTTP route to HTTPS</label>
  <p class="hint">Turning this on makes HAProxy listen on port 80 even with no HTTP routes. Ignored when an HTTP route is marked default.</p>
  <div class="row">
    <div class="field">
      <label for="timeout_connect">Connect timeout</label>
      <input id="timeout_connect" name="timeout_connect" value="{{ options.timeout_connect }}">
    </div>
    <div class="field">
      <label for="timeout_tunnel">Idle connection timeout</label>
      <input id="timeout_tunnel" name="timeout_tunnel" value="{{ options.timeout_tunnel }}">
      <p class="hint">Keep at 1h for Outlook and ActiveSync.</p>
    </div>
    <div class="field">
      <label for="timeout_http">HTTP client timeout</label>
      <input id="timeout_http" name="timeout_http" value="{{ options.timeout_http }}">
    </div>
  </div>
  <div class="form-actions"><button class="btn" type="submit">Save settings</button></div>
</form>

<section class="card">
  <h2>Server configuration</h2>
  <p class="muted">Set in <code>/etc/hapman/hapman.env</code>; restart HAPMan after changing.</p>
  <dl class="kv">
    <dt>Sign-in</dt><dd>Entra ID, tenant <code>{{ env.entra_tenant_id or 'not set' }}</code></dd>
    <dt>Client secret expires</dt><dd>{{ env.entra_secret_expires or 'unknown' }}{% if env.secret_days_left is not none %} ({{ env.secret_days_left }} days){% endif %}</dd>
    <dt>App role required</dt><dd>{{ env.required_role or 'none' }}</dd>
    <dt>Allowed users</dt><dd>{{ env.allowed_users | join(', ') if env.allowed_users else 'any user with the role' }}</dd>
    <dt>HAProxy config</dt><dd><code>{{ env.haproxy_cfg }}</code></dd>
    <dt>Runtime socket</dt><dd><code>{{ env.haproxy_socket }}</code></dd>
    <dt>Reserved ports</dt><dd>{{ env.reserved_ports | join(', ') }}</dd>
  </dl>
</section>
{% endblock %}