/**
 * Reverse Proxy for Onebox
 *
 * Delegates to CoreTraffic (running as Docker service) for production-grade reverse proxy
 * with TLS termination, WebSocket proxying, and zero-downtime configuration updates.
 *
 * Routes use Docker service names (e.g., onebox-hello-world:80) for container-to-container
 * communication within the Docker overlay network.
 */
import { type ICoreTrafficStatusObservation } from './coretraffic.js';
import type { IService } from '../types.js';
interface IProxyRoute {
    domain: string;
    targetHost: string;
    targetPort: number;
    serviceId?: number;
    serviceName?: string;
    routeType: 'service' | 'admin-ui';
}
export declare class OneboxReverseProxy {
    private oneboxRef;
    private database;
    private coreTraffic;
    private routes;
    private httpPort;
    private httpsPort;
    constructor(oneboxRef: any);
    private ensureCoreTrafficAdminToken;
    /**
     * Initialize reverse proxy - CoreTraffic runs as Docker service, no setup needed
     */
    init(): Promise<void>;
    /**
     * Start the HTTP/HTTPS reverse proxy server
     * CoreTraffic handles both HTTP and HTTPS on the configured ports
     */
    startHttp(port?: number): Promise<void>;
    /**
     * Start HTTPS - CoreTraffic already handles HTTPS when started
     * This method exists for interface compatibility
     */
    startHttps(port?: number): Promise<void>;
    /**
     * Stop the reverse proxy
     */
    stop(): Promise<void>;
    /**
     * Add a route for a service
     * Uses Docker service name for upstream (CoreTraffic runs in same Docker network)
     */
    addRoute(serviceId: number, domain: string, targetPort: number): Promise<void>;
    addAdminUiRoute(domain: string): Promise<void>;
    /**
     * Remove a route
     */
    removeRoute(domain: string): Promise<void>;
    /**
     * Get all routes
     */
    getRoutes(): IProxyRoute[];
    /**
     * Reload routes from database
     */
    reloadRoutes(): Promise<void>;
    /**
     * Reapply the desired runtime config without rebuilding it from the database.
     * This rehydrates CoreTraffic after Docker replaces its service task.
     */
    reapplyRuntimeConfig(): Promise<void>;
    reloadPublicPortRoutes(optionsArg?: {
        excludeServiceId?: number;
    }): Promise<void>;
    validatePublicPortRoutesForServices(servicesArg: IService[]): void;
    private normalizeServicePortConfig;
    private resolveServiceRoutePort;
    private getServiceDomainNames;
    private getServicePublicPortRoutes;
    private getAdminUiDomain;
    private getAdminUiTargetHost;
    /**
     * Add TLS certificate for a domain
     * Sends PEM content to CoreTraffic via Admin API
     */
    addCertificate(domain: string, certPem: string, keyPem: string): Promise<void>;
    /**
     * Remove TLS certificate for a domain
     */
    removeCertificate(domain: string): Promise<void>;
    /**
     * Reload TLS certificates from database
     */
    reloadCertificates(): Promise<void>;
    /**
     * Get status of reverse proxy
     */
    observeStatus(): Promise<{
        state: ICoreTrafficStatusObservation['state'];
        running: boolean | null;
        observedAt: number;
        http: {
            running: boolean | null;
            port: number;
        };
        https: {
            running: boolean | null;
            port: number;
            certificates: number;
        };
        routes: number;
        backend: 'coretraffic-docker';
    }>;
    getStatus(): {
        http: {
            running: boolean;
            port: number;
        };
        https: {
            running: boolean;
            port: number;
            certificates: number;
        };
        routes: number;
        backend: string;
    };
}
export {};
