Support routes.

internal/services/manager.go

@@ -40,14 +40,66 @@ type Backend struct {
 	Health  string      `yaml:"health,omitempty" json:"health,omitempty"`
 }
 
+// HeaderConfig describes custom request/response headers for L7 HTTP services.
+type HeaderConfig struct {
+	Request  map[string]string `yaml:"request,omitempty" json:"request,omitempty"`
+	Response map[string]string `yaml:"response,omitempty" json:"response,omitempty"`
+}
+
+// Route describes one path→backend mapping within a service.
+// Routes are evaluated in order — first match wins.
+// A route with empty Paths is a catch-all (should be last).
+type Route struct {
+	Paths   []string      `yaml:"paths,omitempty" json:"paths,omitempty"`     // path prefixes (empty = catch-all)
+	Backend Backend       `yaml:"backend" json:"backend"`                     // where to route
+	Headers *HeaderConfig `yaml:"headers,omitempty" json:"headers,omitempty"` // per-route headers
+	IPAllow []string      `yaml:"ipAllow,omitempty" json:"ipAllow,omitempty"` // per-route CIDR whitelist
+}
+
 // Service represents a registered service. The Domain is the unique key.
+//
+// Simple services use Backend directly. Multi-backend services use Routes
+// for path-based splitting (Backend is ignored when Routes is present).
 type Service struct {
 	Domain     string  `yaml:"domain" json:"domain"`                             // FQDN — unique key
 	Source     string  `yaml:"source,omitempty" json:"source,omitempty"`         // who registered: wild-cloud, wild-works, manual
-	Backend    Backend `yaml:"backend" json:"backend"`                           // where to route
+	Backend    Backend `yaml:"backend,omitempty" json:"backend,omitempty"`       // single backend (simple case)
 	Subdomains bool    `yaml:"subdomains,omitempty" json:"subdomains,omitempty"` // also match *.domain
 	Public     bool    `yaml:"public,omitempty" json:"public,omitempty"`         // true = internet-visible (DDNS + external), false = LAN only
 	TLS        TLSMode `yaml:"tls,omitempty" json:"tls,omitempty"`              // passthrough or terminate
+
+	// Multi-backend path routing. When present, Backend is ignored.
+	// Each route maps path prefixes to a specific backend with its own L7 options.
+	Routes []Route `yaml:"routes,omitempty" json:"routes,omitempty"`
+}
+
+// EffectiveRoutes returns the service's routing as a normalized []Route.
+// Simple services (Backend, no Routes) are wrapped in a single-element slice.
+func (s *Service) EffectiveRoutes() []Route {
+	if len(s.Routes) > 0 {
+		return s.Routes
+	}
+	if s.Backend.Address == "" {
+		return nil
+	}
+	return []Route{{Backend: s.Backend}}
+}
+
+// EffectiveBackendAddress returns the primary backend address for DNS/DDNS purposes.
+// For multi-route services, returns the first route's backend.
+func (s *Service) EffectiveBackendAddress() string {
+	if len(s.Routes) > 0 {
+		return s.Routes[0].Backend.Address
+	}
+	return s.Backend.Address
+}
+
+// EffectiveBackendType returns the backend type for routing decisions.
+func (s *Service) EffectiveBackendType() BackendType {
+	if len(s.Routes) > 0 {
+		return s.Routes[0].Backend.Type
+	}
+	return s.Backend.Type
 }
 
 // Manager handles service registration CRUD and triggers networking reconciliation.
@@ -92,17 +144,36 @@ func (m *Manager) Register(svc Service) error {
 	if svc.Domain == "" {
 		return fmt.Errorf("domain is required")
 	}
-	if svc.Backend.Address == "" {
-		return fmt.Errorf("backend address is required")
+
+	hasBackend := svc.Backend.Address != ""
+	hasRoutes := len(svc.Routes) > 0
+
+	if hasBackend && hasRoutes {
+		return fmt.Errorf("service must use backend or routes, not both")
 	}
-	if svc.Backend.Type == "" {
-		return fmt.Errorf("backend type is required")
+	if !hasBackend && !hasRoutes {
+		return fmt.Errorf("backend address or routes required")
+	}
+
+	if hasRoutes {
+		for i, r := range svc.Routes {
+			if r.Backend.Address == "" {
+				return fmt.Errorf("route %d: backend address is required", i)
+			}
+			if r.Backend.Type == "" {
+				return fmt.Errorf("route %d: backend type is required", i)
+			}
+		}
+	} else {
+		if svc.Backend.Type == "" {
+			return fmt.Errorf("backend type is required")
+		}
 	}
-	// Public field is a bool — no validation needed (defaults to false)
 
 	// Default TLS mode based on backend type
 	if svc.TLS == "" {
-		if svc.Backend.Type == BackendTCPPassthrough {
+		bt := svc.EffectiveBackendType()
+		if bt == BackendTCPPassthrough {
 			svc.TLS = TLSPassthrough
 		} else {
 			svc.TLS = TLSTerminate
@@ -126,7 +197,14 @@ func (m *Manager) Register(svc Service) error {
 	slog.Info("service registered", "domain", svc.Domain, "public", svc.Public, "source", svc.Source, "subdomains", svc.Subdomains)
 
 	if m.reconcileFn != nil {
-		go m.reconcileFn()
+		go func() {
+			defer func() {
+				if r := recover(); r != nil {
+					slog.Error("reconcile panicked", "error", r)
+				}
+			}()
+			m.reconcileFn()
+		}()
 	}
 
 	return nil
@@ -222,7 +300,7 @@ func (m *Manager) DeregisterBySource(source, backendAddress string) error {
 	}
 
 	for _, svc := range svcs {
-		if svc.Source == source && svc.Backend.Address == backendAddress {
+		if svc.Source == source && svc.EffectiveBackendAddress() == backendAddress {
 			if err := m.Deregister(svc.Domain); err != nil {
 				slog.Warn("failed to deregister service during cleanup", "domain", svc.Domain, "error", err)
 			}
@@ -256,6 +334,8 @@ func (m *Manager) Update(domain string, updates map[string]any) error {
 			svc.Backend.Health = health
 		}
 	}
+	// Routes is a full replacement — partial route updates are too complex
+	// to express via map[string]any. Re-register the full service instead.
 
 	return m.Register(*svc)
 }