It's state, not config.

internal/api/v1/helpers.go

@@ -4,7 +4,6 @@ import (
 	"fmt"
 	"log/slog"
 	"os"
-	"path/filepath"
 	"strings"
 	"time"
 
@@ -72,10 +71,9 @@ func (api *API) reconcileNetworking() {
 		return
 	}
 
-	globalConfigPath := filepath.Join(api.dataDir, "config.yaml")
-	globalCfg, err := config.LoadGlobalConfig(globalConfigPath)
+	globalCfg, err := config.LoadState(api.statePath())
 	if err != nil {
-		slog.Warn("reconcile: failed to load global config, using empty", "error", err)
+		slog.Warn("reconcile: failed to load state, using empty", "error", err)
 		globalCfg = &config.GlobalConfig{}
 	}
 
@@ -84,20 +82,30 @@ func (api *API) reconcileNetworking() {
 	var httpRoutes []haproxy.HTTPRoute
 
 	for _, svc := range svcs {
-		switch svc.Backend.Type {
+		switch svc.EffectiveBackendType() {
 		case services.BackendTCPPassthrough:
 			instanceRoutes = append(instanceRoutes, haproxy.InstanceRoute{
 				Name:       svc.Domain,
 				Domain:     svc.Domain,
-				BackendIP:  extractHost(svc.Backend.Address),
+				BackendIP:  extractHost(svc.EffectiveBackendAddress()),
 				Subdomains: svc.Subdomains,
 			})
 		case services.BackendHTTP:
+			var routeBackends []haproxy.HTTPRouteBackend
+			for _, r := range svc.EffectiveRoutes() {
+				routeBackends = append(routeBackends, haproxy.HTTPRouteBackend{
+					Paths:      r.Paths,
+					Backend:    r.Backend.Address,
+					HealthPath: r.Backend.Health,
+					Headers:    r.Headers,
+					IPAllow:    r.IPAllow,
+				})
+			}
 			httpRoutes = append(httpRoutes, haproxy.HTTPRoute{
 				Name:       svc.Domain,
 				Domain:     svc.Domain,
-				Backend:    svc.Backend.Address,
-				HealthPath: svc.Backend.Health,
+				Subdomains: svc.Subdomains,
+				Routes:     routeBackends,
 			})
 		}
 	}
@@ -151,9 +159,9 @@ func (api *API) reconcileNetworking() {
 
 		// Choose the DNS target IP based on service type
 		dnsIP := centralIP
-		if svc.Backend.Type == services.BackendTCPPassthrough {
+		if svc.EffectiveBackendType() == services.BackendTCPPassthrough {
 			// k8s instances: LAN clients connect directly to the k8s LB
-			dnsIP = extractHost(svc.Backend.Address)
+			dnsIP = extractHost(svc.EffectiveBackendAddress())
 		}
 
 		ic := config.InstanceConfig{}