config

type API struct {
	Enabled bool `toml:"enabled"`
}

type Config struct {
	Server       Server       `toml:"server"`
	SSH          SSH          `toml:"ssh"`
	HTTP         HTTP         `toml:"http"`
	GitDaemon    GitDaemon    `toml:"git_daemon"`
	Web          Web          `toml:"web"`
	Registration Registration `toml:"registration"`
	API          API          `toml:"api"`
	Webhooks     Webhooks     `toml:"webhooks"`
	Pages        Pages        `toml:"pages"`
	LFS          LFS          `toml:"lfs"`
	Limits       Limits       `toml:"limits"`
	Mail         Mail         `toml:"mail"`
	Mirrors      Mirrors      `toml:"mirrors"`
	Deps         Deps         `toml:"deps"`
	Retention    Retention    `toml:"retention"`
	// GoImport maps vanity Go module paths to repositories, e.g.
	// "gitbay.org/gitbay" = "krz/gitbay". Requests carrying ?go-get=1
	// under a mapped path get a go-import meta tag.
	GoImport map[string]string `toml:"go_import"`
}

type Deps struct {
	CheckIntervalHours int `toml:"check_interval_hours"`
}

type GitDaemon struct {
	Enabled bool `toml:"enabled"`
	Port    int  `toml:"port"`
}

type HTTP struct {
	Addr     string `toml:"addr"`
	TLS      string `toml:"tls"` // acme | files | off
	CertFile string `toml:"cert_file"`
	KeyFile  string `toml:"key_file"`
	// ACME (Let's Encrypt by default). Certificates are cached under
	// server.root/acme. acme_http_addr serves HTTP-01 challenges and
	// redirects to HTTPS; "off" disables it (TLS-ALPN-01 on the HTTPS
	// port still works).
	ACMEEmail    string `toml:"acme_email"`
	ACMEHTTPAddr string `toml:"acme_http_addr"`
	// TrustedProxies are the addresses or CIDRs of reverse proxies in front
	// of this process. A request from one of them is attributed to the
	// last X-Forwarded-For hop that is not itself a trusted proxy; from
	// anyone else the peer address is the client and the header is
	// ignored. Empty means no proxy, which is how gitbayd is deployed by
	// default: it terminates TLS itself.
	TrustedProxies []string `toml:"trusted_proxies,omitempty"`
}

type LFS struct {
	Root           string `toml:"root"`
	MaxObjectBytes int64  `toml:"max_object_bytes"`
}

type Limits struct {
	MaxPackBytes    int64 `toml:"max_pack_bytes"`
	MaxBlobBytes    int64 `toml:"max_blob_bytes"`
	MaxAssetBytes   int64 `toml:"max_asset_bytes"` // per release asset
	CloneTimeoutSec int   `toml:"clone_timeout"`
	SSHAuthRate     int   `toml:"ssh_auth_rate"`
	// APIRate is sustained JSON-API requests per minute per caller; writes
	// draw on a tenth of it. 0 uses the default.
	APIRate int `toml:"api_rate"`
	// Per-account quotas on what a user owns directly (organizations are
	// not capped). 0 means unlimited; admin user limits overrides per
	// account.
	MaxReposPerUser int   `toml:"max_repos_per_user"`
	MaxBytesPerUser int64 `toml:"max_bytes_per_user"`
}

type Mail struct {
	SMTPHost string `toml:"smtp_host"` // host:port (port defaults to 587)
	From     string `toml:"from"`
	SMTPUser string `toml:"smtp_user,omitempty"`
	SMTPPass string `toml:"smtp_pass,omitempty"`
}

type Mirrors struct {
	PullIntervalMinutes int `toml:"pull_interval_minutes"`
}

type Pages struct {
	Domain string `toml:"domain"`
}

type Registration struct {
	Mode string `toml:"mode"` // closed | invite | open
	// PendingExpiry is how long a self-registered account may stay
	// unverified before it is removed, as a duration ("168h"). Empty
	// keeps such accounts forever.
	PendingExpiry string `toml:"pending_expiry"`
}

type Retention struct {
	Audit             string `toml:"audit"`
	Events            string `toml:"events"`
	WebhookDeliveries string `toml:"webhook_deliveries"`
	// Mail is the outbound queue: rows already sent or given up on.
	Mail string `toml:"mail"`
}

type SSH struct {
	Mode     string   `toml:"mode"` // embedded | system
	Port     int      `toml:"port"`
	HostKeys []string `toml:"host_keys"`
}

type Server struct {
	Root    string `toml:"root"`
	SiteURL string `toml:"site_url"`

	// SourceRepo names the repository this instance develops itself in, as
	// "owner/name". When set, startup warns if the running build's commit is
	// not on that repository's default branch. Empty disables the check, which
	// is right for any instance that does not host its own source.
	SourceRepo string `toml:"source_repo"`
}

type Web struct {
	Mode         string `toml:"mode"` // view_only | accounts
	PasswordAuth bool   `toml:"password_auth"`
	// Title is the instance's display name in the header and page titles.
	// Empty falls back to the site host.
	Title string `toml:"title"`
	// PrivacyNotice is operator-provided text shown on /privacy under the
	// fixed project-level statement. Plain text; blank paragraphs split.
	PrivacyNotice string `toml:"privacy_notice"`
}

type Webhooks struct {
	AllowLocal bool `toml:"allow_local"`
}