config

type AdminConfig struct {
	Email    string `yaml:"email"`
	Password string `yaml:"password"`
}

type AgentControlConfig struct {
	// MTLS selects the client certificate mode of the AnixOps Agent
	// channels:
	//   - "off": client certificates are neither requested nor accepted and
	//     AgentEnrollment is unavailable; every agent uses its legacy node
	//     credential, without deprecation signals (a rollback switch);
	//   - "optional": a client certificate is verified when given, otherwise
	//     the legacy node credential authenticates, silently;
	//   - "preferred" (the 4.1 default): as optional, but legacy
	//     authentication is answered with deprecation signals (the
	//     x-anix-auth-deprecated stream header, and Deprecation, Sunset and
	//     Link on the legacy HTTP agent paths);
	//   - "required" (the default from 4.2, owner decision H5): the AnixOps
	//     Agent channels accept certificates only; the legacy agent paths
	//     and API key authentication on the stream are refused. Third-party
	//     node protocols (UniProxy, the v2board gRPC services) are not
	//     affected.
	// Empty means the default, required. Certificates come from
	// AgentEnrollment and need the built-in CA (module_runtime.ca_kek with
	// pki builtin; module_runtime.enabled is not needed) and
	// grpc.tls_cert_file. An explicit required refuses to start without
	// them; the default starts and warns (MTLSExplicit).
	MTLS string `yaml:"mtls"`
	// LegacySunset is the date after which the legacy agent transports may
	// stop answering, as YYYY-MM-DD or RFC 3339. When set, the deprecation
	// signals carry it (the HTTP Sunset header, x-anix-auth-sunset on the
	// stream). Empty sends no Sunset: the 4.2 release date is not fixed.
	LegacySunset string `yaml:"legacy_sunset"`
}

type AgentInstallConfig struct {
	// PublicURL is the Control address nodes reach, as https://host[:port];
	// empty uses the request's origin (server.trusted_proxies decides
	// whether X-Forwarded-* count).
	PublicURL string `yaml:"public_url"`
	// GRPCTarget is the host:port of the gRPC listener nodes dial (TLS);
	// empty uses PublicURL's host and grpc.port.
	GRPCTarget string `yaml:"grpc_target"`
	// AgentVersion is the Agent release tag installed; empty uses
	// "v" + app.version (Control and the Agent share version numbers, H25).
	AgentVersion string `yaml:"agent_version"`
	// ArtifactDir holds Agent release assets as <dir>/<tag>/<asset> with
	// their .dgst (and .sig) files; Control then serves them at
	// /install/agent/<tag>/<asset> (the "control" mirror) and publishes their
	// SHA-256 in /install/agent.json. Empty: the control mirror falls back to
	// GitHub releases.
	ArtifactDir string `yaml:"artifact_dir"`
	// CNMirrorURL is the base URL of a mainland mirror laid out like GitHub
	// release downloads (<base>/<tag>/<asset>). The script never trusts a
	// checksum from the mirror: it takes it from Control or GitHub.
	CNMirrorURL string `yaml:"cn_mirror_url"`
	// SignatureFile is the release signature of the embedded install
	// script (base64 Ed25519 by plugins.official_public_key), served at
	// /install.sh.sig after Control checks it. The release image sets it.
	SignatureFile string `yaml:"signature_file"`
}

type AlertSettings struct {
	Enabled          bool
	CheckInterval    time.Duration
	LeafExpiryDays   int
	CAExpiryDays     int
	RenotifyInterval time.Duration
	// PhaseStuckAfter is zero when the phase alerts are off.
	PhaseStuckAfter time.Duration
}

type AlertsConfig struct {
	// Enabled turns the monitor off when false; nil means on.
	Enabled *bool `yaml:"enabled"`
	// CheckInterval is how often the certificate stores and the phased
	// processes are scanned (a duration, at least 1m; default 15m).
	CheckInterval string `yaml:"check_interval"`
	// LeafExpiryDays caps, in days, how close to its end a leaf certificate
	// (Agent, link, module) may get without having been renewed before it
	// alerts (default 14). The window is the smaller of this and one sixth
	// of the certificate's own lifetime, because a healthy certificate is
	// renewed at two thirds of its lifetime.
	LeafExpiryDays int `yaml:"leaf_expiry_days"`
	// CAExpiryDays is how many days before its end the current module or
	// forward link CA alerts (default 60).
	CAExpiryDays int `yaml:"ca_expiry_days"`
	// RenotifyInterval is the shortest time between two notifications of
	// the same alert (a duration, at least 1h; default 24h). Critical alerts
	// repeat four times as often, phase alerts seven times as rarely.
	RenotifyInterval string `yaml:"renotify_interval"`
	// PhaseStuckAfter is how long a phased process may stay untouched in a
	// non-final phase before it alerts (a duration, at least 1h; default
	// 72h); "0" turns the phase alerts off.
	PhaseStuckAfter string `yaml:"phase_stuck_after"`
}

type AppConfig struct {
	Name             string `yaml:"name"`
	Version          string `yaml:"version"`
	APIToken         string `yaml:"api_token"`
	TrafficLogEnable bool   `yaml:"traffic_log_enable"`
	SubscribePath    string `yaml:"subscribe_path"`
	// Edition selects the product edition: "community" (default) hides the
	// commercial features (orders, payments, affiliate, plan purchase);
	// "commercial" serves them. See internal/edition.
	Edition string `yaml:"edition"`
}

type AuthConfig struct {
	LoginRateLimit    LoginRateLimitConfig   `yaml:"login_rate_limit"`
	RegisterRateLimit LoginRateLimitConfig   `yaml:"register_rate_limit"`
	Registration      RegistrationAuthConfig `yaml:"registration"`
}

type CORSConfig struct {
	AllowedOrigins   []string `yaml:"allowed_origins"`
	AllowedMethods   []string `yaml:"allowed_methods"`
	AllowedHeaders   []string `yaml:"allowed_headers"`
	AllowCredentials bool     `yaml:"allow_credentials"`
	MaxAge           int      `yaml:"max_age"` // preflight cache duration in seconds
}

type CacheConfig struct {
	Driver        string `yaml:"driver"`
	RedisHost     string `yaml:"redis_host"`
	RedisPort     int    `yaml:"redis_port"`
	RedisPassword string `yaml:"redis_password"`
	RedisDB       int    `yaml:"redis_db"`
}

type Config struct {
	Env            string               `yaml:"env"`
	Server         ServerConfig         `yaml:"server"`
	Frontend       FrontendConfig       `yaml:"frontend"`
	Database       DatabaseConfig       `yaml:"database"`
	Cache          CacheConfig          `yaml:"cache"`
	Log            LogConfig            `yaml:"log"`
	JWT            JWTConfig            `yaml:"jwt"`
	Auth           AuthConfig           `yaml:"auth"`
	App            AppConfig            `yaml:"app"`
	Admin          AdminConfig          `yaml:"admin"`
	TLS            TLSConfig            `yaml:"tls"`
	ForwardRuntime ForwardRuntimeConfig `yaml:"forward_runtime"`
	Forward        ForwardConfig        `yaml:"forward"`
	Plugins        PluginConfig         `yaml:"plugins"`
	GRPC           GRPCConfig           `yaml:"grpc"`
	ModuleRuntime  ModuleRuntimeConfig  `yaml:"module_runtime"`
	Identity       IdentityConfig       `yaml:"identity"`
	AgentControl   AgentControlConfig   `yaml:"agent_control"`
	AgentInstall   AgentInstallConfig   `yaml:"agent_install"`
	PackageRoutes  PackageRoutesConfig  `yaml:"package_routes"`
	Alerts         AlertsConfig         `yaml:"alerts"`
}

type DatabaseConfig struct {
	Driver   string `yaml:"driver"`
	Database string `yaml:"database"`
	Host     string `yaml:"host"`
	Port     int    `yaml:"port"`
	Username string `yaml:"username"`
	Password string `yaml:"password"`
	// SSLMode is the libpq sslmode (disable, allow, prefer, require,
	// verify-ca, verify-full); empty means disable.
	SSLMode string `yaml:"sslmode"`
	// TimeZone is the PostgreSQL session time zone; empty means Asia/Shanghai.
	TimeZone string `yaml:"timezone"`
	// DSN, when set, is used verbatim instead of the fields above.
	DSN             string `yaml:"dsn"`
	LogLevel        string `yaml:"log_level"`
	MaxIdleConns    int    `yaml:"max_idle_conns"`
	MaxOpenConns    int    `yaml:"max_open_conns"`
	ConnMaxLifetime int    `yaml:"conn_max_lifetime"`
}

type EnvVar struct {
	Name    string // ANIX_CONTROL_DATABASE_PASSWORD
	Path    string // database.password
	Type    string // string, bool, int, list
	Default string // value in the supplied config; empty for secrets
	Secret  bool
}

type ForwardConfig struct {
	// AnixOpsExperimental lets routes use the experimental AnixOps engine and
	// link (ENGINE_ANIXOPS, LINK_SECURITY_ANIXOPS): it sets the planner's and
	// the validation's EnableAnixOps. Off by default; the Agents need their own
	// Forward.AnixOps.Enable (their JSON configuration) to advertise the engine, since the planner
	// refuses a node that does not. The wire format of the prototype (ALPN
	// anixops/0) may change without notice.
	AnixOpsExperimental bool `yaml:"anixops_experimental"`
}

type ForwardRuntimeAnsibleConfig struct {
	Inventory      string            `yaml:"inventory"`
	ApplyPlaybook  string            `yaml:"apply_playbook"`
	RemovePlaybook string            `yaml:"remove_playbook"`
	Become         bool              `yaml:"become"`
	ExtraVars      map[string]any    `yaml:"extra_vars"`
	Command        string            `yaml:"command"`
	WorkingDir     string            `yaml:"working_dir"`
	TargetPattern  string            `yaml:"target_pattern"`
	Environment    map[string]string `yaml:"environment"`
	TimeoutSeconds int               `yaml:"timeout_seconds"`
}

type ForwardRuntimeCleanAgentConfig struct {
	PublicURL                string `yaml:"public_url"`
	HeartbeatIntervalSeconds int    `yaml:"heartbeat_interval_seconds"`
	ActionTimeoutSeconds     int    `yaml:"action_timeout_seconds"`
	TokenExpireSeconds       int    `yaml:"token_expire_seconds"`
	LegacyBridgeEnabled      bool   `yaml:"legacy_bridge_enabled"`
}

type ForwardRuntimeConfig struct {
	NodeXMode       *bool                          `yaml:"nodex_mode"`
	Backend         string                         `yaml:"backend"`
	NodeX           ForwardRuntimeNodeXConfig      `yaml:"nodex"`
	CleanAgent      ForwardRuntimeCleanAgentConfig `yaml:"clean_agent"`
	NftablesAnsible ForwardRuntimeAnsibleConfig    `yaml:"nftables_ansible"`
	Jobs            ForwardRuntimeJobsConfig       `yaml:"jobs"`
	GostStats       ForwardRuntimeGostStatsConfig  `yaml:"gost_stats"`
	Latency         ForwardRuntimeLatencyConfig    `yaml:"latency"`
}

type ForwardRuntimeGostStatsConfig struct {
	PollInterval     string `yaml:"poll_interval"`
	IdlePollInterval string `yaml:"idle_poll_interval"`
	ErrorLogInterval string `yaml:"error_log_interval"`
}

type ForwardRuntimeJobsConfig struct {
	PollInterval     string `yaml:"poll_interval"`
	IdlePollInterval string `yaml:"idle_poll_interval"`
	ErrorLogInterval string `yaml:"error_log_interval"`
	BatchSize        int    `yaml:"batch_size"`
	TimeoutSeconds   int    `yaml:"timeout_seconds"`
}

type ForwardRuntimeLatencyConfig struct {
	PollInterval     string `yaml:"poll_interval"`
	IdlePollInterval string `yaml:"idle_poll_interval"`
	ErrorLogInterval string `yaml:"error_log_interval"`
	Dials            int    `yaml:"dials"`
	DialTimeout      string `yaml:"dial_timeout"`
	Concurrency      int    `yaml:"concurrency"`
	RetentionDays    int    `yaml:"retention_days"`
}

type ForwardRuntimeNodeXConfig struct {
	BaseURL        string `yaml:"base_url"`
	Token          string `yaml:"token"`
	TimeoutSeconds int    `yaml:"timeout_seconds"`
}

type FrontendConfig struct {
	Enable bool   `yaml:"enable"`
	Port   int    `yaml:"port"`
	Path   string `yaml:"path"`
}

type GRPCConfig struct {
	Enable      bool   `yaml:"enabled"`
	Host        string `yaml:"host"`
	Port        int    `yaml:"port"`
	APIToken    string `yaml:"api_token"`
	TLSCertFile string `yaml:"tls_cert_file"`
	TLSKeyFile  string `yaml:"tls_key_file"`
}

type IdentityConfig struct {
	// KEK is the base64 or hex 32-byte key that seals the identity signing
	// keys. It is passed to the local identity-platform host only; a network
	// module gets its own copy (ANIX_IDENTITY_KEK_FILE). Without it identity
	// signs no tokens and the kernel's own HS256 tokens stay in use.
	KEK string `yaml:"kek"`
}

type JWTConfig struct {
	Secret string `yaml:"secret"`
	Expire int    `yaml:"expire"`
}

type LogConfig struct {
	// Format is "text" (default: the historical plain log lines) or "json"
	// (one JSON object per line on stdout, for container log collectors).
	Format     string `yaml:"format"`
	Level      string `yaml:"level"`
	Output     string `yaml:"output"`
	FilePath   string `yaml:"file_path"`
	MaxSize    int    `yaml:"max_size"`
	MaxBackups int    `yaml:"max_backups"`
	MaxAge     int    `yaml:"max_age"`
}

type LoginRateLimitConfig struct {
	Enabled        *bool `yaml:"enabled"`
	MaxAttempts    int   `yaml:"max_attempts"`
	WindowSeconds  int   `yaml:"window_seconds"`
	LockoutSeconds int   `yaml:"lockout_seconds"`
}

type ModuleRuntimeConfig struct {
	Enabled bool `yaml:"enabled"`
	// Listen is the address of the kernel's mTLS module listener (ModulePKI
	// and the remote package bridge).
	Listen string `yaml:"listen"`
	// Cluster names the deployment in every module SPIFFE ID.
	Cluster string `yaml:"cluster"`
	// PKI is "builtin" (the kernel's own CA, with enrollment) or "external"
	// (certificates issued elsewhere, for example by cert-manager).
	PKI string `yaml:"pki"`
	// CAKEK is the base64 or hex 32-byte key that seals the built-in CA key.
	CAKEK string `yaml:"ca_kek"`
	// CertLifetime bounds module and kernel certificates (default 24h).
	CertLifetime string `yaml:"cert_lifetime"`
	// External PKI: the trust bundle and the kernel's own certificate.
	TrustBundleFile string `yaml:"trust_bundle_file"`
	CertFile        string `yaml:"cert_file"`
	KeyFile         string `yaml:"key_file"`
	// DatabaseHost ("host" or "host:port") is the PostgreSQL address in
	// storage leases for remote modules, when it differs from the kernel's.
	DatabaseHost string `yaml:"database_host"`
	// BindTimeout bounds how long starting a remote package waits for a
	// healthy instance (default 2m).
	BindTimeout string `yaml:"bind_timeout"`
}

type PackageRoutesConfig struct {
	// DefaultMode is the default policy:
	//   - "rehearsed" (the default from 4.1.0): the routes listed in
	//     config/package-route-defaults.json, which passed the staging
	//     rehearsal, run natively when the installation stores no mode for
	//     them and the installed package release is at least the rehearsed
	//     one;
	//   - "legacy": no route defaults to native; every route without a
	//     stored mode runs its legacy handler, as in 4.0 (the kill switch).
	// A stored mode (anix-control routes set/rollback) always wins.
	DefaultMode string `yaml:"default_mode"`
}

type PluginConfig struct {
	OfficialPublicKey                  string `yaml:"official_public_key"`
	IdentityBootstrapPackageDir        string `yaml:"identity_bootstrap_package_dir"`
	ControlExecutionEnabled            bool   `yaml:"control_execution_enabled"`
	ControlPollInterval                string `yaml:"control_poll_interval"`
	ControlHostRuntimeDir              string `yaml:"control_host_runtime_dir"`
	ControlHostArtifactDir             string `yaml:"control_host_artifact_dir"`
	ControlHostStartupTimeout          string `yaml:"control_host_startup_timeout"`
	ControlHostRequestTimeout          string `yaml:"control_host_request_timeout"`
	ControlHostWebSocketSessionTimeout string `yaml:"control_host_websocket_session_timeout"`
	ControlHostMaxRequestBytes         int64  `yaml:"control_host_max_request_bytes"`
	ControlHostMaxResponseBytes        int64  `yaml:"control_host_max_response_bytes"`
	DispatchEnabled                    bool   `yaml:"dispatch_enabled"`
	DispatchPollInterval               string `yaml:"dispatch_poll_interval"`
	TopologyExecutionEnabled           bool   `yaml:"topology_execution_enabled"`
	TopologyPollInterval               string `yaml:"topology_poll_interval"`
}

type RegistrationAuthConfig struct {
	Enabled             *bool    `yaml:"enabled"`
	RequireInvite       bool     `yaml:"require_invite"`
	AllowedEmailDomains []string `yaml:"allowed_email_domains"`
	BlockedEmailDomains []string `yaml:"blocked_email_domains"`
}

type ServerConfig struct {
	Host           string     `yaml:"host"`
	Port           int        `yaml:"port"`
	Mode           string     `yaml:"mode"`
	ReadTimeout    int        `yaml:"read_timeout"`
	WriteTimeout   int        `yaml:"write_timeout"`
	TrustedProxies []string   `yaml:"trusted_proxies"` // proxies whose X-Forwarded-* count (internal/requestorigin); nil = loopback, empty = none
	CORS           CORSConfig `yaml:"cors"`
	// ShutdownDrainDelay is how long the server keeps accepting requests after
	// /readyz starts failing on shutdown, so load balancers and Kubernetes
	// endpoints stop routing to it first (Go duration, e.g. "5s"; empty = 0).
	ShutdownDrainDelay string `yaml:"shutdown_drain_delay"`
}

type TLSConfig struct {
	Enable   bool   `yaml:"enable"`
	CertFile string `yaml:"cert_file"`
	KeyFile  string `yaml:"key_file"`
	Domain   string `yaml:"domain"`
}