config

type Config struct {
	Env             string
	HTTPAddr        string
	DatabaseURL     string
	LogLevel        string
	ShutdownTimeout time.Duration

	// BrandFile points at the visual identity YAML. Optional: without it the
	// interface uses the default identity.
	BrandFile string

	// MetricsAddr is where /metrics listens, and it is a SEPARATE address from
	// HTTPAddr on purpose. The API pod is the one behind an Ingress, and a
	// scrape endpoint on the same port would either sit behind the login --
	// where no scraper can reach it -- or publish every workflow and step name
	// to whoever finds the path.
	//
	// It defaults to :9090 rather than to empty, because a metrics endpoint
	// that has to be turned on is a metrics endpoint nobody has. Setting
	// BREVIS_METRICS_ADDR to the empty string serves nothing -- which is why it
	// is read with LookupEnv and not with `get`, where empty and unset are the
	// same thing.
	MetricsAddr string

	// TaskEnv lists what the process passes on to local tasks. See
	// TasksEnvironment -- the default does NOT inherit the environment, and
	// that is deliberate.
	TaskEnv []string

	// SlackWebhook receives the alert for a definitive failure. Empty means
	// nobody is told. It comes from the environment and never from the YAML:
	// whoever holds the URL posts in the channel as if they were the
	// platform.
	SlackWebhook string

	// Auth is the operator credential that closes the interface. See internal/auth.
	Auth auth.Credential

	// UIURL builds the run's link in the alert. Without it the alert says what
	// failed but makes the reader hunt for the run by hand.
	UIURL string

	// Pods parameterises execution in Kubernetes. These are the INSTALLATION's
	// decisions -- which identity and credentials the pods start with -- which
	// is why they come from the environment and not the workflow's YAML: a
	// pipeline must not get to pick the service account it runs as.
	Pods PodsConfig
}

type Grace struct {
	Key    string
	Value  string
	Efeito string
}

type PodsConfig struct {
	// Mode: auto (use pods when a cluster is there), on (require) or off (never).
	Modo              string
	Namespace         string
	ServiceAccount    string
	PullSecrets       []string
	EnvFromSecrets    []string
	EnvFromConfigMaps []string

	// AllowedSecrets limits what a YAML's `secrets:` may name. Empty denies
	// everything: the installation decides which secrets exist for workflows,
	// and the YAML decides which step receives each one.
	AllowedSecrets []string

	// CredencialPVC and CredencialPath mount the volume where the SDK keeps the
	// credential it rotates. Without the PVC, nothing changes.
	CredentialPVC  string
	CredentialPath string
	NodeSelector   map[string]string
	// Tolerations in "key=value:effect" form, comma separated. An arm64 pool
	// commonly carries a taint, and without a toleration the task's pod stays
	// Pending forever -- no error, just stopped.
	Tolerations   []Grace
	KeepOnFailure bool
}