config

type AccountConfig struct {
	MaxDevicesPerAccount int `yaml:"maxDevicesPerAccount"`
	InviteTTLHours       int `yaml:"inviteTTLHours"`
	MaxInvitesPerAccount int `yaml:"maxInvitesPerAccount"`
}

type AliasDomainConfig struct {
	MaxPerAccount              int    `yaml:"maxPerAccount"`
	PendingExpiryDays          int    `yaml:"pendingExpiryDays"`
	VerificationTimeoutSeconds int    `yaml:"verificationTimeoutSeconds"`
	DNSResolver                string `yaml:"dnsResolver"`
}

type Config struct {
	PublicHostname   string `yaml:"publicHostname"`
	AcmeDirectoryURL string `yaml:"acmeDirectoryURL"`
	AcmeCACert       string `yaml:"acmeCACert"`
	ListenAddress    string `yaml:"listenAddress"`
	HTTPAddress      string `yaml:"httpAddress"`
	AdminAddress     string `yaml:"adminAddress"`

	Database        DatabaseConfig        `yaml:"database"`
	DNS             DNSConfig             `yaml:"dns"`
	PowerDNS        PowerDNSConfig        `yaml:"powerDNS"`
	TPM             TPMConfig             `yaml:"tpm"`
	Nexus           NexusConfig           `yaml:"nexus"`
	Token           TokenConfig           `yaml:"token"`
	Enrollment      EnrollmentConfig      `yaml:"enrollment"`
	Nonce           NonceConfig           `yaml:"nonce"`
	DeviceRateLimit DeviceRateLimitConfig `yaml:"deviceRateLimit"`
	SetupDiscover   SetupDiscoverConfig   `yaml:"setupDiscover"`
	Hostname        HostnameConfig        `yaml:"hostname"`
	AliasDomain     AliasDomainConfig     `yaml:"aliasDomain"`
	Recovery        RecoveryConfig        `yaml:"recovery"`
	Account         AccountConfig         `yaml:"account"`
	FleetTrust      FleetTrustConfig      `yaml:"fleetTrust"`

	AuditRetentionDays int `yaml:"auditRetentionDays"`
}

type DNSConfig struct {
	BaseDomain    string   `yaml:"baseDomain"`
	Zone          string   `yaml:"zone"`
	RelayHostname string   `yaml:"relayHostname"`
	Nameservers   []string `yaml:"nameservers"`
}

type DatabaseConfig struct {
	URL          string `yaml:"url"`
	MaxOpenConns int    `yaml:"maxOpenConns"`
	MaxIdleConns int    `yaml:"maxIdleConns"`
}

type DeviceRateLimitConfig struct {
	MutationPerMin int `yaml:"mutationPerMin"`
	MutationBurst  int `yaml:"mutationBurst"`
	ReadPerMin     int `yaml:"readPerMin"`
	ReadBurst      int `yaml:"readBurst"`
}

type EnrollmentConfig struct {
	MaxPending              int `yaml:"maxPending"`
	PendingTTLSeconds       int `yaml:"pendingTTLSeconds"`
	RateLimitPerSecond      int `yaml:"rateLimitPerSecond"`
	BurstPerSecond          int `yaml:"burstPerSecond"`
	RateLimitPerIPPerSecond int `yaml:"rateLimitPerIPPerSecond"`
	BurstPerIPPerSecond     int `yaml:"burstPerIPPerSecond"`
}

type FleetTrustConfig struct {
	CensusAnalysisIntervalMinutes int     `yaml:"censusAnalysisIntervalMinutes"`
	CAPromotionMinDevices         int     `yaml:"caPromotionMinDevices"`
	CAPromotionMinDays            int     `yaml:"caPromotionMinDays"`
	CAPromotionMinSubnets         int     `yaml:"caPromotionMinSubnets"`
	CAPromotionMinCompliance      float64 `yaml:"caPromotionMinCompliance"`
	CAEnrollmentRatePerHour       int     `yaml:"caEnrollmentRatePerHour"`
	PCRMajorityMinPopulation      int     `yaml:"pcrMajorityMinPopulation"`
	CensusActiveWindowDays        int     `yaml:"censusActiveWindowDays"`
}

type HostnameConfig struct {
	MaxChangesPerYear    int `yaml:"maxChangesPerYear"`
	CooldownDays         int `yaml:"cooldownDays"`
	ReleasedCooldownDays int `yaml:"releasedCooldownDays"`
}

type NexusConfig struct {
	TrustedDomainSuffixes       []string `yaml:"trustedDomainSuffixes"`
	ClientCACertFile            string   `yaml:"clientCACertFile"`
	HeartbeatIntervalSeconds    int      `yaml:"heartbeatIntervalSeconds"`
	InactiveThresholdMultiplier int      `yaml:"inactiveThresholdMultiplier"`
}

type NonceConfig struct {
	MaxNonces               int `yaml:"maxNonces"`
	TTLSeconds              int `yaml:"ttlSeconds"`
	RateLimitPerSecond      int `yaml:"rateLimitPerSecond"`
	BurstPerSecond          int `yaml:"burstPerSecond"`
	RateLimitPerIPPerSecond int `yaml:"rateLimitPerIPPerSecond"`
	BurstPerIPPerSecond     int `yaml:"burstPerIPPerSecond"`
}

type PowerDNSConfig struct {
	ApiURL         string `yaml:"apiURL"`
	ApiKey         string `yaml:"apiKey"`
	ServerID       string `yaml:"serverID"`
	TimeoutSeconds int    `yaml:"timeoutSeconds"`
	DNSAddress     string `yaml:"dnsAddress"`
	// DisableProxy skips the embedded ":53" DNS proxy even when PowerDNS is on
	// a non-standard port. Useful for dev hosts where systemd-resolved already
	// holds port 53 and the operator does not need the bridge (e.g. local test
	// loops where Pebble runs with PEBBLE_VA_ALWAYS_VALID=1 and never actually
	// resolves challenge records). Production deployments should leave this
	// false so the proxy runs under root / CAP_NET_BIND_SERVICE.
	DisableProxy bool `yaml:"disableProxy,omitempty"`
}

type RecoveryConfig struct {
	Enabled           *bool `yaml:"enabled"`
	QuorumTimeoutDays int   `yaml:"quorumTimeoutDays"`
}

type SetupDiscoverConfig struct {
	RateLimitPerSecond      int      `yaml:"rateLimitPerSecond"`
	BurstPerSecond          int      `yaml:"burstPerSecond"`
	RateLimitPerIPPerSecond int      `yaml:"rateLimitPerIPPerSecond"`
	BurstPerIPPerSecond     int      `yaml:"burstPerIPPerSecond"`
	AllowedOrigins          []string `yaml:"allowedOrigins"`
	TTLSeconds              int      `yaml:"ttlSeconds"`
}

type TPMConfig struct {
	TrustedCACertsDir string `yaml:"trustedCACertsDir"`
	SeedBundleDir     string `yaml:"seedBundleDir"`
	AllowSoftwareTPM  bool   `yaml:"allowSoftwareTPM"`
}

type TokenConfig struct {
	TTLSeconds                 int `yaml:"ttlSeconds"`
	DefaultWeight              int `yaml:"defaultWeight"`
	HandshakeMaxAgeSeconds     int `yaml:"handshakeMaxAgeSeconds"`
	ReauthIntervalSeconds      int `yaml:"reauthIntervalSeconds"`
	ReauthGraceSeconds         int `yaml:"reauthGraceSeconds"`
	MaintenanceGraceCapSeconds int `yaml:"maintenanceGraceCapSeconds"`
}