config

type Config struct {
	BackendListenAddress           string             `yaml:"backendListenAddress"`
	PeerListenAddress              string             `yaml:"peerListenAddress"`
	RelayPorts                     []int              `yaml:"relayPorts"`
	UDPRelayPorts                  []int              `yaml:"udpRelayPorts"`
	IdleTimeoutSeconds             int                `yaml:"idleTimeoutSeconds"`
	BackendsJWTSecret              string             `yaml:"backendsJWTSecret"`
	RemoteVerifierURL              string             `yaml:"remoteVerifierURL"`
	MaintenanceGraceDefaultSeconds int                `yaml:"maintenanceGraceDefaultSeconds"`
	Peers                          []string           `yaml:"peers"`
	PeerAuthentication             PeerAuthentication `yaml:"peerAuthentication"`

	// Manual TLS configuration
	HubTlsCertFile string `yaml:"hubTlsCertFile"`
	HubTlsKeyFile  string `yaml:"hubTlsKeyFile"`

	// Automatic TLS configuration via ACME
	HubPublicHostname string `yaml:"hubPublicHostname"`
	AcmeCacheDir      string `yaml:"acmeCacheDir"`

	// TotalBandwidthMbps is the total bandwidth limit for the proxy in Mbps.
	// Set to 0 for unlimited. When set, bandwidth is distributed fairly
	// among all active backends using Deficit Round Robin.
	TotalBandwidthMbps int `yaml:"totalBandwidthMbps"`

	// Port claim allowlists (security controls). When empty, port claims are disabled.
	AllowedTCPPortClaims []int `yaml:"allowedTCPPortClaims"`
	AllowedUDPPortClaims []int `yaml:"allowedUDPPortClaims"`

	// Orchestrator registration (optional — omit to run without DNS orchestration)
	RegistrationURL string `yaml:"registrationURL"`
	Region          string `yaml:"region"` // sent in registration body

	// UDP flow table and payload bounds (applies to udpRelayPorts).
	UDPMaxFlows                      int `yaml:"udpMaxFlows"`
	UDPMaxDatagramBytes              int `yaml:"udpMaxDatagramBytes"`
	UDPFlowIdleTimeoutDefaultSeconds int `yaml:"udpFlowIdleTimeoutDefaultSeconds"`
	UDPFlowIdleTimeoutMinSeconds     int `yaml:"udpFlowIdleTimeoutMinSeconds"`
	UDPFlowIdleTimeoutMaxSeconds     int `yaml:"udpFlowIdleTimeoutMaxSeconds"`

	// STUN server port (optional — omit or set to 0 to disable).
	// When set, a STUN Binding server listens on this UDP port.
	StunPort int `yaml:"stunPort"`
}

type PeerAuthentication struct {
	TrustedDomainSuffixes []string `yaml:"trustedDomainSuffixes"`
}