config

type BackupConfig struct {
	Dir string `json:"dir"`
	// Keep is how many capsule generations recoveryclient retains; it refuses values below 1.
	Keep int `json:"keep"`
	// DepositInterval is how often a paired instance seals and deposits a capsule to
	// KyRecovery. Zero disables the schedule; deposits then happen only on request.
	DepositInterval time.Duration `json:"deposit_interval"`
	// AllowPrivateRecovery admits private and CGNAT KyRecovery destinations (HTTPS still
	// required). Off by default: KyRecovery destinations must be public.
	AllowPrivateRecovery bool `json:"allow_private_recovery"`
}

type CaptchaConfig struct {
	Provider      string `json:"provider"` // "pow" or "none"
	DifficultyPoW int    `json:"difficulty_pow"`
}

type Config struct {
	Server    ServerConfig    `json:"server"`
	Database  DatabaseConfig  `json:"database"`
	Security  SecurityConfig  `json:"security"`
	SSO       SSOConfig       `json:"sso"`
	SCIM      SCIMConfig      `json:"scim"`
	Backup    BackupConfig    `json:"backup"`
	Registry  RegistryConfig  `json:"registry"`
	Container ContainerConfig `json:"container"`
	Captcha   CaptchaConfig   `json:"captcha"`
	Suite     SuiteConfig     `json:"suite"`
}

type ContainerConfig struct {
	// AllowPrivileged lets a container recreate or run set host-level settings: privileged,
	// devices, security options, capabilities beyond Docker's defaults, the host's or another
	// container's network, or a bind of a system path (anything under /etc but a few read-only
	// files) or a .ssh directory. Off by default: with it, container.configure
	// is root on the host.
	AllowPrivileged bool `json:"allow_privileged"`
}

type DatabaseConfig struct {
	Driver  string `json:"driver"` // "sqlite", "postgres", "mysql"
	DSN     string `json:"dsn"`    // Connection string or file path
	DataDir string `json:"data_dir"`
	// DiskBudget bounds what telemetry may occupy (docs/retention-policy.md). Zero disables
	// the check; the default is the documented 2 GiB.
	DiskBudget int64 `json:"disk_budget"`
	// SampleCeiling bounds stored metric rows per endpoint (docs/retention-policy.md). Zero
	// means the built-in default; it is configured once, before the store opens.
	SampleCeiling   int           `json:"sample_ceiling"`
	MaxOpenConns    int           `json:"max_open_conns"`
	MaxIdleConns    int           `json:"max_idle_conns"`
	ConnMaxLifetime time.Duration `json:"conn_max_lifetime"`
}

type RegistryConfig struct {
	// AllowPrivate lets organization admins set allow_private on a registry, admitting
	// private and CGNAT destinations. Off by default: a tenant must not reach the server's network.
	AllowPrivate bool `json:"allow_private"`
}

type SCIMConfig struct {
	Enabled     bool   `json:"enabled"`
	BearerToken string `json:"bearer_token"`
}

type SSOConfig struct {
	Enabled             bool   `json:"enabled"`
	KySignOnIssuer      string `json:"kysignon_issuer"`
	KySignOnClientID    string `json:"kysignon_client_id"`
	KySignOnSecret      string `json:"kysignon_secret"`
	KySignOnHMACSecret  string `json:"kysignon_hmac_secret"`
	GenericOIDCIssuer   string `json:"generic_oidc_issuer"`
	GenericOIDCClientID string `json:"generic_oidc_client_id"`
	GenericOIDCSecret   string `json:"generic_oidc_secret"`
	SAMLEntityID        string `json:"saml_entity_id"`
	SAMLMetadataURL     string `json:"saml_metadata_url"`
	AutoProvision       bool   `json:"auto_provision"`
}

type SecurityConfig struct {
	SessionSecret string `json:"-"`
	EncryptionKey []byte `json:"-"` // 32 bytes for AES-256-GCM; never serialised
	InstanceKey   []byte `json:"-"` // 32-byte Ed25519 seed; reserved for control-plane identity
	CookieSecure  bool   `json:"cookie_secure"`
	CookieDomain  string `json:"cookie_domain"`
	SessionTTL    time.Duration
	// TrustedProxies is the parsed KY_TRUSTED_PROXIES allowlist. Only a request whose peer
	// address falls inside it may speak for a client other than itself.
	TrustedProxies []netip.Prefix `json:"-"`
}

type ServerConfig struct {
	Host         string `json:"host"`
	Port         int    `json:"port"`
	AppURL       string `json:"app_url"`
	AppName      string `json:"app_name"`
	DockerSocket string `json:"docker_socket"`
	// AgentImage overrides installed-image discovery with a digest-pinned remote image.
	AgentImage   string        `json:"agent_image"`
	ReadTimeout  time.Duration `json:"read_timeout"`
	WriteTimeout time.Duration `json:"write_timeout"`
}

type SuiteConfig struct {
	// RunnerSocket is the runner's Unix socket; empty turns suite management off.
	RunnerSocket string `json:"runner_socket"`
}