config

type ACME struct {
	// Listen is IP:port of the ACME listener – never the public CRL port, so
	// nobody talks ACME in clear text. Without TLSIssuer it is for the reverse
	// proxy only; with it, for the clients (e.g. :443).
	Listen string `yaml:"listen"`
	// BaseURL is what clients use (the proxy's https URL, e.g.
	// https://pki.homelab.lan/acme); every URL the server hands out is built
	// from it. Empty: ACME is off.
	BaseURL string `yaml:"base_url"`
	// TrustedProxies may connect to Listen (others get 403), and only their
	// X-Forwarded-For is believed (IPs or CIDRs, comma-separated). Ignored
	// with TLSIssuer: then every client connects directly and the peer is
	// the client address.
	TrustedProxies string `yaml:"trusted_proxies"`
	// Resolver is the DNS server (IP or IP:port) for dns-01 and for resolving
	// http-01 names. Empty: the system resolver.
	Resolver string `yaml:"resolver"`
	// TLSIssuer names a CA of this instance: ACME runs with TLS on Listen,
	// with a certificate for the host of BaseURL that the server issues from
	// this CA itself. Empty: plain HTTP behind a reverse proxy.
	TLSIssuer string `yaml:"tls_issuer"`
}

type Admin struct {
	// Listen is IP:port; an empty IP means all interfaces.
	Listen string `yaml:"listen"`
	// TLSCertFile and TLSKeyFile name an operator-provided certificate. Both
	// empty: a self-signed bootstrap certificate is created (PLAN §5).
	TLSCertFile string `yaml:"tls_cert_file"`
	TLSKeyFile  string `yaml:"tls_key_file"`
	// TLSNames are further DNS names or IPs (comma-separated) for the
	// bootstrap certificate, besides the host name, the listen IP and
	// loopback – the names admins type into the browser. With TLSIssuer they
	// are exactly the names of the issued certificate.
	TLSNames string `yaml:"tls_names"`
	// TLSIssuer names a CA of this instance (v0.2.2): the server issues the
	// listener's certificate from it itself, while unsealed, and renews it.
	// Empty: the operator certificate or the bootstrap certificate.
	TLSIssuer string `yaml:"tls_issuer"`
	// AllowedNetworks limits who may connect (IPs or CIDRs, comma-separated);
	// empty: everybody. Checked against the direct peer before TLS (ADR-08).
	AllowedNetworks string `yaml:"allowed_networks"`
}

type Auth struct {
	// KeyFile holds the key that encrypts the TOTP secrets and keys the
	// recovery code hashes. Empty: <data_dir>/auth.key. It may live outside
	// the data directory (Docker secret, systemd credential): then a copy of
	// the databases alone holds no usable TOTP secret.
	KeyFile string `yaml:"key_file"`
	// TrustedProxies lists reverse proxies (IPs or CIDRs, comma-separated)
	// whose X-Forwarded-For header is believed. Empty: the direct peer is
	// the client – the safe default.
	TrustedProxies string `yaml:"trusted_proxies"`
	// PasskeyOrigin is the address users open the admin UI with, e.g.
	// https://pki.homelab.lan:9443 (PHASE1 step 17). Passkeys are bound to its
	// host name (the WebAuthn RP ID). Empty: no passkeys, TOTP only.
	PasskeyOrigin string `yaml:"passkey_origin"`
}

type Config struct {
	// DataDir holds system.db and the tenant directories. Absolute path.
	DataDir string `yaml:"data_dir"`
	Log     Log    `yaml:"log"`
	Admin   Admin  `yaml:"admin"`
	Public  Public `yaml:"public"`
	Auth    Auth   `yaml:"auth"`
	ACME    ACME   `yaml:"acme"`
}

type Log struct {
	Level  string `yaml:"level"`  // debug, info, warn, error
	Format string `yaml:"format"` // json (production) or text
}

type Public struct {
	// Listen is IP:port; empty disables the listener.
	Listen string `yaml:"listen"`
}

type Source struct {
	File string   // the config file that was read
	Env  []string // MYOWNPKI_* variables that overrode a value, sorted
}