config

type ACME struct {
	// Listen is IP:port of the ACME listener – never the public CRL port, so
	// nobody talks ACME in clear text. Without TLSIssuer it is for the reverse
	// proxy only; with it, for the clients (e.g. :443).
	Listen string `yaml:"listen"`
	// BaseURL is what clients use (the proxy's https URL, e.g.
	// https://pki.homelab.lan/acme); every URL the server hands out is built
	// from it. Empty: ACME is off.
	BaseURL string `yaml:"base_url"`
	// TrustedProxies may connect to Listen (others get 403), and only their
	// X-Forwarded-For is believed (IPs or CIDRs, comma-separated). Ignored
	// with TLSIssuer: then every client connects directly and the peer is
	// the client address.
	TrustedProxies string `yaml:"trusted_proxies"`
	// Resolver is the DNS server (IP or IP:port) for dns-01 and for resolving
	// http-01 names. Empty: the system resolver.
	Resolver string `yaml:"resolver"`
	// TLSIssuer names a CA of this instance: ACME runs with TLS on Listen,
	// with a certificate for the host of BaseURL that the server issues from
	// this CA itself. Empty: plain HTTP behind a reverse proxy.
	TLSIssuer string `yaml:"tls_issuer"`
}

type Admin struct {
	// Listen is IP:port; an empty IP means all interfaces.
	Listen string `yaml:"listen"`
	// TLSCertFile and TLSKeyFile name an operator-provided certificate. Both
	// empty: a self-signed bootstrap certificate is created (PLAN §5).
	TLSCertFile string `yaml:"tls_cert_file"`
	TLSKeyFile  string `yaml:"tls_key_file"`
	// TLSNames are further DNS names or IPs (comma-separated) for the
	// bootstrap certificate, besides the host name, the listen IP and
	// loopback – the names admins type into the browser. With TLSIssuer they
	// are exactly the names of the issued certificate.
	TLSNames string `yaml:"tls_names"`
	// TLSIssuer names a CA of this instance (v0.2.2): the server issues the
	// listener's certificate from it itself, while unsealed, and renews it.
	// Empty: the operator certificate or the bootstrap certificate.
	TLSIssuer string `yaml:"tls_issuer"`
	// AllowedNetworks limits who may connect (IPs or CIDRs, comma-separated);
	// empty: everybody. Checked against the direct peer before TLS (ADR-08).
	AllowedNetworks string `yaml:"allowed_networks"`
}

type Agent struct {
	// BaseURL is what agents connect to, e.g. https://pki.homelab.lan:8444;
	// its host is the name in the listener certificate. Empty: no agents.
	BaseURL string `yaml:"base_url"`
	// Listen is IP:port of the agent listener – its own port, never the
	// admin, ACME or public one.
	Listen string `yaml:"listen"`
	// TLSIssuer names the CA that issues the listener certificate, as for
	// admin.tls_issuer: an intermediate, issued while unsealed.
	TLSIssuer string `yaml:"tls_issuer"`
	// CA names the agent CA: an intermediate with the EKU limit clientAuth
	// only. It signs the agents' 7-day certificates, and only certificates
	// from it pass the listener's client authentication.
	CA string `yaml:"ca"`
	// PackageDir is the immutable release-artifact directory exposed by the
	// agent listener. The host installer stages it; the container uses /opt.
	PackageDir string `yaml:"package_dir"`
}

type Auth struct {
	// KeyFile holds the key that encrypts the TOTP secrets and keys the
	// recovery code hashes. Empty: <data_dir>/auth.key. It may live outside
	// the data directory (Docker secret, systemd credential): then a copy of
	// the databases alone holds no usable TOTP secret.
	KeyFile string `yaml:"key_file"`
	// TrustedProxies lists reverse proxies (IPs or CIDRs, comma-separated)
	// whose X-Forwarded-For header is believed. Empty: the direct peer is
	// the client – the safe default.
	TrustedProxies string `yaml:"trusted_proxies"`
	// PasskeyOrigin is the address users open the admin UI with, e.g.
	// https://pki.homelab.lan:9443 (PHASE1 step 17). Passkeys are bound to its
	// host name (the WebAuthn RP ID). Empty: no passkeys, TOTP only.
	PasskeyOrigin string `yaml:"passkey_origin"`
}

type Config struct {
	// DataDir holds system.db and the tenant directories. Absolute path.
	DataDir string  `yaml:"data_dir"`
	Log     Log     `yaml:"log"`
	Admin   Admin   `yaml:"admin"`
	Public  Public  `yaml:"public"`
	Auth    Auth    `yaml:"auth"`
	ACME    ACME    `yaml:"acme"`
	Agent   Agent   `yaml:"agent"`
	Monitor Monitor `yaml:"monitor"`
	Notify  Notify  `yaml:"notify"`
}

type Email struct {
	// SMTP is host:port of the mail server.
	SMTP string `yaml:"smtp"`
	// Security: starttls (default), tls (implicit, port 465) or none (only
	// without username – a password never travels in plain text).
	Security     string `yaml:"security"`
	Username     string `yaml:"username"`
	PasswordFile string `yaml:"password_file"`
	From         string `yaml:"from"`
	// To: one or more addresses, comma-separated.
	To string `yaml:"to"`
	// CAFile: extra trusted roots for the mail server's certificate, e.g.
	// this PKI's root when the mail server has a certificate from it.
	CAFile string `yaml:"ca_file"`
}

type Log struct {
	Level  string `yaml:"level"`  // debug, info, warn, error
	Format string `yaml:"format"` // json (production) or text
}

type Monitor struct {
	// ExpiryDays: warning and critical days before an end-entity
	// certificate expires, "14, 3".
	ExpiryDays string `yaml:"expiry_days"`
	// CAExpiryDays: the same for CA certificates, "90, 30".
	CAExpiryDays string `yaml:"ca_expiry_days"`
	// SealedAfter: how long the server may stay sealed before it alerts.
	SealedAfter string `yaml:"sealed_after"`
	// AgentSilentAfter: how long an agent may be silent before it alerts.
	AgentSilentAfter string `yaml:"agent_silent_after"`
	// RepeatEvery: the reminder for an alert that is still open.
	RepeatEvery string `yaml:"repeat_every"`

	// ScanInterval: how often each endpoint is scanned, "5m" to "24h", or
	// "off" when the server must not connect anywhere.
	ScanInterval string `yaml:"scan_interval"`
	// ScanTimeout: resolve, connect and handshake of one scan together.
	ScanTimeout string `yaml:"scan_timeout"`
	// ScanPorts: the only ports an endpoint may have, "443, 8443".
	ScanPorts string `yaml:"scan_ports"`
	// ScanMaxEndpoints: how many endpoints may be entered.
	ScanMaxEndpoints string `yaml:"scan_max_endpoints"`
	// ScanUnreachableAfter: failed scans in a row before scan_unreachable opens.
	ScanUnreachableAfter string `yaml:"scan_unreachable_after"`
	// ScanMismatchAfter: how old the newest certificate for a name must be
	// before an older one still being served is an alert.
	ScanMismatchAfter string `yaml:"scan_mismatch_after"`
}

type MonitorValues struct {
	ExpiryWarn, ExpiryCrit   time.Duration
	CAWarn, CACrit           time.Duration
	SealedAfter, AgentSilent time.Duration
	RepeatEvery              time.Duration
}

type Notify struct {
	Email   Email   `yaml:"email"`
	Webhook Webhook `yaml:"webhook"`
}

type Public struct {
	// Listen is IP:port; empty disables the listener.
	Listen string `yaml:"listen"`
}

type ScanValues struct {
	// Interval is 0 when scanning is off.
	Interval         time.Duration
	Timeout          time.Duration
	Ports            []int
	MaxEndpoints     int
	UnreachableAfter int
	MismatchAfter    time.Duration
}

type Source struct {
	File string   // the config file that was read
	Env  []string // MYOWNPKI_* variables that overrode a value, sorted
}

type Webhook struct {
	URL string `yaml:"url"`
	// SecretFile holds the HMAC-SHA256 key of X-MyOwnPKI-Signature.
	SecretFile string `yaml:"secret_file"`
	CAFile     string `yaml:"ca_file"`
}