config

type Config struct {
	Server    ServerConfig    `koanf:"server"`
	Scanner   ScannerConfig   `koanf:"scanner"`
	Storage   StorageConfig   `koanf:"storage"`
	RateLimit RateLimitConfig `koanf:"ratelimit"`
	Security  SecurityConfig  `koanf:"security"`
	Reports   ReportsConfig   `koanf:"reports"`
	Logging   LoggingConfig   `koanf:"logging"`
}

type LoadOptions struct {
	// ConfigPath, if non-empty, points at a YAML file. A missing file is
	// silently ignored so the binary works without config on a fresh install.
	ConfigPath string
	// Flags is an already-parsed pflag.FlagSet whose long-name keys (using
	// dots, e.g. "server.listen") override env and YAML values. May be nil.
	Flags *pflag.FlagSet
}

type LoggingConfig struct {
	Level      string `koanf:"level"`  // debug | info | warn | error
	Format     string `koanf:"format"` // json | text
	LogTargets bool   `koanf:"log_targets"`
}

type PerIPLimit struct {
	Rate   int           `koanf:"rate"`
	Period time.Duration `koanf:"period"`
}

type PerTargetLimit struct {
	Cooldown time.Duration `koanf:"cooldown"`
}

type RateLimitConfig struct {
	PerIP     PerIPLimit     `koanf:"per_ip"`
	PerTarget PerTargetLimit `koanf:"per_target"`
}

type RedisConfig struct {
	URL string `koanf:"url"`
}

type ReportsConfig struct {
	DefaultVisibility string `koanf:"default_visibility"` // public | private
	PrivateTokenBytes int    `koanf:"private_token_bytes"`
}

type ScannerConfig struct {
	MaxConcurrentScans         int           `koanf:"max_concurrent_scans"`
	MaxConcurrentChecksPerScan int           `koanf:"max_concurrent_checks_per_scan"`
	PerCheckTimeout            time.Duration `koanf:"per_check_timeout"`
	PerScanTimeout             time.Duration `koanf:"per_scan_timeout"`
	UserAgent                  string        `koanf:"user_agent"`
}

type SecurityConfig struct {
	RefusePrivateRanges bool `koanf:"refuse_private_ranges"`
	RefuseLoopback      bool `koanf:"refuse_loopback"`
	RefuseCGNAT         bool `koanf:"refuse_cgnat"`
	RefuseLinkLocal     bool `koanf:"refuse_link_local"`
	// RefuseMetadata is a separate hard-toggle from RefusePrivateRanges:
	// disabling metadata blocking on a cloud host is essentially a
	// pre-authorised IAM-credential heist, so we keep it default-true
	// and log a WARN at startup if it's flipped off.
	RefuseMetadata  bool     `koanf:"refuse_metadata"`
	DomainBlocklist []string `koanf:"domain_blocklist"`
	AllowedCIDRs    []string `koanf:"allowed_cidrs"`
	AllowedHosts    []string `koanf:"allowed_hosts"`
}

type ServerConfig struct {
	Listen       string        `koanf:"listen"`
	ReadTimeout  time.Duration `koanf:"read_timeout"`
	WriteTimeout time.Duration `koanf:"write_timeout"`
}

type StorageConfig struct {
	Backend string        `koanf:"backend"` // memory | ristretto | redis
	TTL     time.Duration `koanf:"ttl"`
	Redis   RedisConfig   `koanf:"redis"`
}