config

type Config struct {
	// Host is the hostname or IP address to bind to.
	// Equivalent to LocalStack's LOCALSTACK_HOST.
	// Use "127.0.0.1" to restrict to localhost only.
	// Defaults to "0.0.0.0" (all interfaces).
	Host string

	// Port is the TCP port the HTTP server listens on.
	Port int

	// Hostname is the externally-reachable hostname or IP that services embed
	// in URLs returned to clients (e.g. SQS QueueUrl, SNS UnsubscribeURL,
	// RDS Endpoint.Address). When empty, defaults to "localhost".
	// Set OVERCAST_HOSTNAME when Overcast runs in Docker Compose alongside
	// app containers that need to reach it by its service name.
	Hostname string

	// Services is the set of AWS services to enable.
	// Map key is the lowercase service name, e.g. "s3", "sqs".
	Services map[string]bool

	// State controls the global storage backend used for all services.
	// Individual services may override this via ServiceStates.
	State StateBackend

	// ServiceStates overrides the global State for individual services.
	// Keys are lowercase service names ("s3", "sqs", "dynamodb", etc.).
	// Entries missing from the map inherit the global State.
	ServiceStates map[string]StateBackend

	// HybridFlushInterval controls how often the hybrid store flushes
	// in-memory state to disk. Only meaningful when State or a per-service
	// mode is "hybrid".
	HybridFlushInterval time.Duration

	// WALFsyncMode controls fsync policy for the WAL backend.
	// Valid values: always, interval, never.
	WALFsyncMode string

	// WALFsyncInterval controls periodic fsync cadence when WALFsyncMode is
	// set to interval.
	WALFsyncInterval time.Duration

	// WALMaxLogBytes triggers log compaction when the append log grows past
	// this size.
	WALMaxLogBytes int64

	// DataDir is the root directory for the SQLite file and any
	// on-disk state (analogous to LocalStack's DATA_DIR).
	DataDir string

	// Region is the default AWS region reported in ARNs and responses.
	Region string

	// AccountID is the fake AWS account ID embedded in ARNs.
	AccountID string

	// EKSMode controls whether the EKS service stays metadata-only (`mock`) or
	// enables the live k3s-backed control plane path (`live`).
	EKSMode EKSMode

	// SigV4Validate enables SigV4 signature verification.
	SigV4Validate bool

	// EnforceIAM enables opt-in IAM authorization enforcement middleware.
	// Default false.
	EnforceIAM bool

	// CFNSyncWait is the bounded time CloudFormation waits for fast stack
	// create/update/delete provisioning to reach a terminal state before returning.
	// A zero value disables the wait and restores fully asynchronous behaviour.
	// Corresponds to env var OVERCAST_CFN_SYNC_WAIT_MS. Default 1000ms.
	CFNSyncWait time.Duration

	// ShutdownTimeout is how long the server waits for in-flight
	// requests to complete before forcibly closing.
	ShutdownTimeout time.Duration

	// LogLevel controls log verbosity: "debug", "info", "warn", "error".
	LogLevel string

	// LambdaDockerSocket is the path to the Docker daemon socket used to
	// manage Lambda container siblings. Defaults to the platform Docker socket
	// (/var/run/docker.sock on Linux/macOS, npipe:////./pipe/docker_engine on Windows).
	LambdaDockerSocket string

	// LambdaNetwork is the Docker network name that Lambda containers are
	// attached to. Must be reachable from the Overcast container.
	// Defaults to "overcast_lambda".
	LambdaNetwork string

	// LambdaRuntimeAPIPort is the port on which Overcast exposes the Lambda
	// Runtime API to containers. Each container connects back on this port.
	// Defaults to 9001.
	LambdaRuntimeAPIPort int

	// LambdaDockerMaxConcurrentStarts bounds concurrent Docker-backed Lambda
	// environment starts. This is local Docker backpressure, not an AWS-facing
	// Lambda concurrency quota. Corresponds to env var
	// LAMBDA_DOCKER_MAX_CONCURRENT_STARTS. Default 4.
	LambdaDockerMaxConcurrentStarts int

	// LambdaInitTimeout is the maximum time to wait for a Docker-backed Lambda
	// runtime to finish INIT and poll the Runtime API for its first invocation.
	// This is separate from the function invocation timeout. Corresponds to env
	// var LAMBDA_INIT_TIMEOUT_SECONDS. Default 10s.
	LambdaInitTimeout time.Duration

	// LambdaKeepContainers controls whether Docker containers are removed when
	// a Lambda instance expires (idle timeout) or the function is deleted.
	// Set to true to keep stopped containers for post-mortem inspection.
	// Corresponds to env var LAMBDA_KEEP_CONTAINERS. Default false.
	LambdaKeepContainers bool

	// LambdaHotReload enables bind-mount based source reload for functions that
	// opt in via the overcast:hot-reload-path function tag.
	// Corresponds to env var OVERCAST_LAMBDA_HOT_RELOAD. Default false.
	LambdaHotReload bool

	// LambdaFetchRemoteLayers enables downloading layer content from real AWS
	// when a layer ARN is not found locally. Requires valid AWS credentials.
	// Downloaded layers are cached on disk and have /opt/extensions/ stripped
	// (extensions can't run locally without the full Lambda platform).
	// Corresponds to env var LAMBDA_FETCH_REMOTE_LAYERS. Default false.
	LambdaFetchRemoteLayers bool

	// LambdaLayerCacheDir overrides the directory used to look up and cache
	// layer zip files. When empty, defaults to {DataDir}/layers (typically
	// /data/layers in the standard Docker image).
	// Users can pre-download layers and mount this directory to avoid needing
	// AWS credentials at runtime. Files are named {sha256(arn)}.zip.
	// Corresponds to env var LAMBDA_LAYER_CACHE_DIR.
	LambdaLayerCacheDir string

	// LambdaRemoteAWSAccessKeyID is the AWS access key used for fetching
	// remote layers. Read from LAMBDA_REMOTE_AWS_ACCESS_KEY_ID.
	LambdaRemoteAWSAccessKeyID string

	// LambdaRemoteAWSSecretAccessKey is the AWS secret key used for fetching
	// remote layers. Read from LAMBDA_REMOTE_AWS_SECRET_ACCESS_KEY.
	LambdaRemoteAWSSecretAccessKey string

	// LambdaRemoteAWSSessionToken is the optional session token for fetching
	// remote layers. Read from LAMBDA_REMOTE_AWS_SESSION_TOKEN.
	LambdaRemoteAWSSessionToken string

	// ECSDockerSocket is the path to the Docker daemon socket used to manage
	// ECS task containers. Defaults to the same value as LambdaDockerSocket.
	ECSDockerSocket string

	// ECSNetwork is the Docker network name that ECS task containers are
	// attached to. Defaults to "overcast_ecs".
	ECSNetwork string

	// ECSKeepContainers controls whether Docker containers are removed when
	// an ECS task stops. Set to true for post-mortem inspection.
	// Corresponds to env var ECS_KEEP_CONTAINERS. Default false.
	ECSKeepContainers bool

	// RDSDockerSocket is the path to the Docker daemon socket used to manage
	// RDS database containers. Defaults to the same value as LambdaDockerSocket.
	RDSDockerSocket string

	// RDSNetwork is the Docker network name that RDS database containers are
	// attached to. Defaults to "overcast_rds".
	RDSNetwork string

	// RDSPortBase is the starting host port for RDS database containers.
	// Each DB instance gets a sequential port starting from this base.
	// Defaults to 33060.
	RDSPortBase int

	// RDSKeepContainers controls whether Docker containers are removed when
	// an RDS instance is deleted. Set to true for post-mortem inspection.
	// Corresponds to env var RDS_KEEP_CONTAINERS. Default false.
	RDSKeepContainers bool

	// ElastiCacheDockerSocket is the path to the Docker daemon socket used to
	// manage ElastiCache Redis/Valkey containers. Defaults to the same value as
	// LambdaDockerSocket.
	ElastiCacheDockerSocket string

	// ElastiCacheNetwork is the Docker network name that ElastiCache containers
	// are attached to. Defaults to "overcast_elasticache".
	ElastiCacheNetwork string

	// ElastiCachePortBase is the starting host port for ElastiCache containers.
	// Each cache cluster gets a sequential port starting from this base.
	// Defaults to 63790.
	ElastiCachePortBase int

	// ElastiCacheKeepContainers controls whether Docker containers are removed
	// when a cache cluster is deleted. Set to true for post-mortem inspection.
	// Corresponds to env var ELASTICACHE_KEEP_CONTAINERS. Default false.
	ElastiCacheKeepContainers bool

	// MSKDockerSocket is the path to the Docker daemon socket for MSK Redpanda containers.
	MSKDockerSocket string

	// MSKNetwork is the Docker network name for MSK containers.
	MSKNetwork string

	// MSKPortBase is the starting host port for MSK containers.
	MSKPortBase int

	// MSKKeepContainers controls whether Docker containers are removed on delete.
	MSKKeepContainers bool

	// EKSDockerSocket is the path to the Docker daemon socket used to manage
	// EKS live-mode control-plane containers. Defaults to the same value as
	// LambdaDockerSocket.
	EKSDockerSocket string

	// EKSNetwork is the Docker network name that EKS live-mode containers are
	// attached to. Defaults to "overcast_eks".
	EKSNetwork string

	// EC2VPCNetworkStrategy selects the policy used to map stored VPCs onto
	// Docker networks. Docker bridges share one host address space, so two
	// VPCs with overlapping CIDRs cannot both back real networks. Valid
	// values:
	//
	//   shared   (default) — overlapping VPCs share one Docker network.
	//                        Fastest, isolation leaks between sharers.
	//   strict              — reject overlapping CIDRs at CreateVpc; startup
	//                        tolerates existing overlaps. (future)
	//   remapped            — allocate a shadow CIDR from 100.64.0.0/10
	//                        when the requested range collides. (future)
	//   netns               — per-VPC Linux netns for true overlap. (future)
	//
	// Values other than "shared" currently fall back to "shared" with a
	// startup warning. Corresponds to env var OVERCAST_EC2_VPC_STRATEGY.
	EC2VPCNetworkStrategy string

	// Debug enables the /_debug/* endpoint namespace.
	// These endpoints expose internal state and should never be enabled
	// in shared or production environments.
	Debug bool

	// TLSCertFile is the path to the TLS certificate file.
	// When set (together with TLSKeyFile), the server uses HTTPS.
	TLSCertFile string

	// TLSKeyFile is the path to the TLS private key file.
	TLSKeyFile string

	// SMTPMock enables the built-in SMTP capture server. When true, all
	// outbound SNS email/email-json notifications are delivered to the local
	// capture server and are browseable in the web UI under /mail.
	// Automatically set to false when SMTPHost is configured.
	SMTPMock bool

	// SMTPPort is the TCP port the mock SMTP server listens on, and also the
	// default port the mailer dials when SMTPHost is unset.
	SMTPPort int

	// SMTPHost is the hostname of an external SMTP relay. When set, SMTPMock
	// is automatically false and the built-in capture server is not started.
	SMTPHost string

	// SMTPFrom is the envelope From address used when sending SNS email notifications.
	SMTPFrom string

	// SMTPUsername and SMTPPassword are the credentials for SMTP AUTH PLAIN
	// when connecting to an external relay. Leave empty for no authentication.
	SMTPUsername string
	SMTPPassword string

	// SMTPTLS enables implicit TLS (port 465). For STARTTLS (port 587) leave
	// this false — Go's net/smtp client upgrades automatically.
	SMTPTLS bool

	// SMTPInboxMax is the maximum number of messages the capture store retains.
	// When exceeded, the oldest message is evicted.
	SMTPInboxMax int

	// InitEnabled controls whether init hook scripts are executed.
	// Defaults to true.
	InitEnabled bool

	// InitDirs is the list of base directories to scan for init hook scripts.
	// Each directory should contain stage subdirs: boot.d/, start.d/, ready.d/,
	// shutdown.d/. Scripts are executed in the order directories appear, then
	// alphabetically within each directory.
	// Defaults to ["/etc/localstack/init", "/etc/overcast/init"].
	InitDirs []string

	// InitTimeout is the maximum time allowed for each individual init script.
	// Defaults to 30s.
	InitTimeout time.Duration

	// Version is the build version string, injected via -ldflags at build time.
	// Not loaded from environment — set by the caller after Load().
	Version string

	// MCPReplayLimit bounds in-memory MCP notification replay history for
	// Last-Event-ID reconnect support. A value of 0 disables replay retention.
	// Default: 256.
	MCPReplayLimit int

	// MCPRemoteExposure explicitly enables remote/runtime MCP exposure mode.
	// When true, MCPAuthToken must be configured.
	MCPRemoteExposure bool

	// MCPAuthToken is the bearer token required for HTTP access to runtime MCP
	// when MCPRemoteExposure is enabled.
	MCPAuthToken string
}

type EKSMode string

type StateBackend string