server

type Config struct {
	// Addr is the TCP address to listen on, e.g. ":8080".
	Addr string
	// ServerID identifies this server in the login transcript, normally its public WebSocket URL, e.g.
	// "wss://vfs.example/v1/ws". A client that compares it with the URL it connected to detects a challenge relayed
	// by another server. Required.
	ServerID string
	// Store selects the store. Required.
	Store StoreKind

	// DatabaseURL is the PostgreSQL connection string. Required for StorePostgres.
	DatabaseURL string
	// DBMaxConns and DBMinConns set the connection pool size. 0 keeps the pgxpool default.
	DBMaxConns int32
	DBMinConns int32
	// RequireSyncReplication makes Run refuse to start unless PostgreSQL replicates commits synchronously, that is,
	// unless synchronous_standby_names is set. A commit is then acknowledged only once a standby has it, so a failover
	// does not lose acknowledged commits. Only for StorePostgres. Without it, Run logs a warning instead.
	RequireSyncReplication bool

	// MaxFrameBytes is the largest WebSocket frame accepted. It must hold one block of the largest page size.
	MaxFrameBytes uint32
	// MaxCommitBytes is the largest commit accepted, over all its parts.
	MaxCommitBytes uint64
	// PingInterval is the interval at which clients ping while idle.
	PingInterval time.Duration
	// LeaseTTL is the time after the last renewal from which another instance can take a lease without takeover.
	// It must be at least twice PingInterval, so that one lost ping does not cost a client its lease.
	//
	// A connected client's lease is written to the store every LeaseTTL/2, so a longer TTL means fewer writes. The
	// cost is the wait for another instance after a client stopped without closing: up to LeaseTTL, unless it takes
	// the database over. The same instance, by its instance ID, opens again at once.
	LeaseTTL time.Duration
	// HelloTimeout is the time a client has to complete the login.
	HelloTimeout time.Duration
	// AllowedOrigins lists the hosts from which a browser page may connect. In each pattern, `*` matches any part of
	// a host, e.g. `*.example.com` or `127.0.0.1:*`. Empty allows only pages from the server's own origin. Clients
	// other than browsers send no Origin header and are not affected.
	AllowedOrigins []string
	// DeleteUnusedAfter deletes a database that no client has opened, read or committed to for this long. It is
	// meant for databases whose owner has lost the key: nobody can delete them otherwise. A deleted database keeps a
	// small record, so that its version continues if it is created again and a client's outdated cache is not
	// taken for current. The server checks once an hour. 0 turns the deletion off; otherwise it must be at least one
	// day.
	DeleteUnusedAfter time.Duration

	// TokenJWKSURL or TokenJWKSFile turns on access tokens: the server then admits only clients that present a JWT
	// from a token service, bound to their key. The JWKS holds the token service's public keys. A JWKS URL is fetched
	// again after its max-age, at most five minutes, and when a token names an unknown key, at most once a minute.
	// It must use https, except on localhost. A JWKS file is read once at start. Only one of the two may be set.
	TokenJWKSURL  string
	TokenJWKSFile string
	// TokenIssuer is the required iss claim of a token. Required with access tokens.
	TokenIssuer string
	// TokenAudience is the required aud claim of a token. Empty means ServerID.
	TokenAudience string
	// TokenLeeway allows for clock differences between the token service and this server when checking exp and
	// nbf. A connection whose token expired more than TokenLeeway ago is closed at the next request.
	TokenLeeway time.Duration
}

type ConfigError struct {
	Field   string
	Problem string
}

type StoreKind string