config

var (
	// Application
	EnvJWTSecret            = StringVar("JWT_SECRET", "JWT token signing secret", nil, true)
	EnvLogLevel             = StringVar("LOG_LEVEL", "Logging level (debug, info, warn, error)", ptr("info"), false)
	EnvLogFormat            = StringVar("LOG_FORMAT", "Log output format (json or text)", ptr("json"), false)
	EnvEncryptionKey        = StringVar("ENCRYPTION_KEY", "Master encryption key (64-1024 chars)", nil, true)
	EnvRuntimeMode          = StringVar("RUNTIME_MODE", "Runtime mode (self_hosted or stackdome_cloud)", ptr(string(RuntimeModeSelfHosted)), false)
	EnvComputeMode          = StringVar("COMPUTE_MODE", "Compute mode (bring_your_own or shared)", ptr(string(ComputeModeBYOC)), false)
	EnvStackdomeCloudConfig = StringVar("STACKDOME_CLOUD_CONFIG", "Path to the Stackdome Cloud runtime configuration", nil, false)
	EnvTurnstileSecret      = StringVar("TURNSTILE_SECRET", "Cloudflare Turnstile secret for signup verification", nil, false)
	// GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET are used for GitHub OAuth login
	EnvGitHubClientID     = StringVar("GITHUB_CLIENT_ID", "GitHub OAuth app client ID", nil, false)
	EnvGitHubClientSecret = StringVar("GITHUB_CLIENT_SECRET", "GitHub OAuth app client secret", nil, false)
	EnvGitHubRedirectURI  = StringVar("GITHUB_REDIRECT_URI", "GitHub OAuth app redirect URI (optional; derived from SERVER_EXTERNAL_URL when unset)", nil, false)
	// The GITHUB_APP_* vars configure one platform-wide GitHub App that every
	// org installs; unset leaves each org creating its own app via the
	// manifest flow.
	EnvGitHubAppID            = IntVar("GITHUB_APP_ID", "Platform GitHub App numeric ID", nil, false)
	EnvGitHubAppSlug          = StringVar("GITHUB_APP_SLUG", "Platform GitHub App URL slug", nil, false)
	EnvGitHubAppPrivateKey    = StringVar("GITHUB_APP_PRIVATE_KEY", "Platform GitHub App private key (PEM)", nil, false)
	EnvGitHubAppWebhookSecret = StringVar("GITHUB_APP_WEBHOOK_SECRET", "Platform GitHub App webhook secret", nil, false)

	// Server
	EnvServerHostname    = StringVar("SERVER_HOSTNAME", "Server hostname/domain", nil, false)
	EnvServerExternalURL = StringVar("SERVER_EXTERNAL_URL", "Externally reachable base URL of the hub (used for GitHub App callbacks and webhooks)", nil, false)
	// GitHub API base URL override (httptest stubs / GHES)
	EnvGitHubAPIBaseURL   = StringVar("GITHUB_API_BASE_URL", "GitHub API base URL", ptr("https://api.github.com"), false)
	EnvServerBindAddress  = StringVar("SERVER_BIND_ADDRESS", "Server bind address and port", ptr("0.0.0.0:8000"), false)
	EnvMetricsBindAddress = StringVar("METRICS_BIND_ADDRESS", "Internal Prometheus metrics bind address", ptr("0.0.0.0:9090"), false)

	// Database
	EnvDBHost           = StringVar("DB_HOST", "PostgreSQL host", nil, true)
	EnvDBPort           = IntVar("DB_PORT", "PostgreSQL port", nil, true)
	EnvDBName           = StringVar("DB_NAME", "Database name", nil, true)
	EnvDBUsername       = StringVar("DB_USERNAME", "Database user", nil, true)
	EnvDBPassword       = StringVar("DB_PASSWORD", "Database password", nil, true)
	EnvDBSSLMode        = StringVar("DB_SSL_MODE", "SSL mode (disable or require)", ptr("disable"), false)
	EnvDBMaxConnections = IntVar("DB_MAX_CONNECTIONS", "Max open DB connections", ptr(50), false)
	EnvDBRootCertFile   = StringVar("DB_ROOT_CERT_FILE", "Root CA cert path for SSL", nil, false)
	EnvDBDebugMode      = BoolVar("DB_DEBUG_MODE", "Enable DB query debug logging", ptr(false), false)

	// Shared Compute Cluster
	EnvSharedComputeClusterAPIURL = StringVar("SHARED_COMPUTE_CLUSTER_API_URL", "Shared compute cluster API URL", nil, false)
	EnvSharedComputeClusterCAData = StringVar("SHARED_COMPUTE_CLUSTER_CA_DATA", "Shared compute cluster CA cert (base64)", nil, false)
	EnvSharedComputeClusterToken  = StringVar("SHARED_COMPUTE_CLUSTER_TOKEN", "Shared compute cluster auth token", nil, false)

	// Platform routing and TLS
	EnvPlatformEmail                   = StringVar("PLATFORM_EMAIL", "Operator contact email; ACME contact for the platform TLS issuer", nil, false)
	EnvPlatformBaseDomain              = StringVar("PLATFORM_BASE_DOMAIN", "Base domain for the platform org and per-org subdomains", nil, false)
	EnvPlatformDNSCloudflareAPIToken   = StringVar("PLATFORM_DNS_CLOUDFLARE_API_TOKEN", "Cloudflare API token used for platform wildcard DNS challenges", nil, false)
	EnvPlatformTLSEnabled              = BoolVar("PLATFORM_TLS_ENABLED", "Enable platform-managed TLS on shared compute", ptr(false), false)
	EnvPlatformACMEEnvironment         = StringVar("PLATFORM_ACME_ENVIRONMENT", "Let's Encrypt ACME environment (production or staging)", nil, false)
	EnvPlatformTLSNamespace            = StringVar("PLATFORM_TLS_NAMESPACE", "Namespace for platform TLS resources", nil, false)
	EnvPlatformOrgRegistryStorageSize  = StringVar("PLATFORM_ORG_REGISTRY_STORAGE_SIZE", "Default storage size for each org's registry seeded at signup", ptr(models.DefaultPlatformOrgRegistryStorageSize), false)
	EnvPlatformOrgRegistryStorageClass = StringVar("PLATFORM_ORG_REGISTRY_STORAGE_CLASS", "Default storage class for each org's registry seeded at signup", nil, false)

	// Environment
	EnvStackdomeEnv = StringVar("STACKDOME_ENV", "Runtime environment (DEVELOPMENT, PRODUCTION)", ptr("DEVELOPMENT"), false)

	// Test Overrides
	EnvTestJWTSecret     = StringVar("TEST_JWT_SECRET", "Override JWT secret in tests", nil, false)
	EnvTestEncryptionKey = StringVar("TEST_ENCRYPTION_KEY", "Override encryption key in tests", nil, false)
	EnvTestLogLevel      = StringVar("TEST_LOG_LEVEL", "Override log level in tests", ptr("info"), false)
)

var (
	ErrIncompleteSharedComputeClusterConfig = &ConfigError{"SHARED_COMPUTE_CLUSTER_API_URL, SHARED_COMPUTE_CLUSTER_CA_DATA and SHARED_COMPUTE_CLUSTER_TOKEN must all be set together"}
	ErrUnsupportedComputeMode               = &ConfigError{"COMPUTE_MODE must be bring_your_own or shared"}
	ErrSharedComputeProvisioningRequired    = &ConfigError{"shared compute provisioning is required in shared compute mode"}
	ErrSharedComputeProvisioningNotAllowed  = &ConfigError{"shared compute provisioning is not allowed in bring_your_own compute mode"}
	ErrPlatformRoutingNotAllowed            = &ConfigError{"platform routing is not allowed in bring_your_own compute mode"}
	ErrPlatformBaseDomainRequired           = &ConfigError{"PLATFORM_BASE_DOMAIN is required in shared compute mode"}
	ErrPlatformTLSRequired                  = &ConfigError{"PLATFORM_TLS_ENABLED is required in stackdome_cloud runtime mode"}
	ErrPlatformTLSConfigNotAllowed          = &ConfigError{"platform TLS configuration requires PLATFORM_TLS_ENABLED=true"}
	ErrPlatformEmailRequired                = &ConfigError{"PLATFORM_EMAIL is required when platform TLS is enabled"}
	ErrPlatformCloudflareTokenRequired      = &ConfigError{"PLATFORM_DNS_CLOUDFLARE_API_TOKEN is required when platform TLS is enabled"}
	ErrPlatformACMEEnvironmentInvalid       = &ConfigError{"PLATFORM_ACME_ENVIRONMENT must be production or staging"}
	ErrPlatformTLSNamespaceRequired         = &ConfigError{"PLATFORM_TLS_NAMESPACE is required when platform TLS is enabled"}
)