config

type Config struct {
	// NPM / NPMplus API.
	NPMURL                string
	NPMIdentity           string
	NPMSecret             string
	NPMTimeout            time.Duration
	NPMInsecureSkipVerify bool
	// NPMFlavour pins the API dialect instead of probing for it.
	NPMFlavour npm.Flavour

	// Docker endpoint. Either a unix socket or a TCP endpoint pointing at a
	// docker-socket-proxy (recommended, see SECURITY.md).
	DockerHost string

	// Behaviour.
	LabelPrefix string
	ResolveIP   bool
	NPMNetwork  string
	// StrictNetwork skips a container that is not attached to NPMNetwork
	// instead of falling back to an address NPM cannot route to. Only has an
	// effect when NPMNetwork is set.
	StrictNetwork bool
	// NPMContainer is the name of the NPM/NPMplus container. When set, its
	// networks are used for upstream resolution (Redth: NPM_CONTAINER_NAME).
	NPMContainer string
	// ExposedByDefault manages every container carrying labels of the
	// namespace, without requiring npm.enable=true.
	ExposedByDefault bool
	// StrictLabels skips a resource whose labels contain an unknown field.
	StrictLabels bool
	// PortPreference orders the exposed ports when a container has several.
	PortPreference []int
	// Defaults are the effective per-field defaults from the environment.
	Defaults *fields.Defaults
	// CertificatePartial decides what happens when no certificate covers
	// every domain of a host.
	CertificatePartial certs.Partial
	// CertificateAutoCreate requests a Let's Encrypt certificate when the
	// automatic selection finds nothing.
	CertificateAutoCreate bool
	// CertificatePoll is how often the certificate list is polled.
	CertificatePoll time.Duration
	// MigrateFromRedth takes over hosts created by Redth/npm-docker-sync.
	MigrateFromRedth bool
	// OnStop decides what happens to the resources of a container that is
	// stopped but still exists.
	OnStop docker.OnStop
	// StopGrace is how long a stopped container is ignored, so a restart does
	// not produce a disable/enable cycle.
	StopGrace time.Duration
	// InstanceID identifies this sync instance in the resource meta.
	InstanceID string
	// DeleteGuard is the largest share of the managed resources one run may
	// delete; 0 disables the guard.
	DeleteGuard float64
	// DeleteGuardMin is how many deletions a run needs before the share guard
	// applies at all.
	DeleteGuardMin   int
	Kinds            []npm.Kind
	DebounceInterval time.Duration
	DebounceMaxWait  time.Duration
	ResyncInterval   time.Duration
	DeleteOrphans    bool
	AdoptExisting    bool
	DryRun           bool
	ShutdownTimeout  time.Duration

	// Observability.
	LogLevel   slog.Level
	LogFormat  string
	HealthAddr string
	// LogPayloads mirrors full API request bodies into the debug log.
	LogPayloads bool

	// Warnings are non-fatal configuration problems, reported once at start.
	Warnings []string
	// Notices record which alias spelling of a variable was used, so a
	// configuration copied from another project is traceable in the log.
	Notices []string
}

type Getenv func(string) string