util

type CommonConfig struct {
	DefaultDomain string `json:"default_domain"`

	// SmtpHost/Port/User/Pass/TLSMode and EmailSender are the shared
	// outbound mail relay settings (Settings.Smtp*/EmailSender, edited on
	// the admin UI's Factum > Email tab) - factum2-icinga-notifications
	// is the first consumer, but any tool needing to send mail can reuse
	// these instead of having its own copy.
	SmtpHost    string `json:"smtp_host"`
	SmtpPort    uint16 `json:"smtp_port"`
	SmtpUser    string `json:"smtp_user"`
	SmtpPass    string `json:"smtp_pass"`
	SmtpTLSMode string `json:"smtp_tls_mode"`
	EmailSender string `json:"email_sender"`
}

type ConfigAgentRoot struct {
	Factum  ConfigFactum  `yaml:"factum"`
	Worker  ConfigWorker  `yaml:"worker"`
	Driver  ConfigDriver  `yaml:"driver" optional:"true"`
	Storage ConfigStorage `yaml:"storage" optional:"true"`
}

type ConfigDB struct {
	Host     string `boa:"configonly" yaml:"host"`
	Port     string `boa:"configonly" yaml:"port"`
	User     string `boa:"configonly" yaml:"user"`
	Pass     string `boa:"configonly" yaml:"pass"`
	Database string `boa:"configonly" yaml:"database"`
}

type ConfigDNS struct {
	CommonConfig
	DestFile        string
	IgnoreModels    string
	IgnorePlatforms string
}

type ConfigDeviceSync struct {
	CommonConfig
	VRFInGlobal  []string
	DeviceStates []string
	DeviceIgnore []string
	// VlanGroupName is the Netbox VLAN Group every synced VLAN is created
	// in (Settings.DeviceSyncVlanGroupName) - "" disables VLAN sync.
	VlanGroupName string
	// InventoryMaps is sync_source → netbox_type from cfgmgmt service
	// types (ELINE→evpl, ELAN→vpls, L3VPN→vrf). Empty means device-sync
	// falls back to ELINE→evpl only.
	InventoryMaps map[string]string
	// ServiceSources is the allow-list of sync sources to write
	// (eline, elan, l3vpn). Nil means every implemented source. An empty
	// slice means write no services, including the ELINE fallback.
	ServiceSources *[]string
	// Workers is how many devices one run handles at once
	// (Settings.DeviceSyncWorkers). Values below 1 mean
	// models.DefaultDeviceSyncWorkers.
	Workers int
	Auth    map[string]ConfigDeviceSyncAuth
}

type ConfigDeviceSyncAuth struct {
	Username string
	Password string
}

type ConfigDriver struct {
	Platforms      *[]string `boa:"configonly" yaml:"platforms" optional:"true"`
	IdleTimeout    string    `boa:"configonly" yaml:"idle_timeout" optional:"true"`
	MaxSessions    int       `boa:"configonly" yaml:"max_sessions" optional:"true"`
	QueueDepth     int       `boa:"configonly" yaml:"queue_depth" optional:"true"`
	AcquireTimeout string    `boa:"configonly" yaml:"acquire_timeout" optional:"true"`
	Keepalive      string    `boa:"configonly" yaml:"keepalive" optional:"true"`
	SessionURL     string    `boa:"configonly" yaml:"session_url" optional:"true"`
	SessionToken   string    `boa:"configonly" yaml:"session_token" optional:"true"`
	Socket         string    `boa:"configonly" yaml:"socket" optional:"true"`
	Listen         string    `boa:"configonly" yaml:"listen" optional:"true"`
	Token          string    `boa:"configonly" yaml:"token" optional:"true"`
	TLSCert        string    `boa:"configonly" yaml:"tls_cert" optional:"true"`
	TLSKey         string    `boa:"configonly" yaml:"tls_key" optional:"true"`
	TLSCA          string    `boa:"configonly" yaml:"tls_ca" optional:"true"`
	AllowCIDRs     []string  `boa:"configonly" yaml:"allow_cidrs" optional:"true"`
}

type ConfigFactum struct {
	// URL/Token are optional at the boa level - like ConfigWorker.Roles,
	// not every subcommand of every binary that embeds ConfigFactum
	// actually calls out to the primary (e.g. "factum2-worker start" never
	// does, only "run" does, via internal/worker.RunRemote), so requiring
	// them unconditionally would force values into a config file that
	// aren't needed for that particular subcommand. Call sites that do
	// need them (RunRemote, internal/factum.FactumClient) check for an
	// empty URL/Token themselves and fail with a clear error instead.
	URL string `boa:"configonly" yaml:"url" optional:"true"`
	// Token authenticates server-to-server callers (internal/factum's HTTP
	// client, used by e.g. factum2-dns and factum2-librenms-cli, the latter
	// typically running on a different host than the primary) against the
	// primary's Settings.FactumApiToken, sent as "Authorization: Bearer
	// <token>". See web.Controller.RequireAPIAuth.
	Token string `boa:"configonly" yaml:"token" optional:"true"`
	// Socket is the local unix API path when this CLI is co-located with
	// factum2-worker. Empty uses DefaultHubSocket unless FACTUM_WORKER_API_SOCKET
	// overrides it; "none"/"0" disables the socket (CLI-only escape hatch).
	// Primary-side CLIs should call WithoutHubSocket rather than relying on
	// operators to set this.
	Socket string `boa:"configonly" yaml:"socket" optional:"true"`
}

type ConfigIcinga struct {
	CommonConfig
	URL      string
	Username string
	Password string

	HostsFile      string
	UsersFile      string
	CertsFile      string
	InterfacesFile string

	// MonitorInterfaces writes passive interface services and is what
	// factum2-icinga poll requires before it polls. SNMPCommunities is a
	// newline-separated SNMPv2c community list. EAPIUser/EAPIPassword are
	// the Arista eAPI account for EOS patch-panel status.
	MonitorInterfaces bool
	SNMPCommunities   string
	EAPIUser          string
	EAPIPassword      string

	// IgnoreDevices is a newline-separated list of device names to skip
	// entirely (Settings.IcingaIgnoreDevices).
	IgnoreDevices string
	// DefaultNotification is Jet template source executed with
	// .Device for a host that has no CfAlarmDestination
	// (Settings.IcingaDefaultNotification). Literal Icinga lines with no
	// {{ }} still render unchanged. The result is inserted into the host
	// object via hostTemplateData.Options.
	DefaultNotification string

	// HostTemplate/DependencyTemplate/UserTemplate/CertTemplate are Jet
	// templates source, executed by internal/icinga.FactumIcingaClient -
	// see that package for the data each is executed with.
	HostTemplate       string
	DependencyTemplate string
	UserTemplate       string
	CertTemplate       string

	// Certificates is the slim list used to emit Icinga cert checks
	// (name, check host, DNS names). Fetched with icinga-config so the
	// Icinga worker does not need ACME account secrets.
	Certificates []ConfigIcingaCert
}

type ConfigIcingaCert struct {
	Name    string   `json:"name"`
	Host    string   `json:"host"`
	Domains []string `json:"domains"`
}

type ConfigLdapWriteback struct {
	BindDN   string `boa:"configonly" yaml:"bind_dn" optional:"true"`
	Password string `boa:"configonly" yaml:"bind_password" optional:"true"`
}

type ConfigLibrenms struct {
	CommonConfig
	URL string
	Key string

	// PersistentDevices is a newline-separated list of LibreNMS hostnames
	// or display names sync never quarantines or deletes - see
	// Settings.LibrenmsPersistentDevices's doc comment.
	PersistentDevices string
	// DelayedDeleteEnabled/DelayedDeleteDays control the LibreNMS delete
	// path - see Settings.LibrenmsDelayedDeleteEnabled's doc comment.
	DelayedDeleteEnabled bool
	DelayedDeleteDays    int
	// RolesEnabled/InterfacesDisabled are newline-separated lists of
	// regexes - see Settings.LibrenmsRolesEnabled's doc comment.
	RolesEnabled       string
	InterfacesDisabled string

	// SNMPVersion/SNMPCommunities are used when creating devices in
	// LibreNMS - see Settings.LibrenmsSNMPVersion/LibrenmsSNMPCommunities's
	// doc comments. SNMPCommunities is newline-separated, same convention
	// as RolesEnabled/InterfacesDisabled.
	SNMPVersion     string
	SNMPCommunities string
}

type ConfigNetbox struct {
	CommonConfig
	URL   string
	Token string
}

type ConfigOxidized struct {
	CommonConfig
	URL  string
	User string
	Pass string

	// DestFile is oxidized's own router.db - the file
	// internal/oxidized.FactumOxidizedClient.Sync writes the filtered
	// device list to (name:ip:model per line).
	DestFile string

	// IgnoreDevices/IgnoreManufacturers/IgnoreModels/IgnorePlatforms are
	// newline-separated lists (one value per line) - a device matching any
	// one of them is skipped during sync.
	IgnoreDevices       string
	IgnoreManufacturers string
	IgnoreModels        string
	IgnorePlatforms     string
}

type ConfigPrometheus struct {
	CommonConfig
	DestFile  string
	ReloadURL string
	Module    string
	Auth      string

	IgnoreDevices       string
	IgnoreManufacturers string
	IgnoreModels        string
	IgnorePlatforms     string
}

type ConfigRoot struct {
	DB            ConfigDB            `yaml:"db"`
	Factum        ConfigFactum        `yaml:"factum"`
	Web           ConfigWeb           `yaml:"web"`
	Worker        ConfigWorker        `yaml:"worker"`
	LdapWriteback ConfigLdapWriteback `yaml:"ldap_writeback"`
	Driver        ConfigDriver        `yaml:"driver" optional:"true"`
	Storage       ConfigStorage       `yaml:"storage" optional:"true"`
}

type ConfigStorage struct {
	Socket string `boa:"configonly" yaml:"socket" optional:"true"`
}

type ConfigWeb struct {
	Bind      string
	JWTSecret string
	// WiregasmDir is where wiregasm.js, wiregasm.wasm.gz and
	// wiregasm.data.gz live (make wiregasm). Empty searches
	// /usr/share/factum2/wiregasm and web/static/wiregasm, then the
	// copy embedded in a release binary.
	WiregasmDir string `yaml:"wiregasm_dir" boa:"configonly" optional:"true"`
}

type ConfigWorker struct {
	// Roles lists what this worker instance does. "primary" runs the
	// primary loop (dispatches ad hoc commands via "factum2-worker run" and
	// logs everything agents report); any other entry is the name of a
	// Commands entry that this instance additionally runs as an agent for
	// - so one worker process can be primary AND handle one or more
	// specific agent roles (e.g. ["primary", "librenms"]) at once, instead
	// of being purely one or the other. Every non-"primary" role must have
	// a matching Commands entry.
	//
	// optional:"true" because boa's required-field check would otherwise
	// treat this flat []string as required (unlike map fields, which
	// default to optional) for every cmd/worker subcommand, including ones
	// like "run" and "show-config" that never look at it - Worker.Start
	// does its own "at least one role" check instead, only when it
	// actually matters.
	Roles []string `boa:"configonly" yaml:"roles" optional:"true"`
	// Commands lists the predefined commands this worker is able to run as
	// an agent, keyed by name - Roles selects which of these (if any) this
	// particular instance actually activates. An agent only ever receives
	// commands it has both defined here and activated via Roles - there is
	// no separate addressing by node name.
	Commands map[string]ConfigWorkerCommand `boa:"configonly" yaml:"commands"`

	// Paths pins executables and output files this host will accept from
	// the primary. See ConfigWorkerPaths.
	Paths ConfigWorkerPaths `boa:"configonly" yaml:"paths" optional:"true"`

	// Listen is the bind address (e.g. ":8443") for this agent's hub
	// listener (internal/worker.runHubListener), which the primary's
	// RemoteManager dials into - the reverse of this agent dialing out.
	// Empty (the default) disables the listener entirely.
	Listen string `boa:"configonly" yaml:"listen" optional:"true"`
	// Token is the shared secret this agent expects from the primary as
	// "Authorization: Bearer <Token>" on the hub connection - the primary
	// side of the same value lives on the matching models.WorkerNode row,
	// not in any config file.
	Token string `boa:"configonly" yaml:"token" optional:"true"`
	// TLSCert/TLSKey are the PEM files the hub listener serves WSS with.
	// Required for factum2-worker start (hub RPC carries config secrets;
	// there is no ws:// fallback). optional at boa level so show-config
	// and run do not force them.
	TLSCert string `boa:"configonly" yaml:"tls_cert" optional:"true"`
	TLSKey  string `boa:"configonly" yaml:"tls_key" optional:"true"`
	// APISocket is the unix HTTP listener for hub RPC. Empty uses
	// DefaultHubSocket / FACTUM_WORKER_API_SOCKET; "none"/"0" is invalid
	// for factum2-worker start (fail closed). Not a route on worker.listen.
	APISocket string `boa:"configonly" yaml:"api_socket" optional:"true"`
	// RadiusState is the on-disk copy of the RADIUS policy, including
	// directory and NAS secrets. Empty uses /var/lib/factum2/radius/cache.json.
	// The worker keeps answering from this file while factum2 is down.
	RadiusState string `boa:"configonly" yaml:"radius_state" optional:"true"`
}

type ConfigWorkerCommand struct {
	Cmd       string   `boa:"configonly" yaml:"cmd"`
	Args      []string `boa:"configonly" yaml:"args"`
	AllowArgs []string `boa:"configonly" yaml:"allow_args" optional:"true"`
}

type ConfigWorkerPaths struct {
	LegoBin              string `boa:"configonly" yaml:"lego_bin" optional:"true"`
	LegoYaml             string `boa:"configonly" yaml:"lego_yaml" optional:"true"`
	LegoEnv              string `boa:"configonly" yaml:"lego_env" optional:"true"`
	LegoStorage          string `boa:"configonly" yaml:"lego_storage" optional:"true"`
	DNSDestFile          string `boa:"configonly" yaml:"dns_dest_file" optional:"true"`
	DNSZonesFile         string `boa:"configonly" yaml:"dns_zones_file" optional:"true"`
	DNSPrefixesFile      string `boa:"configonly" yaml:"dns_prefixes_file" optional:"true"`
	OxidizedDestFile     string `boa:"configonly" yaml:"oxidized_dest_file" optional:"true"`
	PrometheusDestFile   string `boa:"configonly" yaml:"prometheus_dest_file" optional:"true"`
	IcingaHostsFile      string `boa:"configonly" yaml:"icinga_hosts_file" optional:"true"`
	IcingaUsersFile      string `boa:"configonly" yaml:"icinga_users_file" optional:"true"`
	IcingaCertsFile      string `boa:"configonly" yaml:"icinga_certs_file" optional:"true"`
	IcingaInterfacesFile string `boa:"configonly" yaml:"icinga_interfaces_file" optional:"true"`
	StorageRoot          string `boa:"configonly" yaml:"storage_root" optional:"true"`
	// IcingaCommandPipe and IcingaInterfaceState are local to this worker.
	// They are not worker.paths keys: a destination field must not be able
	// to name the command pipe, or sync could overwrite it.
	IcingaCommandPipe    string `boa:"configonly" yaml:"icinga_command_pipe" optional:"true"`
	IcingaInterfaceState string `boa:"configonly" yaml:"icinga_interface_state" optional:"true"`
}

type Response struct {
	Status  string `json:"status"`
	Message string `json:"message"`
	Data    any    `json:"data"`
}