config

type Config struct {
	// --- Core ---
	DatabaseURL string // Airlock's own Postgres connection
	JWTSecret   string
	ServerAddr  string

	// --- S3 / Object Storage ---
	// Three audiences: Airlock process, agent containers, public internet.
	S3URL       string // Airlock process → MinIO (e.g. "http://localhost:9090")
	S3URLAgent  string // Agent containers → MinIO via Docker network (e.g. "http://minio:9000")
	S3URLPublic string // Public internet → MinIO via reverse proxy (e.g. "https://s3.dev.airlock.run")
	S3AccessKey string
	S3SecretKey string
	S3Bucket    string
	S3Region    string

	// --- Database (agent schemas) ---
	// Airlock creates per-agent Postgres schemas. Connections are built from parts
	// because Airlock process and agent containers reach Postgres via different hosts.
	DBHost      string // Airlock process → Postgres (e.g. "localhost")
	DBHostAgent string // Agent containers → Postgres via Docker network (e.g. "postgres")
	DBPort      string
	DBName      string
	DBSSLMode   string // "disable" for dev, "require" for prod

	// --- Networking ---
	PublicURL     string // Public base URL (OAuth callbacks, auth links, e.g. "https://dev.airlock.run")
	APIURLAgent   string // Agent containers → Airlock API (e.g. "http://host.docker.internal:8080")
	AgentDomain   string // Subdomain routing (e.g. "dev.airlock.run" → {slug}.dev.airlock.run)
	DockerNetwork string // Docker network for agent containers (e.g. "airlock-dev")

	// --- Encryption ---
	// AES-256-GCM for provider API keys, webhook secrets, tokens at rest.
	// Generate with: openssl rand -hex 32
	EncryptionKey    string // hex-encoded 32-byte key (required)
	EncryptionKeyOld string // hex-encoded 32-byte key (optional, for rotation)

	// --- Containers ---
	ContainerRuntime string // "docker"
	ContainerImage   string // toolserver image name

	// --- Build pipeline ---
	AgentMonorepoPath string // local path to agent monorepo
	AgentBuilderImage string // toolserver sandbox image (default: agent-builder:v${agentsdk.Version})
	AgentBaseImage    string // agent runtime base image
	AgentRegistryURL  string // Docker registry for agent images (empty = local only)
	AgentLibsPath     string // path containing agentsdk/ goai/ sol/ dirs (the libs we own). If unset, airlock extracts /libs/ from AgentBuilderImage at startup into AgentLibsCacheDir.
	AgentLibsExtPath  string // path containing goose/ templ/ dirs (third-party libs always sourced from the agent-builder image's baked /libs/). Set at startup by EnsureLibs; not read from env.
	AgentLibsCacheDir string // base dir where extracted /libs/ from agent-builder image is cached. Subdir per image digest.

	// --- Reverse proxy ---
	ReverseProxyTrustedProxies string // comma-separated CIDRs, "*" = trust all (default: trust none)
	ReverseProxyLimit          int    // how many proxy hops to trust in X-Forwarded-For (default: 1)

	// --- Optional ---
	WorkDir                string // temp directory for agent tool execution
	LLMProxyURL            string // route LLM calls through this proxy (e.g. telescope -watch)
	ActivationCodeFile     string // path to write the first-run activation code to (so `docker compose` users can `cat` it)
	ForceInlineAttachments bool   // dev escape hatch: force base64 delivery to LLMs even when the provider supports URLs (public URL unreachable from provider)

	// --- OIDC (optional) ---
	OIDCIssuerURL    string
	OIDCClientID     string
	OIDCClientSecret string
	OIDCRedirectURL  string
}