config

type Config struct {
	// --- Core ---
	DatabaseURL string // Airlock's own Postgres connection
	JWTSecret   string
	ServerAddr  string

	// --- S3 / Object Storage ---
	// Three audiences: Airlock process, agent containers, public internet.
	S3URL       string // Airlock process → MinIO (e.g. "http://localhost:9090")
	S3URLAgent  string // Agent containers → MinIO via Docker network (e.g. "http://minio:9000")
	S3URLPublic string // Public internet → MinIO via reverse proxy (e.g. "https://s3.dev.airlock.run")
	S3AccessKey string
	S3SecretKey string
	S3Bucket    string
	S3Region    string

	// --- Database (agent schemas) ---
	// Airlock creates per-agent Postgres schemas. Connections are built from parts
	// because Airlock process and agent containers reach Postgres via different hosts.
	DBHost      string // Airlock process → Postgres (e.g. "localhost")
	DBHostAgent string // Agent containers → Postgres via Docker network (e.g. "postgres")
	DBPort      string
	DBName      string
	DBSSLMode   string // "disable" for dev, "require" for prod

	// --- Networking ---
	PublicURL     string // Public base URL (OAuth callbacks, auth links, e.g. "https://dev.airlock.run")
	APIURLAgent   string // Agent containers → Airlock API (e.g. "http://host.docker.internal:8080")
	AgentDomain   string // Subdomain routing (e.g. "dev.airlock.run" → {slug}.dev.airlock.run)
	DockerNetwork string // Docker network for agent containers (e.g. "airlock-dev")

	// --- Encryption ---
	// AES-256-GCM for provider API keys, webhook secrets, tokens at rest.
	// Generate with: openssl rand -hex 32
	EncryptionKey    string // hex-encoded 32-byte key (required)
	EncryptionKeyOld string // hex-encoded 32-byte key (optional, for rotation)

	// --- Containers ---
	ContainerRuntime string // "docker"
	ContainerImage   string // toolserver image name

	// --- Build pipeline ---
	AgentMonorepoPath string // local path to agent monorepo
	AgentBuilderImage string // toolserver sandbox image (default: agent-builder:v${agentsdk.Version})
	AgentBaseImage    string // agent runtime base image
	AgentRegistryURL  string // Docker registry for agent images (empty = local only)
	AgentLibsPath     string // path containing agentsdk/ goai/ sol/ dirs (the libs we own). Set after startup either to the user-supplied AGENT_LIBS_PATH (dev) or the extracted cache dir (prod). Always non-empty by the time the build pipeline runs.
	AgentLibsExtPath  string // path containing goose/ templ/ dirs (third-party libs always sourced from the agent-builder image's baked /libs/). Set at startup by EnsureLibs; not read from env.
	AgentLibsCacheDir string // base dir where extracted /libs/ from agent-builder image is cached. Subdir per image digest.

	// AgentLibsPathExplicit is true iff the operator set AGENT_LIBS_PATH as
	// an env var (i.e. dev mode, where AgentLibsPath points at a live source
	// tree we want overlaid into toolservers). False in prod (where
	// AgentLibsPath holds the extracted cache dir, used only for the
	// per-agent docker build's --build-context — overlaying the extracted
	// cache onto the toolserver's image-baked /libs/ would just mask the
	// authoritative content with itself, and risks shadowing files if the
	// extraction is mid-way or partial).
	AgentLibsPathExplicit bool

	// AgentCodegenPath is where the build pipeline creates per-build temp
	// directories for sparse checkouts and cache-warming scaffolds.
	// AgentCodegenVolume is the Docker volume name that contains
	// AgentCodegenPath and is also mounted into spawned sibling
	// containers — required for docker-in-docker (airlock-in-container)
	// deployments where bind-mounts of host paths don't work because
	// airlock's filesystem is the container overlay, not the host.
	//
	// Both unset: dev-on-host behavior (MkdirTemp under /tmp, bind mount
	// the resulting host path into siblings — daemon and airlock share
	// the FS, so it just works).
	//
	// Both set: docker-compose mode. MkdirTemp goes inside the named
	// volume, sibling containers mount the same volume by name. The
	// daemon resolves both ends through the same managed volume so
	// the absolute path airlock writes is the same path the sibling
	// reads.
	AgentCodegenPath   string
	AgentCodegenVolume string

	// --- Reverse proxy ---
	ReverseProxyTrustedProxies string // comma-separated CIDRs, "*" = trust all (default: trust none)
	ReverseProxyLimit          int    // how many proxy hops to trust in X-Forwarded-For (default: 1)

	// --- Optional ---
	WorkDir                string // temp directory for agent tool execution
	LLMProxyURL            string // route LLM calls through this proxy (e.g. telescope -watch)
	ActivationCodeFile     string // path to write the first-run activation code to (so `docker compose` users can `cat` it)
	ForceInlineAttachments bool   // dev escape hatch: force base64 delivery to LLMs even when the provider supports URLs (public URL unreachable from provider)

	// --- OIDC (optional) ---
	OIDCIssuerURL    string
	OIDCClientID     string
	OIDCClientSecret string
	OIDCRedirectURL  string
}