config

type AdminConfig struct {
	Username string `yaml:"username"`
	Password string `yaml:"password"`
	Token    string `yaml:"token"`
	APIToken string `yaml:"api_token"`
	Email    string `yaml:"email"`
	Enabled  bool   `yaml:"enabled"`
}

type Announcement struct {
	ID          string `yaml:"id"`
	Type        string `yaml:"type"` // warning, info, error, success
	Title       string `yaml:"title"`
	Message     string `yaml:"message"`
	Start       string `yaml:"start"`       // ISO 8601 datetime
	End         string `yaml:"end"`         // ISO 8601 datetime
	Dismissible bool   `yaml:"dismissible"` // User can dismiss
}

type AnnouncementsConfig struct {
	Enabled  bool           `yaml:"enabled"`
	Messages []Announcement `yaml:"messages"`
}

type AuthConfig struct {
	OIDC []OIDCProviderConfig `yaml:"oidc"`
	LDAP []LDAPConfig         `yaml:"ldap"`
}

type BackupConfig struct {
	// Encryption configuration
	Encryption BackupEncryptionConfig `yaml:"encryption"`
	// Retention policy
	Retention BackupRetentionConfig `yaml:"retention"`
}

type BackupEncryptionConfig struct {
	Enabled bool   `yaml:"enabled"` // true if password was set during setup
	Hint    string `yaml:"hint"`    // Optional password hint (stored, NOT the password)
}

type BackupRetentionConfig struct {
	MaxBackups  int `yaml:"max_backups"`  // Daily full backups to keep (default: 1)
	KeepWeekly  int `yaml:"keep_weekly"`  // Weekly backups (Sunday) to keep (0 = disabled)
	KeepMonthly int `yaml:"keep_monthly"` // Monthly backups (1st) to keep (0 = disabled)
	KeepYearly  int `yaml:"keep_yearly"`  // Yearly backups (Jan 1st) to keep (0 = disabled)
}

type BangConfig struct {
	Shortcut    string   `yaml:"shortcut"`
	Name        string   `yaml:"name"`
	URL         string   `yaml:"url"`
	Category    string   `yaml:"category"`
	Description string   `yaml:"description,omitempty"`
	Aliases     []string `yaml:"aliases,omitempty"`
}

type BangsConfig struct {
	Enabled       bool         `yaml:"enabled"`
	ProxyRequests bool         `yaml:"proxy_requests"`
	Custom        []BangConfig `yaml:"custom"`
}

type BrandingConfig struct {
	Title        string `yaml:"title"`       // Per PART 13: project.name source
	Tagline      string `yaml:"tagline"`     // Per PART 13: project.tagline source
	Description  string `yaml:"description"` // Per PART 13: project.description source
	LogoURL      string `yaml:"logo_url"`
	FaviconURL   string `yaml:"favicon_url"`
	FooterText   string `yaml:"footer_text"`
	Theme        string `yaml:"theme"`
	PrimaryColor string `yaml:"primary_color"`
}

type CacheConfig struct {
	// Type: none (disabled), memory (default), valkey, redis
	// IMPORTANT: Use valkey/redis for cluster or mixed mode deployments
	Type string `yaml:"type"`

	// Connection: Use EITHER url OR host/port/password (not both)
	// url takes precedence if both are specified
	// Format: redis://user:password@host:port/db or valkey://...
	URL string `yaml:"url"`

	// Individual connection settings (alternative to url)
	Host     string `yaml:"host"`
	Port     int    `yaml:"port"`
	Password string `yaml:"password"`
	DB       int    `yaml:"db"`

	// Connection pool settings
	PoolSize int    `yaml:"pool_size"`
	MinIdle  int    `yaml:"min_idle"`
	Timeout  string `yaml:"timeout"` // Connection timeout (e.g., "5s")

	// Key prefix to avoid collisions (use unique prefix per app)
	Prefix string `yaml:"prefix"`

	// Default TTL in seconds
	TTL int `yaml:"ttl"`

	// Cluster settings (when using Valkey/Redis Cluster)
	Cluster      bool     `yaml:"cluster"`
	ClusterNodes []string `yaml:"cluster_nodes"` // e.g., ["node1:6379", "node2:6379"]
}

type ComplianceConfig struct {
	Enabled bool `yaml:"enabled"` // HIPAA, SOC2, etc. compliance mode
}

type CompressionConfig struct {
	Enabled      bool     `yaml:"enabled"`
	Level        int      `yaml:"level"`         // 1-9, higher = more compression, more CPU
	MinSize      int      `yaml:"min_size"`      // Minimum response size to compress (bytes)
	MimeTypes    []string `yaml:"mime_types"`    // MIME types to compress
	Gzip         bool     `yaml:"gzip"`          // Enable gzip compression
	Brotli       bool     `yaml:"brotli"`        // Enable Brotli compression
	DisableProxy bool     `yaml:"disable_proxy"` // Disable compression for proxied requests
}

type Config struct {
	Server  ServerConfig            `yaml:"server"`
	Search  SearchConfig            `yaml:"search"`
	Engines map[string]EngineConfig `yaml:"engines"`
	// contains filtered or unexported fields
}

type ConfigSync struct {
	// contains filtered or unexported fields
}

type ContactConfig struct {
	Enabled bool   `yaml:"enabled"`
	Email   string `yaml:"email"`
}

type CookieConsentConfig struct {
	Enabled    bool   `yaml:"enabled"`
	Message    string `yaml:"message"`
	PolicyURL  string `yaml:"policy_url"`
	TrackingID string `yaml:"tracking_id"` // Google Analytics ID
}

type CryptoWidgetConfig struct {
	Enabled      bool     `yaml:"enabled"`
	DefaultCoins []string `yaml:"default_coins"`
	Currency     string   `yaml:"currency"` // "usd", "eur", etc.
}

type DNS01Config struct {
	Provider             string `yaml:"provider"`              // Provider identifier (cloudflare, route53, etc.)
	CredentialsEncrypted string `yaml:"credentials_encrypted"` // AES-256-GCM encrypted JSON
	ValidatedAt          string `yaml:"validated_at"`          // Timestamp of last successful validation
}

type EmailConfig struct {
	// Enabled is auto-set based on SMTP availability (no manual toggle)
	Enabled bool            `yaml:"-"` // Computed, not stored
	SMTP    SMTPConfig      `yaml:"smtp"`
	From    EmailFromConfig `yaml:"from"`
}

type EmailFromConfig struct {
	// Default: app title
	Name string `yaml:"name"`
	// Default: no-reply@{fqdn}
	Email string `yaml:"email"`
}

type EngineConfig struct {
	Enabled    bool     `yaml:"enabled"`
	Priority   int      `yaml:"priority"`
	Categories []string `yaml:"categories"`
	Timeout    int      `yaml:"timeout"`
	Weight     float64  `yaml:"weight"`
	APIKey     string   `yaml:"api_key,omitempty"`
}

type EnvConfig struct {
	// Core configuration
	SettingsPath string
	Debug        bool
	Secret       string
	BindAddress  string
	InstanceName string
	Autocomplete string
	BaseURL      string

	// Per AI.md PART 5: DOMAIN env var for FQDN override
	Domain string

	// Per AI.md PART 5: DATABASE_DRIVER env var
	DatabaseDriver string
	DatabaseURL    string

	// Image proxy
	ImageProxyURL string
	ImageProxyKey string

	// Search-specific
	Port      string
	Mode      string
	DataDir   string
	ConfigDir string
	LogDir    string

	// SMTP - Per AI.md PART 18: SMTP_* env vars override config file
	SMTPHost      string
	SMTPPort      int
	SMTPUsername  string
	SMTPPassword  string
	SMTPTLS       string
	SMTPFromName  string
	SMTPFromEmail string

	// Engines
	EnableGoogle     bool
	EnableDuckDuckGo bool
	EnableBing       bool
}

type GeoIPConfig struct {
	Enabled          bool     `yaml:"enabled"`
	Dir              string   `yaml:"dir"`               // Directory for MMDB files
	Update           string   `yaml:"update"`            // never, daily, weekly, monthly
	DenyCountries    []string `yaml:"deny_countries"`    // Countries to block (ISO 3166-1 alpha-2)
	AllowedCountries []string `yaml:"allowed_countries"` // If set, only these countries allowed
	// Database toggles per AI.md PART 20
	ASN     bool `yaml:"asn"`     // Enable ASN lookups
	Country bool `yaml:"country"` // Enable country lookups
	City    bool `yaml:"city"`    // Enable city lookups (larger download)
	WHOIS   bool `yaml:"whois"`   // Enable WHOIS lookups
}

type I18nConfig struct {
	Enabled            bool     `yaml:"enabled"`
	DefaultLanguage    string   `yaml:"default_language"`    // BCP 47 language tag (e.g., en, en-US, de)
	SupportedLanguages []string `yaml:"supported_languages"` // List of supported languages
	AutoDetect         bool     `yaml:"auto_detect"`         // Detect from Accept-Language header
	ShowSelector       bool     `yaml:"show_selector"`       // Show language selector in UI
	RTLLanguages       []string `yaml:"rtl_languages"`       // Right-to-left languages (ar, he, etc.)
	TranslationsDir    string   `yaml:"translations_dir"`    // Directory for translation files
	FallbackLanguage   string   `yaml:"fallback_language"`   // Fallback if requested language not available
}

type ImageProxyConfig struct {
	Enabled bool   `yaml:"enabled"`
	URL     string `yaml:"url"`
	Key     string `yaml:"key"`
}

type LDAPConfig struct {
	ID            string `yaml:"id"`
	Name          string `yaml:"name"`
	Enabled       bool   `yaml:"enabled"`
	Host          string `yaml:"host"`
	Port          int    `yaml:"port"`
	UseTLS        bool   `yaml:"use_tls"`
	SkipTLSVerify bool   `yaml:"skip_tls_verify"`
	BindDN        string `yaml:"bind_dn"`
	BindPassword  string `yaml:"bind_password"`
	BaseDN        string `yaml:"base_dn"`
	UserFilter    string `yaml:"user_filter"`
	UsernameAttr  string `yaml:"username_attr"`
	EmailAttr     string `yaml:"email_attr"`
	// Admin group mapping per AI.md PART 31
	AdminGroups     []string `yaml:"admin_groups"`
	GroupFilter     string   `yaml:"group_filter"`
	GroupMemberAttr string   `yaml:"group_member_attr"`
}

type LimitsConfig struct {
	MaxBodySize  string `yaml:"max_body_size"` // Maximum request body size (e.g., "10MB")
	ReadTimeout  string `yaml:"read_timeout"`  // HTTP read timeout (e.g., "30s")
	WriteTimeout string `yaml:"write_timeout"` // HTTP write timeout (e.g., "30s")
	IdleTimeout  string `yaml:"idle_timeout"`  // HTTP idle connection timeout (e.g., "120s")
}

type LogsConfig struct {
	Level  string `yaml:"level"`
	File   string `yaml:"file"`
	Format string `yaml:"format"`
	Access struct {
		Filename string `yaml:"filename"`
		Format   string `yaml:"format"`
		Custom   string `yaml:"custom"`
		Rotate   string `yaml:"rotate"`
		Keep     string `yaml:"keep"`
	} `yaml:"access"`
	Server struct {
		Filename string `yaml:"filename"`
		Format   string `yaml:"format"`
		Custom   string `yaml:"custom"`
		Rotate   string `yaml:"rotate"`
		Keep     string `yaml:"keep"`
	} `yaml:"server"`
	Error struct {
		Filename string `yaml:"filename"`
		Format   string `yaml:"format"`
		Custom   string `yaml:"custom"`
		Rotate   string `yaml:"rotate"`
		Keep     string `yaml:"keep"`
	} `yaml:"error"`
	Audit struct {
		Filename string `yaml:"filename"`
		Format   string `yaml:"format"`
		Custom   string `yaml:"custom"`
		Rotate   string `yaml:"rotate"`
		Keep     string `yaml:"keep"`
	} `yaml:"audit"`
	Security struct {
		Filename string `yaml:"filename"`
		Format   string `yaml:"format"`
		Custom   string `yaml:"custom"`
		Rotate   string `yaml:"rotate"`
		Keep     string `yaml:"keep"`
	} `yaml:"security"`
	Debug struct {
		Enabled  bool   `yaml:"enabled"`
		Filename string `yaml:"filename"`
		Format   string `yaml:"format"`
		Custom   string `yaml:"custom"`
		Rotate   string `yaml:"rotate"`
		Keep     string `yaml:"keep"`
	} `yaml:"debug"`
}

type MetricsConfig struct {
	Enabled         bool      `yaml:"enabled"`
	Endpoint        string    `yaml:"endpoint"`         // Endpoint path (default: /metrics)
	IncludeSystem   bool      `yaml:"include_system"`   // Include system metrics (CPU, memory, disk)
	IncludeRuntime  bool      `yaml:"include_runtime"`  // Include Go runtime metrics
	Token           string    `yaml:"token"`            // Bearer token for authentication (empty = no auth)
	DurationBuckets []float64 `yaml:"duration_buckets"` // Histogram buckets for request duration (seconds)
	SizeBuckets     []float64 `yaml:"size_buckets"`     // Histogram buckets for request size (bytes)
}

type NewsWidgetConfig struct {
	Enabled  bool     `yaml:"enabled"`
	Sources  []string `yaml:"sources"` // RSS feed URLs
	MaxItems int      `yaml:"max_items"`
}

type OIDCProviderConfig struct {
	ID           string   `yaml:"id"`
	Name         string   `yaml:"name"`
	Enabled      bool     `yaml:"enabled"`
	Issuer       string   `yaml:"issuer"`
	ClientID     string   `yaml:"client_id"`
	ClientSecret string   `yaml:"client_secret"`
	RedirectURL  string   `yaml:"redirect_url"`
	Scopes       []string `yaml:"scopes"`
	// Admin group mapping per AI.md PART 31
	AdminGroups []string `yaml:"admin_groups"`
	GroupsClaim string   `yaml:"groups_claim"`
	AutoCreate  bool     `yaml:"auto_create"`
}

type OpenGraphConfig struct {
	Enabled     bool   `yaml:"enabled"`
	Type        string `yaml:"type"`
	SiteName    string `yaml:"site_name"`
	Image       string `yaml:"image"`
	Description string `yaml:"description"`
}

type OpenSearchConfig struct {
	Enabled     bool   `yaml:"enabled"`
	ShortName   string `yaml:"short_name"`
	Description string `yaml:"description"`
	Contact     string `yaml:"contact"`
	Tags        string `yaml:"tags"`
	LongName    string `yaml:"long_name"`
	Image       string `yaml:"image"`
}

type PagesConfig struct {
	About struct {
		Enabled bool   `yaml:"enabled"`
		Content string `yaml:"content"`
	} `yaml:"about"`
	Privacy struct {
		Enabled bool   `yaml:"enabled"`
		Content string `yaml:"content"`
	} `yaml:"privacy"`
	Contact struct {
		Enabled bool   `yaml:"enabled"`
		Email   string `yaml:"email"`
	} `yaml:"contact"`
	Help struct {
		Enabled bool   `yaml:"enabled"`
		Content string `yaml:"content"`
	} `yaml:"help"`
	Terms struct {
		Enabled bool   `yaml:"enabled"`
		Content string `yaml:"content"`
	} `yaml:"terms"`
}

type RSSWidgetConfig struct {
	Enabled  bool `yaml:"enabled"`
	MaxFeeds int  `yaml:"max_feeds"`
	MaxItems int  `yaml:"max_items"`
}

type RateLimitConfig struct {
	Enabled           bool     `yaml:"enabled"`
	RequestsPerMinute int      `yaml:"requests_per_minute"`
	RequestsPerHour   int      `yaml:"requests_per_hour"`
	RequestsPerDay    int      `yaml:"requests_per_day"`
	BurstSize         int      `yaml:"burst_size"`
	ByIP              bool     `yaml:"by_ip"`
	ByUser            bool     `yaml:"by_user"`
	Whitelist         []string `yaml:"whitelist"`
	Blacklist         []string `yaml:"blacklist"`
}

type SEOConfig struct {
	Enabled            bool              `yaml:"enabled"`
	DefaultTitle       string            `yaml:"default_title"`
	TitleSeparator     string            `yaml:"title_separator"`
	DefaultDescription string            `yaml:"default_description"`
	Keywords           []string          `yaml:"keywords"`
	MetaTags           map[string]string `yaml:"meta_tags"`
	OpenGraph          OpenGraphConfig   `yaml:"opengraph"`
	Twitter            TwitterConfig     `yaml:"twitter"`
	Canonical          bool              `yaml:"canonical"` // Include canonical URLs
	NoIndex            bool              `yaml:"noindex"`   // Set noindex on search results
	Sitemap            bool              `yaml:"sitemap"`   // Generate sitemap.xml
}

type SMTPConfig struct {
	// If empty: autodetect local SMTP on startup
	// If set: test connection on startup
	Host     string `yaml:"host"`
	Port     int    `yaml:"port"`
	Username string `yaml:"username"`
	Password string `yaml:"password"`
	// TLS mode: auto, starttls, tls, none
	TLS string `yaml:"tls"`
}

type SSLConfig struct {
	Enabled     bool   `yaml:"enabled"`
	AutoTLS     bool   `yaml:"auto_tls"`
	CertFile    string `yaml:"cert_file"`
	KeyFile     string `yaml:"key_file"`
	LetsEncrypt struct {
		Enabled   bool     `yaml:"enabled"`
		Email     string   `yaml:"email"`
		Domains   []string `yaml:"domains"`
		Staging   bool     `yaml:"staging"`
		Challenge string   `yaml:"challenge"` // http-01, tls-alpn-01, dns-01
	} `yaml:"letsencrypt"`
	// DNS-01 provider configuration per AI.md PART 17
	DNS01 DNS01Config `yaml:"dns01"`
}

type SchedulerConfig struct {
	// Timezone for scheduled tasks (default: America/New_York)
	Timezone string `yaml:"timezone"`
	// CatchUpWindow: run missed tasks if within this duration (default: 1h)
	CatchUpWindow string `yaml:"catch_up_window"`
	// Task-specific configuration (only skippable tasks can be disabled)
	Tasks SchedulerTasksConfig `yaml:"tasks"`
}

type SchedulerTasksConfig struct {
	// Daily backup at 02:00 (skippable)
	BackupDaily TaskConfig `yaml:"backup_daily"`
	// Hourly incremental backup (skippable, disabled by default)
	BackupHourly TaskConfig `yaml:"backup_hourly"`
	// GeoIP database update (skippable)
	GeoIPUpdate TaskConfig `yaml:"geoip_update"`
	// Blocklist update (skippable)
	BlocklistUpdate TaskConfig `yaml:"blocklist_update"`
	// CVE database update (skippable)
	CVEUpdate TaskConfig `yaml:"cve_update"`
}

type SearchConfig struct {
	SafeSearch        int              `yaml:"safe_search"`
	Autocomplete      string           `yaml:"autocomplete"`
	DefaultLang       string           `yaml:"default_lang"`
	DefaultCategories []string         `yaml:"default_categories"`
	ResultsPerPage    int              `yaml:"results_per_page"`
	Timeout           int              `yaml:"timeout"`
	MaxConcurrent     int              `yaml:"max_concurrent"`
	Bangs             BangsConfig      `yaml:"bangs"`
	OpenSearch        OpenSearchConfig `yaml:"opensearch"`
	Widgets           WidgetsConfig    `yaml:"widgets"`
}

type SecurityConfig struct {
	// CORS
	CORS struct {
		Enabled          bool     `yaml:"enabled"`
		AllowedOrigins   []string `yaml:"allowed_origins"`
		AllowedMethods   []string `yaml:"allowed_methods"`
		AllowedHeaders   []string `yaml:"allowed_headers"`
		AllowCredentials bool     `yaml:"allow_credentials"`
		MaxAge           int      `yaml:"max_age"`
	} `yaml:"cors"`
	// CSRF
	CSRF struct {
		Enabled    bool   `yaml:"enabled"`
		CookieName string `yaml:"cookie_name"`
		HeaderName string `yaml:"header_name"`
		FieldName  string `yaml:"field_name"`
	} `yaml:"csrf"`
	// Headers
	Headers struct {
		XFrameOptions         string `yaml:"x_frame_options"`
		XContentTypeOptions   string `yaml:"x_content_type_options"`
		XXSSProtection        string `yaml:"x_xss_protection"`
		ReferrerPolicy        string `yaml:"referrer_policy"`
		ContentSecurityPolicy string `yaml:"content_security_policy"`
		PermissionsPolicy     string `yaml:"permissions_policy"`
	} `yaml:"headers"`
	// Trusted Proxies
	TrustedProxies []string `yaml:"trusted_proxies"`
}

type ServerConfig struct {
	// Core settings
	Title       string `yaml:"title"`
	Description string `yaml:"description"`
	Port        int    `yaml:"port"`       // HTTP port (or single port if HTTPSPort not set)
	HTTPSPort   int    `yaml:"https_port"` // HTTPS port for dual port mode (optional)
	Address     string `yaml:"address"`
	Mode        string `yaml:"mode"`
	SecretKey   string `yaml:"secret_key"`
	BaseURL     string `yaml:"base_url"`

	// SSL/TLS
	SSL SSLConfig `yaml:"ssl"`

	// Admin
	Admin AdminConfig `yaml:"admin"`

	// Branding
	Branding BrandingConfig `yaml:"branding"`

	// Rate Limiting
	RateLimit RateLimitConfig `yaml:"rate_limit"`

	// Session
	Session SessionConfig `yaml:"session"`

	// Logs
	Logs LogsConfig `yaml:"logs"`

	// Tor
	Tor TorConfig `yaml:"tor"`

	// Email
	Email EmailConfig `yaml:"email"`

	// Security
	Security SecurityConfig `yaml:"security"`

	// External Auth (OIDC/LDAP) per AI.md PART 31
	Auth AuthConfig `yaml:"auth"`

	// Users
	Users UsersConfig `yaml:"users"`

	// Pages
	Pages PagesConfig `yaml:"pages"`

	// Web (robots.txt, security.txt)
	Web WebConfig `yaml:"web"`

	// Scheduler
	Scheduler SchedulerConfig `yaml:"scheduler"`

	// Cache - per AI.md PART 18
	Cache CacheConfig `yaml:"cache"`

	// GeoIP
	GeoIP GeoIPConfig `yaml:"geoip"`

	// Metrics
	Metrics MetricsConfig `yaml:"metrics"`

	// Image Proxy
	ImageProxy ImageProxyConfig `yaml:"image_proxy"`

	// Contact
	Contact ContactConfig `yaml:"contact"`

	// SEO
	SEO SEOConfig `yaml:"seo"`

	// Compression
	Compression CompressionConfig `yaml:"compression"`

	// Request Limits per AI.md PART 18
	Limits LimitsConfig `yaml:"limits"`

	// I18n (Internationalization)
	I18n I18nConfig `yaml:"i18n"`

	// Maintenance mode - when enabled, shows maintenance page to all users
	MaintenanceMode bool `yaml:"maintenance_mode"`

	// Backup configuration per AI.md PART 22
	Backup BackupConfig `yaml:"backup"`

	// Compliance configuration per AI.md PART 22
	Compliance ComplianceConfig `yaml:"compliance"`
}

type SessionConfig struct {
	// Admin sessions (server.db admin_sessions table)
	Admin SessionTypeConfig `yaml:"admin"`
	// User sessions (user.db user_sessions table)
	User SessionTypeConfig `yaml:"user"`
	// Common settings
	ExtendOnActivity bool   `yaml:"extend_on_activity"` // Reset idle timeout on each request
	Secure           string `yaml:"secure"`             // auto, true, false
	HTTPOnly         bool   `yaml:"http_only"`
	SameSite         string `yaml:"same_site"` // strict, lax, none

	// Legacy fields for backward compatibility
	Duration       string `yaml:"duration,omitempty"`
	CookieName     string `yaml:"cookie_name,omitempty"`
	CookieSecure   bool   `yaml:"cookie_secure,omitempty"`
	CookieHTTPOnly bool   `yaml:"cookie_http_only,omitempty"`
	CookieSameSite string `yaml:"cookie_same_site,omitempty"`
}

type SessionTypeConfig struct {
	CookieName  string `yaml:"cookie_name"`
	MaxAge      int    `yaml:"max_age"`      // Absolute session lifetime in seconds
	IdleTimeout int    `yaml:"idle_timeout"` // Expires after inactivity in seconds
}

type SportsWidgetConfig struct {
	Enabled        bool     `yaml:"enabled"`
	DefaultLeagues []string `yaml:"default_leagues"`
}

type StocksWidgetConfig struct {
	Enabled        bool     `yaml:"enabled"`
	DefaultSymbols []string `yaml:"default_symbols"`
}

type TaskConfig struct {
	Schedule string `yaml:"schedule"` // Cron expression or @every interval
	Enabled  bool   `yaml:"enabled"`
}

type TorConfig struct {
	// Runtime state - NOT configurable
	Enabled      bool   `yaml:"-"` // Computed at runtime when Tor binary is found
	OnionAddress string `yaml:"-"` // Set at runtime when Tor starts

	// Binary path (empty = auto-detect)
	Binary string `yaml:"binary"`

	// --- Outbound Network Settings ---
	// Use Tor network for outbound connections (server-wide default)
	UseNetwork bool `yaml:"use_network"`
	// Allow users to set their own Tor network preference
	AllowUserPreference bool `yaml:"allow_user_preference"`

	// --- Performance Settings ---
	// Maximum circuits to keep open (1-128, default 32)
	MaxCircuits int `yaml:"max_circuits"`
	// Circuit timeout in seconds (10-300, default 60)
	CircuitTimeout int `yaml:"circuit_timeout"`
	// Bootstrap timeout in seconds (30-600, default 180)
	BootstrapTimeout int `yaml:"bootstrap_timeout"`

	// --- Security Settings ---
	// Scrub sensitive info from Tor logs (default true)
	SafeLogging bool `yaml:"safe_logging"`
	// Maximum concurrent streams per circuit (10-500, default 100)
	MaxStreamsPerCircuit int `yaml:"max_streams_per_circuit"`
	// Close circuit when stream limit exceeded (default true)
	CloseCircuitOnStreamLimit bool `yaml:"close_circuit_on_stream_limit"`

	// --- Bandwidth Settings ---
	// Maximum bandwidth rate per second (e.g., "1 MB", "500 KB")
	BandwidthRate string `yaml:"bandwidth_rate"`
	// Maximum bandwidth burst per second (e.g., "2 MB", "1 MB")
	BandwidthBurst string `yaml:"bandwidth_burst"`
	// Maximum monthly bandwidth (e.g., "100 GB", "50 GB", "unlimited")
	MaxMonthlyBandwidth string `yaml:"max_monthly_bandwidth"`

	// --- Hidden Service Settings ---
	// Number of introduction points (3-10, default 3)
	NumIntroPoints int `yaml:"num_intro_points"`
	// Virtual port for hidden service (1-65535, default 80)
	HiddenServicePort int `yaml:"hidden_service_port"`
}

type TwitterConfig struct {
	Enabled bool   `yaml:"enabled"`
	Card    string `yaml:"card"` // summary, summary_large_image
	Site    string `yaml:"site"` // @username
	Creator string `yaml:"creator"`
}

type UsersConfig struct {
	Enabled      bool `yaml:"enabled"`
	Registration struct {
		Enabled                  bool     `yaml:"enabled"`
		RequireEmailVerification bool     `yaml:"require_email_verification"`
		RequireApproval          bool     `yaml:"require_approval"`
		AllowedDomains           []string `yaml:"allowed_domains"`
		BlockedDomains           []string `yaml:"blocked_domains"`
	} `yaml:"registration"`
	Roles struct {
		Available []string `yaml:"available"`
		Default   string   `yaml:"default"`
	} `yaml:"roles"`
	Tokens struct {
		Enabled        bool `yaml:"enabled"`
		MaxPerUser     int  `yaml:"max_per_user"`
		ExpirationDays int  `yaml:"expiration_days"`
	} `yaml:"tokens"`
	Profile struct {
		AllowAvatar      bool `yaml:"allow_avatar"`
		AllowDisplayName bool `yaml:"allow_display_name"`
		AllowBio         bool `yaml:"allow_bio"`
	} `yaml:"profile"`
	Auth struct {
		SessionDuration          string `yaml:"session_duration"`
		SessionDurationDays      int    `yaml:"session_duration_days"` // Parsed from SessionDuration
		Require2FA               bool   `yaml:"require_2fa"`
		Allow2FA                 bool   `yaml:"allow_2fa"`
		PasswordMinLength        int    `yaml:"password_min_length"`
		PasswordRequireUppercase bool   `yaml:"password_require_uppercase"`
		PasswordRequireNumber    bool   `yaml:"password_require_number"`
		PasswordRequireSpecial   bool   `yaml:"password_require_special"`
	} `yaml:"auth"`
	Limits struct {
		RequestsPerMinute int `yaml:"requests_per_minute"`
		RequestsPerDay    int `yaml:"requests_per_day"`
	} `yaml:"limits"`
	SSO struct {
		Enabled bool `yaml:"enabled"`
		OIDC    map[string]struct {
			Name         string `yaml:"name"`
			ClientID     string `yaml:"client_id"`
			ClientSecret string `yaml:"client_secret"`
			Issuer       string `yaml:"issuer"`
			IconURL      string `yaml:"icon_url"`
		} `yaml:"oidc"`
		LDAP struct {
			Enabled  bool   `yaml:"enabled"`
			Server   string `yaml:"server"`
			Port     int    `yaml:"port"`
			BaseDN   string `yaml:"base_dn"`
			BindDN   string `yaml:"bind_dn"`
			BindPass string `yaml:"bind_pass"`
		} `yaml:"ldap"`
	} `yaml:"sso"`
}

type ValidationWarning struct {
	Field   string
	Message string
	Default interface{}
}

type WeatherWidgetConfig struct {
	Enabled     bool   `yaml:"enabled"`
	DefaultCity string `yaml:"default_city"`
	Units       string `yaml:"units"` // "metric" or "imperial"
}

type WebConfig struct {
	Robots struct {
		Allow []string `yaml:"allow"`
		Deny  []string `yaml:"deny"`
	} `yaml:"robots"`
	Security struct {
		Contact string `yaml:"contact"` // Security contact email (mailto: prefix added automatically)
		Expires string `yaml:"expires"` // Expiration date (auto-calculated 1 year from now if not set)
	} `yaml:"security"`
	Announcements AnnouncementsConfig `yaml:"announcements"`
	CookieConsent CookieConsentConfig `yaml:"cookie_consent"`
	CORS          string              `yaml:"cors"` // "*", "origin1,origin2", or ""
}

type WidgetsConfig struct {
	Enabled        bool     `yaml:"enabled"`
	DefaultWidgets []string `yaml:"default_widgets"`
	CacheTTL       int      `yaml:"cache_ttl"` // seconds

	Weather WeatherWidgetConfig `yaml:"weather"`
	News    NewsWidgetConfig    `yaml:"news"`
	Stocks  StocksWidgetConfig  `yaml:"stocks"`
	Crypto  CryptoWidgetConfig  `yaml:"crypto"`
	Sports  SportsWidgetConfig  `yaml:"sports"`
	RSS     RSSWidgetConfig     `yaml:"rss"`
}