v1alpha1

type Config struct {
	metav1.TypeMeta `json:",inline"`
	// The name of this instance, if not specified the hostname of the machine
	// will be used.
	Name string `json:"name,omitempty"`
	// Whether to enable verbose logging.
	Verbose bool `json:"verbose,omitempty"`
	// The URL for the dashboard UI.
	DashboardURL string `json:"dashboardURL,omitempty"`
	// CurrentProject is the default project ID to use unless overridden.
	CurrentProject uuid.UUID `json:"currentProject,omitempty"`
	// Projects is a list of projects that this instance is managing.
	Projects []Project `json:"projects,omitempty"`
	// Runtime configures components started by `apoxy run`.
	Runtime *RuntimeConfig `json:"runtime,omitempty"`
	// IsLocalMode is the configuration for the local mode.
	IsLocalMode bool `json:"isLocalMode,omitempty"`
	// UpgradeCheck holds state for the automatic upgrade-check prompt.
	UpgradeCheck *UpgradeCheckState `json:"upgradeCheck,omitempty"`
}

type KubeAggregationConfig struct {
	// ClusterName is an identifier for this cluster used for multi-cluster deconfliction.
	ClusterName string `json:"clusterName,omitempty"`
	// Namespace to operate in. Defaults to "apoxy".
	Namespace string `json:"namespace,omitempty"`
	// BootstrapToken for Apoxy Cloud connectivity.
	BootstrapToken string `json:"bootstrapToken,omitempty"`
	// ServiceName for the K8s Service. Defaults to "kube-aggregation".
	ServiceName string `json:"serviceName,omitempty"`
	// APIHost is the Apoxy Cloud API host for certificate issuance and upstream
	// connectivity. Defaults to "api.apoxy.dev".
	APIHost string `json:"apiHost,omitempty"`
	// CertRenewInterval is how often the auto-renewer wakes up to check
	// the live cert's remaining validity. A negative value disables
	// auto-renewal entirely. Zero falls back to the runtime default
	// (1h).
	// +optional
	CertRenewInterval *metav1.Duration `json:"certRenewInterval,omitempty"`
	// CertRenewThreshold is the remaining-validity window below which
	// the controller issues a fresh cert against cosmos. Zero falls
	// back to the runtime default (30 days).
	// +optional
	CertRenewThreshold *metav1.Duration `json:"certRenewThreshold,omitempty"`
}

type KubeMirrorConfig struct {
	// ClusterName is an identifier for this cluster used for multi-cluster deconfliction.
	ClusterName string `json:"clusterName,omitempty"`
	// Mirror specifies which K8s API resources to mirror. Defaults to "all".
	Mirror MirrorMode `json:"mirror,omitempty"`
	// Namespace to operate in. Defaults to "apoxy".
	Namespace string `json:"namespace,omitempty"`
	// BootstrapToken for Apoxy Cloud connectivity.
	BootstrapToken string `json:"bootstrapToken,omitempty"`
	// ServiceName for the K8s Service. Defaults to "kube-mirror".
	ServiceName string `json:"serviceName,omitempty"`
}

type KubernetesConfig struct {
	// The name of the kubeconfig context to use.
	// +optional
	Context string `json:"context,omitempty"`
	// The path to a kubeconfig file. If not specified, the standard kubeconfig
	// file paths will be used.
	// +optional
	KubeconfigPath string `json:"kubeconfigPath,omitempty"`
	// InCluster specifies whether the project is running in a Kubernetes cluster.
	// Context and KubeconfigPath are ignored if InCluster is true.
	// +optional
	InCluster bool `json:"inCluster,omitempty"`
}

type MirrorMode string

type Project struct {
	// ID is the project ID.
	ID uuid.UUID `json:"id"`
	// The base URL for API requests.
	APIBaseURL string `json:"apiBaseURL,omitempty"`
	// The host header to set for API requests.
	APIBaseHost string `json:"apiBaseHost,omitempty"`
	// APIKey is the API key for the project.
	APIKey string `json:"apiKey"`
	// Name is the human-readable project name, cached from the control
	// plane so commands can announce a target humans recognize instead of
	// the project UUID.
	// +optional
	Name string `json:"name,omitempty"`
	// Registry is the platform bundle registry host for this project
	// (e.g. "registry.apoxy.dev"). When empty it is derived from APIBaseHost
	// for the well-known hosted environments; a project with neither has no
	// platform registry and bundle pushes require an explicit repo.
	// +optional
	Registry string `json:"registry,omitempty"`
	// Kubernetes configuration for the project.
	// If set, overrides APIBaseURL, APIBaseHost, and APIKey.
	// +optional
	KubernetesConfig *KubernetesConfig `json:"kubernetesConfig,omitempty"`
}

type RuntimeComponent struct {
	// Type identifies the component.
	Type RuntimeComponentType `json:"type"`
	// KubeAggregation configures the kube-aggregation component.
	// +optional
	KubeAggregation *KubeAggregationConfig `json:"kubeAggregation,omitempty"`
	// KubeMirror configures the kube-mirror component.
	// +optional
	KubeMirror *KubeMirrorConfig `json:"kubeMirror,omitempty"`
	// Tunnel configures the tunnel component.
	// +optional
	Tunnel *TunnelConfig `json:"tunnel,omitempty"`
}

type RuntimeComponentType string

type RuntimeConfig struct {
	// Components is the list of runtime components to start.
	Components []RuntimeComponent `json:"components,omitempty"`
}

type STUNScheme string

type STUNServer struct {
	Scheme   STUNScheme `json:"scheme,omitempty"`
	Host     string     `json:"host,omitempty"`
	Port     int        `json:"port,omitempty"`
	Proto    StunProto  `json:"proto,omitempty"`
	Username string     `json:"username,omitempty"`
	Password string     `json:"password,omitempty"`
}

type StunProto string

type TunnelConfig struct {
	// Name is the name of the TunnelNode to connect to.
	// Required when running as a runtime component.
	Name string `json:"name,omitempty"`
	// Mode is the mode of the tunnel.
	Mode TunnelMode `json:"mode,omitempty"`
	// SocksPort, when running in user mode, is the port to listen on for
	// SOCKS5 proxy connections. If not specified it will default to 1080.
	SocksPort *int `json:"socksPort,omitempty"`
	// STUNServers is an optional list of STUN servers to use for determining the
	// external address of the tunnel node. If not specified it will default to
	// Google and Cloudflare's public STUN servers.
	STUNServers []STUNServer `json:"stunServers,omitempty"`
	// PacketCapturePath is an optional path to write packet captures to.
	// If not specified, packet sniffing will be disabled.
	// This is only available in user mode and intended for debugging purposes.
	PacketCapturePath string `json:"packetCapturePath,omitempty"`
	// MinConns is the minimum number of concurrent tunnel connections to maintain.
	// Defaults to 1.
	// +optional
	MinConns *int `json:"minConns,omitempty"`
	// HealthAddr is the address to listen on for health checks.
	// Defaults to ":8080". Set to empty string to disable.
	// +optional
	HealthAddr string `json:"healthAddr,omitempty"`
	// MetricsAddr is the address to listen on for metrics.
	// Defaults to ":8081". Set to empty string to disable.
	// +optional
	MetricsAddr string `json:"metricsAddr,omitempty"`
	// AutoCreate will auto-create the TunnelNode if it doesn't exist.
	// +optional
	AutoCreate bool `json:"autoCreate,omitempty"`
	// EndpointSelection is the strategy for selecting tunnel server endpoints.
	// Valid values are "latency" and "random". Defaults to "latency".
	// +optional
	EndpointSelection string `json:"endpointSelection,omitempty"`
	// InsecureSkipVerify skips TLS verification when connecting to tunnel servers.
	// Only use for development/testing.
	// +optional
	InsecureSkipVerify bool `json:"insecureSkipVerify,omitempty"`
	// DNSAddr is the address to listen on for the internal DNS proxy.
	// Defaults to "127.0.0.1:8053". Set to empty string to disable.
	// +optional
	DNSAddr string `json:"dnsAddr,omitempty"`
	// Labels are metadata key-value pairs attached to agent connections.
	// Convention: set "apoxy.dev/cluster" to identify cluster membership.
	// +optional
	Labels map[string]string `json:"labels,omitempty"`
}

type TunnelMode string

type UpgradeCheckState struct {
	// LastChecked is when the CLI last queried GitHub for the latest release.
	LastChecked *metav1.Time `json:"lastChecked,omitempty"`
	// LatestVersion is the newest release seen on the last check.
	LatestVersion string `json:"latestVersion,omitempty"`
	// DismissedVersion is the release the user chose "don't ask again" for.
	// The prompt is suppressed until a strictly newer version is released.
	DismissedVersion string `json:"dismissedVersion,omitempty"`
}