config

type Config struct {
	// Addr is the TCP address the HTTP API listens on, "host:port" with a
	// numeric port; an empty host means every interface.
	Addr string

	// LogLevel is the minimum level written to the log.
	LogLevel slog.Level

	// LogKey is the HMAC key that pseudonymises personal data in the log.
	LogKey Secret

	// DataDir is the only directory the commands write to: the data
	// volume. Every other path may be read-only.
	DataDir string

	// SourceACPR turns the ACPR blacklist on, once its reuse licence is
	// obtained.
	SourceACPR bool

	// AlertWebhook is the HTTPS URL a failed or rejected sync is posted
	// to; nil when unset or empty, and then alerts are only logged. It is a
	// Secret: a webhook URL usually carries its credential.
	AlertWebhook Secret

	// ProblemBaseURL is the HTTPS URL of the documentation of the API's
	// problems, ending with a slash: the type of a problem is its code
	// under it.
	ProblemBaseURL string

	// BatchMaxItems is the most items POST /v1/check/batch accepts, from 1
	// to MaxBatchMaxItems.
	BatchMaxItems int

	// DatabaseURL is the PostgreSQL connection string of the API key store;
	// nil when unset or empty. RequireKeyStore tells whether it is set.
	DatabaseURL Secret

	// DatabaseCA is the certificate authority of the database, in PEM,
	// which replaces the system's to verify it: that of a managed database
	// instance. Empty when unset. It is public: no Secret.
	DatabaseCA string

	// APIKeySecret is the HMAC key the API keys are digested with, kept
	// out of the database; nil when unset or empty.
	APIKeySecret Secret

	// APIKeyEnv is the environment of the API keys accepted: "live" or
	// "test".
	APIKeyEnv string

	// RateLimitKey is the number of requests per minute of an API key,
	// from 1 to MaxRateLimit.
	RateLimitKey int

	// RateLimitIP is the number of requests per minute of a client address
	// on the routes needing no key, from 1 to MaxRateLimit.
	RateLimitIP int

	// RateLimitAuth is the number of refused API keys per minute of a
	// client address on the check routes, from 1 to MaxRateLimit: over it,
	// its keys are no longer looked up.
	RateLimitAuth int

	// TrustedProxies are the proxies whose X-Forwarded-For field tells the
	// client's address: nil when unset, empty when set to "none".
	// RequireTrustedProxies tells whether it is set.
	TrustedProxies []netip.Prefix

	// ClientIPHeader is the field, in canonical form, that the platform in
	// front of the API overwrites with the client's address, such as
	// X-Real-Ip on Scaleway Serverless Containers; empty when unset. It
	// excludes TrustedProxies.
	ClientIPHeader string

	// Demo configures the demo access of the site's checker.
	Demo Demo

	// KeyRequest configures the free API keys requested by login link.
	KeyRequest KeyRequest

	// SnapshotBucket is the bucket the snapshots are stored in instead of
	// SnapshotDir, when it is enabled.
	SnapshotBucket SnapshotBucket
}

type Demo struct {
	// Origin is the site's origin, "https://host", the only one CORS
	// allows; empty when the demo is off.
	Origin string

	// TurnstileSecret is the secret key of the site's Turnstile widget;
	// nil when the demo is off.
	TurnstileSecret Secret

	// RateLimit is the number of demo checks per minute of a client
	// address, from 1 to MaxRateLimit.
	RateLimit int

	// RateLimitGlobal is the number of demo checks per minute of every
	// client together, from 1 to MaxRateLimit.
	RateLimitGlobal int
}

type KeyRequest struct {
	// SMTPAddr is the "host:port" of the sending server, which speaks TLS
	// at once; empty when the key requests are off.
	SMTPAddr string

	// SMTPUsername and SMTPPassword authenticate with the server.
	SMTPUsername string
	SMTPPassword Secret

	// MailFrom is the sender address, a bare address.
	MailFrom string

	// LinkURL is the HTTPS page of the site a login link opens, the token
	// in its fragment.
	LinkURL string

	// RateLimit is the number of requests per minute of a client address
	// to the key request routes, from 1 to MaxRateLimit.
	RateLimit int

	// RateLimitAddress is the number of login links per hour an email
	// address may receive, from 1 to MaxRateLimit.
	RateLimitAddress int
}

type Secret []byte

type SnapshotBucket struct {
	// Name is the bucket: 3 to 63 lower-case letters, digits and dashes,
	// starting and ending with a letter or a digit.
	Name string

	// AccessKey and SecretKey are the credentials of the bucket: the key
	// pair of an IAM application restricted to it. Both are Secrets, kept
	// out of every log.
	AccessKey Secret
	SecretKey Secret
}