config

type Backup struct {
	// Bucket is the bucket name, as SnapshotBucket.Name.
	Bucket string

	// AccessKey and SecretKey are the credentials of the bucket, which may
	// only add objects. Both are Secrets, kept out of every log.
	AccessKey Secret
	SecretKey Secret

	// Recipient is the age public key the backups are sealed for. It is
	// public: no Secret. Its format is checked where it is used.
	Recipient string

	// SigningKey is the hex seed of the Ed25519 key that signs each dump,
	// so that a restore can tell it was made by this job (#340, point 3).
	// It is a Secret; its format is checked where it is used.
	SigningKey Secret
}

type Config struct {
	// Addr is the TCP address the HTTP API listens on, "host:port" with a
	// numeric port; an empty host means every interface.
	Addr string

	// LogLevel is the minimum level written to the log.
	LogLevel slog.Level

	// LogKey is the HMAC key that pseudonymises personal data in the log.
	LogKey Secret

	// DataDir is the only directory the commands write to: the data
	// volume. Every other path may be read-only.
	DataDir string

	// SourceACPR turns the ACPR blacklist on, once its reuse licence is
	// obtained.
	SourceACPR bool

	// AlertWebhook is the HTTPS URL a failed or rejected sync is posted
	// to; nil when unset or empty, and then alerts are only logged. It is a
	// Secret: a webhook URL usually carries its credential.
	AlertWebhook Secret

	// ProblemBaseURL is the HTTPS URL of the documentation of the API's
	// problems, ending with a slash: the type of a problem is its code
	// under it.
	ProblemBaseURL string

	// BatchMaxItems is the most items POST /v1/check/batch accepts, from 1
	// to MaxBatchMaxItems.
	BatchMaxItems int

	// Instances is the most processes of the API running at once, from 1
	// to MaxInstances. The registries limit requests per IP address, and the
	// platform does not tell whether the processes share one: each keeps to
	// its share of the limit.
	Instances int

	// DatabaseURL is the PostgreSQL connection string of the API key store;
	// nil when unset or empty. RequireKeyStore tells whether it is set.
	DatabaseURL Secret

	// DatabaseCA is the certificate authority of the database, in PEM,
	// which replaces the system's to verify it: that of a managed database
	// instance. Empty when unset. It is public: no Secret.
	DatabaseCA string

	// APIKeySecret is the HMAC key the API keys are digested with, kept
	// out of the database; nil when unset or empty.
	APIKeySecret Secret

	// APIKeyEnv is the environment of the API keys accepted: "live" or
	// "test".
	APIKeyEnv string

	// RateLimitKey is the number of requests per minute of an API key,
	// from 1 to MaxRateLimit.
	RateLimitKey int

	// RateLimitIP is the number of requests per minute of a client address
	// on the routes needing no key, from 1 to MaxRateLimit.
	RateLimitIP int

	// RateLimitAuth is the number of refused API keys per minute of a
	// client address on the check routes, from 1 to MaxRateLimit: over it,
	// its keys are no longer looked up.
	RateLimitAuth int

	// TrustedProxies are the proxies whose X-Forwarded-For field tells the
	// client's address: nil when unset, empty when set to "none".
	// RequireTrustedProxies tells whether it is set.
	TrustedProxies []netip.Prefix

	// ClientIPHeader is the field, in canonical form, that the platform in
	// front of the API overwrites with the client's address, such as
	// X-Real-Ip on Scaleway Serverless Containers; empty when unset. It
	// excludes TrustedProxies.
	ClientIPHeader string

	// Demo configures the demo access of the site's checker.
	Demo Demo

	// KeyRequest configures the free API keys requested by login link.
	KeyRequest KeyRequest

	// SnapshotBucket is the bucket the snapshots are stored in instead of
	// SnapshotDir, when it is enabled.
	SnapshotBucket SnapshotBucket

	// Backup is where admin backup keeps the sealed copies of the key
	// store.
	Backup Backup

	// Restore is the dump admin restore -listen loads in production.
	Restore Restore

	// Rotate configures the key rotation job (ADR 0007).
	Rotate Rotate

	// Erase is the account admin account erase erases (#304).
	Erase Erase
}

type Demo struct {
	// Origin is the site's origin, "https://host", the only one CORS
	// allows; empty when the demo is off.
	Origin string

	// TurnstileSecret is the secret key of the site's Turnstile widget;
	// nil when the demo is off.
	TurnstileSecret Secret

	// RateLimit is the number of demo checks per minute of a client
	// address, from 1 to MaxRateLimit.
	RateLimit int

	// RateLimitGlobal is the number of demo checks per minute of every
	// client together, from 1 to MaxRateLimit.
	RateLimitGlobal int
}

type Erase struct {
	// Email is the address of the account: personal data, a Secret so
	// that no log shows it; its format is checked where it is used.
	Email Secret
}

type GitHubApp struct {
	ClientID       string
	InstallationID int64
	// PrivateKey is its private key, in PEM, checked where it is used.
	PrivateKey Secret
}

type KeyRequest struct {
	// SMTPAddr is the "host:port" of the sending server, which speaks TLS
	// at once; empty when the key requests are off.
	SMTPAddr string

	// SMTPUsername and SMTPPassword authenticate with the server.
	SMTPUsername string
	SMTPPassword Secret

	// MailFrom is the sender address, a bare address.
	MailFrom string

	// LinkURL is the HTTPS page of the site a login link opens, the token
	// in its fragment.
	LinkURL string

	// RateLimit is the number of requests per minute of a client address
	// to the key request routes, from 1 to MaxRateLimit.
	RateLimit int

	// RateLimitAddress is the number of login links per hour an email
	// address may receive, from 1 to MaxRateLimit.
	RateLimitAddress int

	// RateLimitGlobal is the number of login links per hour mailed to
	// every address together, from 1 to MaxRateLimit.
	RateLimitGlobal int
}

type Restore struct {
	// URL is the presigned URL of the sealed dump: its query is a
	// credential.
	URL Secret

	// Identity is the age private key the dump is sealed for, drawn for
	// this restore only.
	Identity Secret

	// VerifyKey is the hex Ed25519 public key that checks the signature of
	// the dump, made by the backup job. It is public: no Secret.
	VerifyKey string
}

type Rotate struct {
	// AccessKey and SecretKey are the key of the job itself.
	AccessKey string
	SecretKey Secret

	// OrganizationID is the organization of the applications, which the
	// API requires to list their keys; ProjectID is the default project of
	// the keys it creates.
	OrganizationID string
	ProjectID      string

	// Bucket is the snapshot bucket a new key of api or sync must read.
	Bucket string

	// Apps are the IAM applications of the closed list.
	Apps RotateApps

	// APIContainerID is the api container, whose secrets hold its key.
	APIContainerID string

	// SyncSecrets and SelfSecrets are the Secret Manager secrets the sync
	// job and the rotation job read their key from, one per half.
	SyncSecrets, SelfSecrets SecretIDs

	// GitHubApp writes the key of ci-deploy to the GitHub environment.
	GitHubApp GitHubApp

	// SMTP is the server a new key of mail must authenticate with.
	SMTP RotateSMTP
}

type RotateApps struct {
	API, Sync, CI, Self, Mail string
}

type RotateSMTP struct {
	Addr, Username string
}

type Secret []byte

type SecretIDs struct {
	Access, Secret string
}

type SnapshotBucket struct {
	// Name is the bucket: 3 to 63 lower-case letters, digits and dashes,
	// starting and ending with a letter or a digit.
	Name string

	// AccessKey and SecretKey are the credentials of the bucket: the key
	// pair of an IAM application restricted to it. Both are Secrets, kept
	// out of every log.
	AccessKey Secret
	SecretKey Secret
}