config

type AuthConfig struct {
	// JWTKey is the HS256 key for client JWTs, read verbatim (raw bytes, no
	// base64) from RUSTDESK_API_JWT_KEY. It must be byte-identical to the key
	// hbbs uses for MUST_LOGIN and to the legacy rustdesk-api key.
	JWTKey Secret `yaml:"jwt_key"`
	// JWTKeyFile is used when JWTKey is empty: a random key is generated there
	// on first start. Default: <DataDir>/jwt.key.
	JWTKeyFile string `yaml:"jwt_key_file"`
	// TokenLifetime is the sliding lifetime of client tokens (DB view).
	TokenLifetime time.Duration `yaml:"token_lifetime"`
	// JWTLifetime is the fixed lifetime embedded in the JWT "exp" claim (the hbbs
	// view; hbbs cannot see revocation). Zero means "same as TokenLifetime".
	JWTLifetime time.Duration `yaml:"jwt_lifetime"`
	// SessionIdle is the idle timeout of panel (web) sessions.
	SessionIdle time.Duration `yaml:"session_idle"`
	// SessionAbsolute is the absolute lifetime of panel (web) sessions.
	SessionAbsolute time.Duration `yaml:"session_absolute"`
}

type ClientDownloadsConfig struct {
	// Enabled looks up RustDesk releases on GitHub (cached for 6 h) and serves
	// the Windows installer under a file name that carries this server's
	// settings. false: the page offers only the settings (config string, QR
	// code) and no outbound request is made. Default: true.
	Enabled bool `yaml:"enabled"`
	// Version pins a RustDesk release ("1.4.2"); empty: the latest one.
	Version string `yaml:"version"`
}

type Config struct {
	// Listen is the HTTP bind address, e.g. ":21114" or "127.0.0.1:31114".
	Listen string `yaml:"listen"`
	// PublicURL is the externally visible base URL (scheme://host[:port][/prefix])
	// that RustDesk clients use as "API server". Used for OIDC redirect URIs and HSTS.
	PublicURL string `yaml:"public_url"`
	// AdminURL is the base URL of the panel (SPA + /api/v1/*) when it is served
	// from a different host than PublicURL (e.g. an internal-only admin vhost).
	// Panel-facing redirects (OIDC login/linking) use it. Default: PublicURL.
	AdminURL string `yaml:"admin_url"`
	// DataDir holds panel.db, secret.key and (by default) jwt.key.
	DataDir string `yaml:"data_dir"`
	// DBType is the database engine: "sqlite" (default) or "postgres".
	DBType string `yaml:"db_type"`
	// DBPath is the SQLite database file. Default: <DataDir>/panel.db.
	DBPath string `yaml:"db_path"`
	// DatabaseURL is the PostgreSQL connection string, e.g.
	// postgres://user:pass@host:5432/dbname?sslmode=require. It usually
	// carries a password, so it is a Secret (redacted when printed).
	DatabaseURL Secret `yaml:"database_url"`
	// DatabaseURLFile is read when DatabaseURL is empty (Docker/Kubernetes
	// secrets).
	DatabaseURLFile string `yaml:"database_url_file"`
	// SecretKey is a base64-encoded 32-byte AEAD key for secrets at rest. When
	// empty, the key is loaded from (or generated into) SecretKeyFile.
	SecretKey Secret `yaml:"secret_key"`
	// SecretKeyFile is the AEAD key file. Default: <DataDir>/secret.key.
	SecretKeyFile string `yaml:"secret_key_file"`
	// UpdateCheck lets the About page look up the latest RD Panel
	// release on GitHub (server-side, cached for 6 h; never blocks anything).
	UpdateCheck bool `yaml:"update_check"`
	// APIDocs controls the interactive admin API docs at /api/v1/docs and the
	// spec at /api/v1/openapi.{yaml,json}: "auth" (signed-in users, default),
	// "public" (readable without login) or "off" (404).
	APIDocs string `yaml:"api_docs"`

	Auth       AuthConfig       `yaml:"auth"`
	WebAuthn   WebAuthnConfig   `yaml:"webauthn"`
	HTTP       HTTPConfig       `yaml:"http"`
	HBBS       HBBSConfig       `yaml:"hbbs"`
	Log        LogConfig        `yaml:"log"`
	Logs       LogsConfig       `yaml:"logs"`
	SMTP       SMTPConfig       `yaml:"smtp"`
	Webhook    WebhookConfig    `yaml:"webhook"`
	Federation FederationConfig `yaml:"federation"`
	// WebClient configures the browser remote desktop client (/connect).
	WebClient WebClientConfig `yaml:"webclient"`
	// ClientDownloads configures the "Install client" page.
	ClientDownloads ClientDownloadsConfig `yaml:"client_downloads"`
	// ShareLinks configures public server share links (/s/<token>).
	ShareLinks ShareLinksConfig `yaml:"share_links"`
}

type FederationConfig struct {
	// Enabled serves /api/v1/federation/{health,relays} to peer panels and
	// runs the peer sync loop.
	Enabled bool `yaml:"enabled"`
	// Token is the bearer token peer panels must present to this panel's
	// federation endpoints (at least MinFederationTokenLen characters;
	// required when Enabled). Peers store it as their "auth token" for this
	// panel.
	Token Secret `yaml:"token"`
}

type HBBSConfig struct {
	// IDServer is the hbbs rendezvous TCP address (default 127.0.0.1:21116).
	// The hbbs admin channel listens on its port minus one.
	IDServer string `yaml:"id_server"`
	// RelayServer is the hbbr TCP address (default 127.0.0.1:21117); the hbbr
	// admin channel shares this port (loopback only).
	RelayServer string `yaml:"relay_server"`
	// RelayPublicHost is the public host[:port] of the co-located hbbr as
	// clients reach it; the "local" relay on the Relays tab is seeded from it.
	// Default: the first entry of RELAY (the hbbs -r value in the s6 image).
	RelayPublicHost string `yaml:"relay_public_host"`
	// PublicKeyFile is the hbbs public key served to clients. Default: <DataDir>/id_ed25519.pub.
	PublicKeyFile string `yaml:"public_key_file"`
	// Enabled turns on the hbbs/hbbr workers (presence poller, reconciler).
	Enabled bool `yaml:"enabled"`
	// PollInterval is the presence poll period (OnlineRequest to IDServer).
	PollInterval time.Duration `yaml:"poll_interval"`
	// ReconcileInterval is the admin-channel probe / drift-check period.
	ReconcileInterval time.Duration `yaml:"reconcile_interval"`
	// ListDir is hbbr's working directory; when set, the reconciler keeps
	// blacklist.txt / blocklist.txt there in sync with the desired lists
	// (/data in the s6 image). Empty disables writing the files.
	ListDir string `yaml:"list_dir"`
	// WebProxy controls whether RD Panel proxies browser WebSocket connections
	// (/ws/id and /ws/relay) to local hbbs/hbbr WebSocket listeners. Default: true.
	WebProxy bool `yaml:"web_proxy"`
	// WSIDServer is an explicit override for hbbs WebSocket address (default: IDServer port + 2).
	WSIDServer string `yaml:"ws_id_server"`
	// WSRelayServer is an explicit override for hbbr WebSocket address (default: RelayServer port + 2).
	WSRelayServer string `yaml:"ws_relay_server"`
	// Authz serves POST /internal/hbbs/authorize, where hbbs (AUTHZ_URL)
	// asks the panel whether a connection may start and which control
	// permissions it gets (connection rules and control roles). Loopback
	// callers presenting the secret in AuthzSecretFile only. Default: true.
	Authz bool `yaml:"authz"`
	// AuthzSecretFile holds the bearer secret hbbs presents to the
	// authorization endpoint; generated (32 random bytes, hex, mode 0600)
	// when missing. Default: <DataDir>/hbbs-authz.key.
	AuthzSecretFile string `yaml:"authz_secret_file"`
}

type HTTPConfig struct {
	// TrustedProxies lists IPs/CIDRs whose forwarding headers are honoured.
	TrustedProxies []string `yaml:"trusted_proxies"`
	// RealIPHeader is the header carrying the client IP when the peer is a
	// trusted proxy: X-Forwarded-For, X-Real-IP or CF-Connecting-IP.
	RealIPHeader string `yaml:"real_ip_header"`
	// MetricsAllow lists IPs/CIDRs (as resolved client IPs) allowed to scrape /metrics.
	MetricsAllow []string `yaml:"metrics_allow"`
	// MetricsPerDevice exports rdpanel_presence_device_online{id=...}, one
	// series per device. Off by default: cardinality grows with the fleet.
	MetricsPerDevice bool `yaml:"metrics_per_device"`
	// contains filtered or unexported fields
}

type LogConfig struct {
	// Level is one of debug, info, warn, error.
	Level string `yaml:"level"`
	// Format is json (default) or text.
	Format string `yaml:"format"`
}

type LogsConfig struct {
	// Buffer is the number of recent lines kept per source (hbbs, hbbr,
	// panel); 0 disables the buffer and the Logs page.
	Buffer int `yaml:"buffer"`
	// Dir holds one s6-log directory per source (<dir>/<source>/current),
	// written by the s6 image's log pipelines (/run/rdpanel/logs there). When
	// empty, only the panel's own lines are captured.
	Dir string `yaml:"dir"`
}

type LookupFunc func(key string) (string, bool)

type SMTPConfig struct {
	Host string `yaml:"host"`
	// Port defaults to 587 (starttls), 465 (tls) or 25 (none).
	Port     int    `yaml:"port"`
	Username string `yaml:"username"`
	Password Secret `yaml:"password"`
	// PasswordFile is read when Password is empty (Docker/Kubernetes secrets).
	PasswordFile string `yaml:"password_file"`
	// From is the sender address, e.g. "RD Panel <panel@example.com>".
	From string `yaml:"from"`
	// Encryption is none, starttls (default) or tls (implicit TLS, "SMTPS").
	Encryption         string `yaml:"encryption"`
	InsecureSkipVerify bool   `yaml:"insecure_skip_verify"`
}

type Secret string

type ShareLinksConfig struct {
	// Enabled serves /s/* and lets admins (and user groups an admin allows)
	// create links.
	Enabled bool `yaml:"enabled"`
}

type WebAuthnConfig struct {
	// RPID is the WebAuthn relying party id: a host name equal to, or a
	// registrable parent domain of, every origin's host (e.g. "example.com" to
	// share passkeys between panel.example.com and admin.example.com).
	RPID string `yaml:"rp_id"`
	// Origins are the exact origins (scheme://host[:port]) the panel SPA is
	// served from. Default: the AdminURL origin, plus the PublicURL origin
	// when its host is within the RP ID.
	Origins []string `yaml:"origins"`
}

type WebClientConfig struct {
	// Enabled offers the web client to signed-in users. Default: true.
	Enabled bool `yaml:"enabled"`
	// AdminOnly limits the web client to panel admins.
	AdminOnly bool `yaml:"admin_only"`
	// IDURL / RelayURL are the WebSocket URLs of hbbs (21118) and hbbr
	// (21119) as seen by browsers. Empty: same origin as the panel,
	// /ws/id and /ws/relay.
	IDURL    string `yaml:"id_url"`
	RelayURL string `yaml:"relay_url"`
	// Servers are other RustDesk-compatible servers offered in the web
	// client next to this one (their WebSocket origins are allowed by CSP).
	Servers []WebClientServer `yaml:"servers"`
	// CustomServers lets users enter any server (CSP then allows every wss:
	// origin for WebSocket connections).
	CustomServers bool `yaml:"custom_servers"`
}

type WebClientServer struct {
	Name string `yaml:"name" json:"name"`
	// IDURL is hbbs' WebSocket URL as browsers reach it (wss://host/ws/id).
	IDURL string `yaml:"id_url" json:"id_url"`
	// RelayURL is hbbr's WebSocket URL; empty: IDURL with /ws/relay.
	RelayURL string `yaml:"relay_url" json:"relay_url"`
	// Key is the server's public key (id_ed25519.pub, base64).
	Key string `yaml:"key" json:"key"`
}

type WebhookConfig struct {
	URL    string `yaml:"url"`
	Secret Secret `yaml:"secret"`
}