config

type AuthConfig struct {
	// JWTKey is the HS256 key for client JWTs, read verbatim (raw bytes, no
	// base64) from RUSTDESK_API_JWT_KEY. It must be byte-identical to the key
	// hbbs uses for MUST_LOGIN and to the legacy rustdesk-api key.
	JWTKey Secret `yaml:"jwt_key"`
	// JWTKeyFile is used when JWTKey is empty: a random key is generated there
	// on first start. Default: <DataDir>/jwt.key.
	JWTKeyFile string `yaml:"jwt_key_file"`
	// TokenLifetime is the sliding lifetime of client tokens (DB view).
	TokenLifetime time.Duration `yaml:"token_lifetime"`
	// JWTLifetime is the fixed lifetime embedded in the JWT "exp" claim (the hbbs
	// view; hbbs cannot see revocation). Zero means "same as TokenLifetime".
	JWTLifetime time.Duration `yaml:"jwt_lifetime"`
	// SessionIdle is the idle timeout of panel (web) sessions.
	SessionIdle time.Duration `yaml:"session_idle"`
	// SessionAbsolute is the absolute lifetime of panel (web) sessions.
	SessionAbsolute time.Duration `yaml:"session_absolute"`
}

type Config struct {
	// Listen is the HTTP bind address, e.g. ":21114" or "127.0.0.1:31114".
	Listen string `yaml:"listen"`
	// PublicURL is the externally visible base URL (scheme://host[:port][/prefix])
	// that RustDesk clients use as "API server". Used for OIDC redirect URIs and HSTS.
	PublicURL string `yaml:"public_url"`
	// AdminURL is the base URL of the panel (SPA + /api/v1/*) when it is served
	// from a different host than PublicURL (e.g. an internal-only admin vhost).
	// Panel-facing redirects (OIDC login/linking) use it. Default: PublicURL.
	AdminURL string `yaml:"admin_url"`
	// DataDir holds panel.db, secret.key and (by default) jwt.key.
	DataDir string `yaml:"data_dir"`
	// DBPath is the SQLite database file. Default: <DataDir>/panel.db.
	DBPath string `yaml:"db_path"`
	// SecretKey is a base64-encoded 32-byte AEAD key for secrets at rest. When
	// empty, the key is loaded from (or generated into) SecretKeyFile.
	SecretKey Secret `yaml:"secret_key"`
	// SecretKeyFile is the AEAD key file. Default: <DataDir>/secret.key.
	SecretKeyFile string `yaml:"secret_key_file"`
	// UpdateCheck lets the About page look up the latest RD Panel
	// release on GitHub (server-side, cached for 6 h; never blocks anything).
	UpdateCheck bool `yaml:"update_check"`
	// APIDocs controls the interactive admin API docs at /api/v1/docs and the
	// spec at /api/v1/openapi.{yaml,json}: "auth" (signed-in users, default),
	// "public" (readable without login) or "off" (404).
	APIDocs string `yaml:"api_docs"`

	Auth     AuthConfig     `yaml:"auth"`
	WebAuthn WebAuthnConfig `yaml:"webauthn"`
	HTTP     HTTPConfig     `yaml:"http"`
	HBBS     HBBSConfig     `yaml:"hbbs"`
	Log      LogConfig      `yaml:"log"`
	Logs     LogsConfig     `yaml:"logs"`
	SMTP     SMTPConfig     `yaml:"smtp"`
	Webhook  WebhookConfig  `yaml:"webhook"`
}

type HBBSConfig struct {
	// IDServer is the hbbs rendezvous TCP address (default 127.0.0.1:21116).
	// The hbbs admin channel listens on its port minus one.
	IDServer string `yaml:"id_server"`
	// RelayServer is the hbbr TCP address (default 127.0.0.1:21117); the hbbr
	// admin channel shares this port (loopback only).
	RelayServer string `yaml:"relay_server"`
	// RelayPublicHost is the public host[:port] of the co-located hbbr as
	// clients reach it; the "local" relay on the Relays tab is seeded from it.
	// Default: the first entry of RELAY (the hbbs -r value in the s6 image).
	RelayPublicHost string `yaml:"relay_public_host"`
	// PublicKeyFile is the hbbs public key served to clients. Default: <DataDir>/id_ed25519.pub.
	PublicKeyFile string `yaml:"public_key_file"`
	// Enabled turns on the hbbs/hbbr workers (presence poller, reconciler).
	Enabled bool `yaml:"enabled"`
	// PollInterval is the presence poll period (OnlineRequest to IDServer).
	PollInterval time.Duration `yaml:"poll_interval"`
	// ReconcileInterval is the admin-channel probe / drift-check period.
	ReconcileInterval time.Duration `yaml:"reconcile_interval"`
	// ListDir is hbbr's working directory; when set, the reconciler keeps
	// blacklist.txt / blocklist.txt there in sync with the desired lists
	// (/data in the s6 image). Empty disables writing the files.
	ListDir string `yaml:"list_dir"`
}

type HTTPConfig struct {
	// TrustedProxies lists IPs/CIDRs whose forwarding headers are honoured.
	TrustedProxies []string `yaml:"trusted_proxies"`
	// RealIPHeader is the header carrying the client IP when the peer is a
	// trusted proxy: X-Forwarded-For, X-Real-IP or CF-Connecting-IP.
	RealIPHeader string `yaml:"real_ip_header"`
	// MetricsAllow lists IPs/CIDRs (as resolved client IPs) allowed to scrape /metrics.
	MetricsAllow []string `yaml:"metrics_allow"`
	// MetricsPerDevice exports rdpanel_presence_device_online{id=...}, one
	// series per device. Off by default: cardinality grows with the fleet.
	MetricsPerDevice bool `yaml:"metrics_per_device"`
	// contains filtered or unexported fields
}

type LogConfig struct {
	// Level is one of debug, info, warn, error.
	Level string `yaml:"level"`
	// Format is json (default) or text.
	Format string `yaml:"format"`
}

type LogsConfig struct {
	// Buffer is the number of recent lines kept per source (hbbs, hbbr,
	// panel); 0 disables the buffer and the Logs page.
	Buffer int `yaml:"buffer"`
	// Dir holds one s6-log directory per source (<dir>/<source>/current),
	// written by the s6 image's log pipelines (/run/rdpanel/logs there). When
	// empty, only the panel's own lines are captured.
	Dir string `yaml:"dir"`
}

type LookupFunc func(key string) (string, bool)

type SMTPConfig struct {
	Host string `yaml:"host"`
	// Port defaults to 587 (starttls), 465 (tls) or 25 (none).
	Port     int    `yaml:"port"`
	Username string `yaml:"username"`
	Password Secret `yaml:"password"`
	// PasswordFile is read when Password is empty (Docker/Kubernetes secrets).
	PasswordFile string `yaml:"password_file"`
	// From is the sender address, e.g. "RD Panel <panel@example.com>".
	From string `yaml:"from"`
	// Encryption is none, starttls (default) or tls (implicit TLS, "SMTPS").
	Encryption         string `yaml:"encryption"`
	InsecureSkipVerify bool   `yaml:"insecure_skip_verify"`
}

type Secret string

type WebAuthnConfig struct {
	// RPID is the WebAuthn relying party id: a host name equal to, or a
	// registrable parent domain of, every origin's host (e.g. "example.com" to
	// share passkeys between panel.example.com and admin.example.com).
	RPID string `yaml:"rp_id"`
	// Origins are the exact origins (scheme://host[:port]) the panel SPA is
	// served from. Default: the AdminURL origin, plus the PublicURL origin
	// when its host is within the RP ID.
	Origins []string `yaml:"origins"`
}

type WebhookConfig struct {
	URL    string `yaml:"url"`
	Secret Secret `yaml:"secret"`
}