config

type AdminConfig struct {
	// Listen is the admin server bind address (e.g. ":9090", "127.0.0.1:9090").
	Listen string
	// AuthToken is the bearer token required on every admin request. Mandatory:
	// an admin block without one is a config error (an unauthenticated admin
	// surface would leak the config and live metrics).
	AuthToken string
	// Metrics enables the Prometheus text-format `/metrics` endpoint when true
	// (the JSON API + dashboard are always served; this is the extra scrape
	// endpoint). Off unless the bare `metrics` flag is present.
	Metrics bool
}

type CacheBudgetChange struct {
	Host    string   // the surviving site's primary host
	Details []string // per-field diffs, e.g. "ram 67108864B->134217728B", `disk_path "/a"->"/b"`
}

type Config struct {
	// Sites are the runtime sites in source order.
	Sites []*Site

	// TLS is the per-site TLS configuration (hostnames + tls directive), in site
	// order, for building the server's tlsacme.Manager. The server decides whether
	// to bind :443 from these.
	TLS []tlsacme.SiteConfig

	// Admin is the parsed `admin { … }` global block, or NIL when no admin block
	// is present (the common case). When set, cadish starts the opt-in
	// observability/dashboard server on its own listener (internal/admin) and
	// threads a metrics seam through the datapath; when nil, none of that exists
	// and the datapath pays nothing. The Cadishfile path is recorded so the admin
	// `cadish check`-style config view can re-read it.
	Admin      *AdminConfig
	ConfigPath string

	// Security is the parsed global `security { … }` block (WAF v1c, D52), or NIL
	// when absent (the common case). It carries cross-cutting security observability
	// for v1 — the audit-log target — which is OFF by default. The native security
	// primitives (allow/deny/rate_limit) are site-level and not gated by this block.
	Security *SecurityConfig

	// StrictHost is the global `strict_host` option: when true the server rejects a
	// request whose Host matches no declared site address with 421 Misdirected
	// Request, instead of the lenient single-site fallback (serve ANY Host from the
	// only configured site). Default false = lenient (backward-compatible). It hardens
	// a single-site deployment against cache-poisoning / Host-confusion by an
	// undeclared Host. The server reads it once at routing-build time.
	StrictHost bool

	// AccessLogOff is the global `access_log off` option: when true the server's
	// in-memory access-log fan-out hub (D44) is disabled, so even an attached
	// `cadish logs` consumer receives nothing and the hot path's only cost is the
	// idle atomic check. Default false = hub on (but idle-free until a consumer
	// attaches). The `-access-log off` run flag is OR'd with this.
	AccessLogOff bool

	// ProxyProtocol is the parsed global `proxy_protocol { … }` block (the opt-in
	// PROXY-protocol listener), or NIL when absent (the common case). When set, the
	// server wraps its inbound listener(s) so each accepted connection's PROXY v1/v2
	// header recovers the real client IP (honored ONLY from a trusted peer). When nil,
	// no wrapper is installed and the accept path is unchanged (zero cost). It can also
	// be supplied by the `-proxy-protocol` + `-proxy-protocol-trust` run flags, which
	// the run command merges into this field before constructing the server.
	ProxyProtocol *ProxyProtocolConfig

	// Server is the parsed global `server { maxconn N; read_timeout D; idle_timeout D }`
	// block (the inbound data-plane connection knobs), or NIL when absent (the common
	// case). When set, the server overrides its hardcoded inbound http.Server timeouts
	// from the non-zero fields and wraps the public listener(s) with a LimitListener
	// when maxconn>0. When nil, the shipped default constants apply and no limiter is
	// installed (zero cost). It governs the data plane only — the admin server keeps
	// its own configuration.
	Server *ServerConfig

	// GlobalDirectiveWarnings are load-time WARNINGS for every top-level directive in
	// the leading global-options block that no consumer reads — dead config that loads
	// clean but never takes effect (the CAD-62 trap: a global `trust_proxy` that
	// silently did nothing behind Cloudflare). Computed at load via
	// cadishfile.UnconsumedGlobalDirectives — the SAME detector `cadish check` uses, so
	// check and run agree — and surfaced by the `cadish run` command as log.Warn lines
	// (the config still loads; these are observability only, mirroring
	// AdminExposureWarning). Empty for a clean config.
	GlobalDirectiveWarnings []string
	// contains filtered or unexported fields
}

type LoadOptions struct {
	// Kubeconfig is the explicit kubeconfig path used to resolve k8s:// upstreams
	// out-of-cluster (the --kubeconfig flag). Empty ⇒ in-cluster, then KUBECONFIG,
	// then ~/.kube/config. It is only consulted when the config has a k8s:// target.
	Kubeconfig string

	// EndpointResolver, when non-nil, supplies the k8s:// EndpointResolver directly
	// instead of building a shared k8s.Client. The ingress controller passes Layer 1's
	// already-built client's resolver (so the translated config reuses one client);
	// tests inject a fake so a k8s:// config compiles offline. When set, this config's
	// Start/Close do NOT manage the resolver's client — its owner does.
	EndpointResolver lb.EndpointResolver

	// AllowNoSites permits a config that defines ZERO sites. The ingress controller uses
	// it: its base Cadishfile holds only globals (sites come from Ingress objects), and a
	// reconcile with no matched Ingresses renders a site-less config that must still load
	// (the server then serves nothing until Ingresses appear). For a normal `cadish run`
	// it stays false, so a site-less Cadishfile is the usual fail-fast error.
	AllowNoSites bool
}

type ProxyProtocolConfig struct {
	// Trust is the trusted PROXY-header source CIDRs (typically the LB addresses).
	Trust []netip.Prefix
}

type SecurityConfig struct {
	// AuditLogPath is the `audit_log <dir|file|off>` target. "" / "off" means the
	// audit log is disabled (the default). A directory writes
	// <dir>/security-audit.log; a file path appends to that file. OFF by default
	// because the audit log MAY record the real client IP (recording who was
	// blocked is the point) — an operator must opt in explicitly.
	AuditLogPath string
}

type ServerConfig struct {
	// MaxConn caps the number of simultaneously-accepted inbound connections on the
	// public data-plane listener(s) via golang.org/x/net/netutil.LimitListener.
	// 0 (the default / omitted) means NO limit — the bare listener, unchanged.
	MaxConn int
	// ReadTimeout overrides the inbound http.Server ReadTimeout (a slow-request /
	// slowloris bound). 0 (omitted) ⇒ the server's default const is kept.
	ReadTimeout time.Duration
	// IdleTimeout overrides the inbound http.Server IdleTimeout (how long a keep-alive
	// connection may sit idle). 0 (omitted) ⇒ the server's default const is kept.
	IdleTimeout time.Duration
}

type Site struct {
	// Addresses are the site header tokens (e.g. "example.com", "*.cdn.example.com"),
	// used for Host-based site selection.
	Addresses []string

	// Name is a short identifier for logs (the first address).
	Name string

	// Pipeline is the compiled request-evaluation engine for this site.
	Pipeline *pipeline.Pipeline

	// Store is the two-tier cache for this site.
	Store *cache.Store

	// Origin is the default upstream origin (a single httporigin/s3origin, or a
	// chain when `origin chain …` is configured). Used when no `route` matched or
	// the routed upstream is unknown.
	Origin origin.Origin

	// Origins maps each declared upstream name to its origin, so a `route @m ->
	// NAME` decision can select the matching backend. A chain's member upstreams
	// also appear here.
	Origins map[string]origin.Origin

	// DefaultUpstreamName is the name of the default origin's upstream ("" when the
	// default is an `origin chain`). The server resolves a request's effective
	// upstream name as routedUpstream-or-DefaultUpstreamName to look up its sticky
	// spec for the lb routing-key seam.
	DefaultUpstreamName string

	// StickySpecs maps a sticky upstream's name to the spec telling the server how
	// to derive the {sticky} routing key (which cookie / client_ip fallback) to
	// attach via lb.WithRoutingKey before Fetch.
	StickySpecs map[string]*lb.StickySpec

	// Device is the site's User-Agent → device-class classifier for the {device}
	// cache-key normalizer (built from `device_detect { … }`, or the built-in
	// default ruleset when absent). Never nil. The server consults it (gated by
	// Pipeline.UsesDeviceToken) to set Request.Device before EvalRequest.
	Device *classify.Classifier

	// Geo is the site's client-IP/header → country-class source for the {geo}
	// cache-key normalizer (built from `geo { … }`). It is NIL when the site
	// configures no geo source — the geo tokens then render "". The server consults
	// it (gated by Pipeline.UsesGeoToken) to set Request.Geo before EvalRequest, and
	// derives Request.GeoContinent from the country via an in-tree table.
	Geo geo.Source

	// GeoRegion is the site's upstream region/subdivision-header source for the
	// {geo.region} token / `geo region …` matcher (from `geo { region_header NAME }`).
	// It is NIL when no region_header is configured — {geo.region} then renders "".
	// Region needs an upstream geo header because a US state can't come from a raw IP
	// without a GeoIP DB (D11: no bundled GeoIP database). Set into Request.GeoRegion
	// in the same gated geo pre-pass.
	GeoRegion geo.Source

	// TrustedProxies are the CIDRs whose X-Forwarded-For is trusted when resolving
	// the real client IP. It is the SINGLE SOURCE OF TRUTH for trusted-proxy
	// resolution, read by BOTH {geo} (the geo pre-pass) and the security gate's `ip`
	// ACL. It is the UNION of the standalone site-level `trust_proxy …` directive and
	// the `geo { trust_proxy … }` block, so a pure-security site (an `ip` ACL with no
	// geo block) can still declare its proxies.
	TrustedProxies []netip.Prefix

	// Cluster is the region-local peer-cache membership built from a `cluster { … }`
	// block, or NIL when the site declares no cluster (the zero-cost default: a
	// non-clustered cadish behaves exactly as before). When non-nil it drives peer
	// read-through (#7) and ownership routing (#8); the server consults it in one
	// well-named seam (clusterRoute) and the read-through PeerOrigin is already
	// composed before the real origin in this site's Origin chain.
	Cluster *cluster.Membership

	// PoolHealthy resolves an upstream POOL name to its current liveness (≥1 backend
	// up, lb nbsrv()>0) for the `upstream_healthy NAME…` matcher (the AWS health probe).
	// It is built ONLY when the site's pipeline references the matcher (gated by
	// Pipeline.NeedsPoolHealth) — NIL on every other site, so the request fast path pays
	// nothing. The server injects it into Request.PoolHealthy before EvalRequest. It reads
	// this site's Origins map at CALL time, so it always resolves to the LIVE pool after a
	// reload pool transplant (which repoints Origins in place); a name that is not a pool
	// resolves false (fail-closed).
	PoolHealthy func(name string) bool
	// contains filtered or unexported fields
}