config

type Config struct {
	// Addr is the listen address for the dashboard.
	Addr string

	// DatabaseURL is a Postgres connection string. Required.
	DatabaseURL string

	// Kubeconfig points at a cluster. Empty uses the default client-go
	// loading rules, or in-cluster config when KubeInCluster is set.
	Kubeconfig    string
	KubeInCluster bool

	// AuthToken, when set, requires a bearer token on every request. Empty
	// means the dashboard is unauthenticated and suitable only for a trusted
	// network — the engine warns loudly about this at startup.
	AuthToken string

	// OwnerID identifies the single owner every resource belongs to.
	OwnerID   string
	OwnerName string

	// OwnerEmail is the address that may sign in to a fresh install before
	// anybody has an account.
	//
	// Links go only to addresses that already exist, which is what stops the
	// sign-in form filling the user table — and leaves a new install with
	// accounts on unenterable. This names the one exception, and only until it
	// has an account of its own.
	OwnerEmail string

	// SecretKey seals secret environment variables, base64 of 32 bytes.
	//
	// Empty means secrets are refused rather than stored readable. Losing it
	// means losing every secret sealed with it — there is no recovery path,
	// because a recovery path is a second way in.
	SecretKey string

	// SecretKeyPrevious are keys kept only to open values sealed before the
	// current one. Comma-separated, each the same shape as SecretKey.
	//
	// Nothing is ever sealed with these. They exist so that replacing a key is
	// not a flag day: the new key becomes YACHT_SECRET_KEY, the old one moves
	// here, and every stored value keeps opening until it has been written
	// again under the new key. An install that has never rotated sets only
	// YACHT_SECRET_KEY and this stays empty.
	SecretKeyPrevious []string

	// AppDomain is the platform domain every app gets a hostname under, such
	// as apps.example.com. Empty switches per-app hostnames off entirely.
	AppDomain string

	// WildcardTLS serves platform hostnames over TLS using the ingress
	// controller's configured default certificate.
	//
	// Yacht cannot verify that default exists. An install without one serves
	// the wrong certificate rather than failing, so this is logged at startup
	// and shown on the settings page — a capability the engine cannot check is
	// one it should be noisy about.
	WildcardTLS bool

	// CertIssuer names the cert-manager ClusterIssuer that gives each custom
	// domain a certificate of its own. Empty means there is none, and a custom
	// domain is served over plain HTTP — the wildcard above can never cover a
	// name outside the platform domain.
	//
	// Yacht only names it. Whether the issuer exists and can reach Let's
	// Encrypt is the installer's to check, and what became of each request is
	// read back and shown on the domain.
	CertIssuer string

	// ReservedDomains are additional suffixes no tenant may claim. AppDomain
	// is always reserved whether or not it appears here.
	ReservedDomains []string

	// DNSResolver pins custom-domain lookups to one nameserver, as host or
	// host:port — "1.1.1.1" or "10.0.0.53:53".
	//
	// Empty is the right answer almost always. By default Yacht asks the
	// domain's own nameservers, which hold no cache: a record created two
	// seconds ago verifies two seconds later. Naming a recursive resolver here
	// gives that up — every recursive resolver caches negative answers, and the
	// check made just before somebody creates a record is what puts one there.
	//
	// Worth setting for a split-horizon install, where the answer that matters
	// is the one a particular resolver gives rather than the one the public
	// internet would.
	DNSResolver string

	// BaseURL is the public URL the dashboard is reached at, such as
	// https://yacht.example.com. It is what a sign-in link is built from, and
	// setting it is what switches accounts on: without it there is no address
	// to put in the link, so there is no way to sign in.
	BaseURL string

	// SMTP describes a relay to send sign-in links through. SMTPAddr empty
	// means no relay is configured.
	SMTPAddr     string
	SMTPUsername string
	SMTPPassword string
	SMTPFrom     string

	// ResendAPIKey and ResendFrom select Resend's HTTP API instead of a relay.
	ResendAPIKey string
	ResendFrom   string

	// SessionTTL is how long a signed-in browser stays signed in.
	SessionTTL time.Duration

	// MagicLinkTTL is how long a sign-in link remains redeemable. Short,
	// because the link is a bearer credential sitting in a mailbox.
	MagicLinkTTL time.Duration

	// ShutdownTimeout bounds graceful shutdown.
	ShutdownTimeout time.Duration

	// MaxConcurrentBuilds is the install-wide admission ceiling. It is paired
	// with per-container bounds in the build namespace so the count represents
	// a bounded amount of node capacity rather than an arbitrary pod count.
	MaxConcurrentBuilds int32

	// Debug enables verbose logging.
	Debug bool
}