config

type AuditConfig struct {
	Path string `toml:"path"` // e.g. /data/audit/blockyard.jsonl
}

type BoardStorageConfig struct {
	PostgrestURL string `toml:"postgrest_url"`
}

type Config struct {
	Server       ServerConfig        `toml:"server"`
	Docker       DockerConfig        `toml:"docker"`
	Storage      StorageConfig       `toml:"storage"`
	Database     DatabaseConfig      `toml:"database"`
	Proxy        ProxyConfig         `toml:"proxy"`
	Process      *ProcessConfig      `toml:"process"`       // nil when backend != "process"
	Redis        *RedisConfig        `toml:"redis"`         // nil when not configured
	OIDC         *OidcConfig         `toml:"oidc"`          // nil when not configured
	Openbao      *OpenbaoConfig      `toml:"openbao"`       // nil when not configured
	BoardStorage *BoardStorageConfig `toml:"board_storage"` // nil when not configured
	Audit        *AuditConfig        `toml:"audit"`         // nil when not configured
	Telemetry    *TelemetryConfig    `toml:"telemetry"`     // nil when not configured
	Update       *UpdateConfig       `toml:"update"`        // nil when not configured

	// ConfigPath is the filesystem path to the config file this
	// Config was loaded from. Populated by main.go after Load so the
	// process orchestrator can re-exec the new blockyard with the
	// same --config flag. Not a TOML field — no struct tag.
	ConfigPath string `toml:"-"`
}

type DataMountSource struct {
	Name string `toml:"name"`
	Path string `toml:"path"`
}

type DatabaseConfig struct {
	Driver string `toml:"driver"` // "sqlite" (default) or "postgres"
	Path   string `toml:"path"`   // used when driver = "sqlite"
	URL    string `toml:"url"`    // PostgreSQL connection string; used when driver = "postgres"
}

type DockerConfig struct {
	Socket          string            `toml:"socket"`
	Image           string            `toml:"image"`
	ShinyPort       int               `toml:"shiny_port"`
	PakVersion      string            `toml:"pak_version"`      // "stable" (default), or pinned version
	ServiceNetwork  string            `toml:"service_network"`  // Docker network whose containers are made reachable from workers
	Runtime         string            `toml:"runtime"`          // OCI runtime; empty = Docker daemon default
	RuntimeDefaults map[string]string `toml:"runtime_defaults"` // per-access-type defaults (e.g. public=kata-runtime)

	// Deprecated; copied into the new locations by migrateDeprecatedFields
	// and removed in the next release.
	DeprecatedDefaultMemoryLimit string   `toml:"default_memory_limit"`
	DeprecatedDefaultCPULimit    float64  `toml:"default_cpu_limit"`
	DeprecatedStoreRetention     Duration `toml:"store_retention"`
}

type Duration struct {
	time.Duration
}

type OidcConfig struct {
	IssuerURL          string   `toml:"issuer_url"`
	IssuerDiscoveryURL string   `toml:"issuer_discovery_url"` // optional: use a different URL for OIDC discovery (e.g. Docker-internal DNS)
	ClientID           string   `toml:"client_id"`
	ClientSecret       Secret   `toml:"client_secret"`
	CookieMaxAge       Duration `toml:"cookie_max_age"`
	InitialAdmin       string   `toml:"initial_admin"`
	DefaultRole        string   `toml:"default_role"` // role assigned on first login: "viewer" (default) or "publisher"
}

type OpenbaoConfig struct {
	Address              string          `toml:"address"`
	AdminToken           Secret          `toml:"admin_token"`   // deprecated: use role_id with AppRole auth
	RoleID               string          `toml:"role_id"`       // AppRole role identifier
	TokenTTL             Duration        `toml:"token_ttl"`     // default: 1h
	JWTAuthPath          string          `toml:"jwt_auth_path"` // default: "jwt"
	TokenFile            string          `toml:"token_file"`    // persisted vault token path; default: "/data/.vault-token"
	SkipPolicyScopeCheck bool            `toml:"skip_policy_scope_check"`
	Services             []ServiceConfig `toml:"services"`
}

type ProcessConfig struct {
	BwrapPath      string `toml:"bwrap_path"`             // path to bubblewrap binary
	RPath          string `toml:"r_path"`                 // path to R binary
	SeccompProfile string `toml:"seccomp_profile"`        // path to compiled BPF seccomp profile; empty = no seccomp
	PortRangeStart int    `toml:"port_range_start"`       // first port for workers (inclusive)
	PortRangeEnd   int    `toml:"port_range_end"`         // last port for workers (inclusive)
	WorkerUIDStart int    `toml:"worker_uid_range_start"` // first host UID for workers (inclusive)
	WorkerUIDEnd   int    `toml:"worker_uid_range_end"`   // last host UID for workers (inclusive)
	WorkerGID      int    `toml:"worker_gid"`             // shared host GID for all workers (used by egress firewall rules)
}

type ProxyConfig struct {
	WsCacheTTL         Duration `toml:"ws_cache_ttl"`
	HealthInterval     Duration `toml:"health_interval"`
	WorkerStartTimeout Duration `toml:"worker_start_timeout"`
	MaxWorkers         int      `toml:"max_workers"`
	LogRetention       Duration `toml:"log_retention"`
	SessionIdleTTL     Duration `toml:"session_idle_ttl"`
	IdleWorkerTimeout  Duration `toml:"idle_worker_timeout"`
	HTTPForwardTimeout Duration `toml:"http_forward_timeout"`
	MaxCPULimit        *float64 `toml:"max_cpu_limit"`
	TransferTimeout    Duration `toml:"transfer_timeout"`     // default 60s when unset
	SessionMaxLifetime Duration `toml:"session_max_lifetime"` // 0 = unlimited (default); hard cap on session duration
}

type RedisConfig struct {
	URL       string `toml:"url"`        // redis://[:password@]host:port[/db]
	KeyPrefix string `toml:"key_prefix"` // default: "blockyard:"
}

type Secret struct {
	// contains filtered or unexported fields
}

type SecretResolver interface {
	KVRead(ctx context.Context, path string, token string) (map[string]any, error)
	AdminToken() string
}

type ServerConfig struct {
	Bind               string   `toml:"bind"`
	ManagementBind     string   `toml:"management_bind"` // optional: separate listener for /healthz, /readyz, /metrics
	SessionSecret      *Secret  `toml:"session_secret"`  // required when [oidc] is set
	ExternalURL        string   `toml:"external_url"`
	ShutdownTimeout    Duration `toml:"shutdown_timeout"`
	DrainTimeout       Duration `toml:"drain_timeout"`
	LogLevel           string   `toml:"log_level"`            // debug, info, warn, error (default: info)
	TrustedProxies     []string `toml:"trusted_proxies"`      // CIDRs whose X-Forwarded-For to trust (e.g. ["10.0.0.0/8"])
	Backend            string   `toml:"backend"`              // "docker" (default) or "process"
	SkipPreflight      bool     `toml:"skip_preflight"`       // skip backend-specific preflight checks at startup
	DefaultMemoryLimit string   `toml:"default_memory_limit"` // fallback memory limit for workers (e.g. "2g")
	DefaultCPULimit    float64  `toml:"default_cpu_limit"`    // fallback CPU limit for workers (fractional vCPUs)
	BootstrapToken     string   `toml:"bootstrap_token"`      // dev only: one-time token exchanged for a real PAT via POST /api/v1/bootstrap

	// Deprecated; copied into SkipPreflight by migrateDeprecatedFields and
	// removed in the next release.
	DeprecatedSkipDockerPreflight bool `toml:"skip_docker_preflight"`
}

type ServiceConfig struct {
	ID    string `toml:"id"`
	Label string `toml:"label"`
}

type StorageConfig struct {
	BundleServerPath    string            `toml:"bundle_server_path"`
	BundleWorkerPath    string            `toml:"bundle_worker_path"`
	BundleRetention     int               `toml:"bundle_retention"`
	MaxBundleSize       int64             `toml:"max_bundle_size"`
	SoftDeleteRetention Duration          `toml:"soft_delete_retention"`
	StoreRetention      Duration          `toml:"store_retention"` // R library cache eviction; 0 = disabled
	DataMounts          []DataMountSource `toml:"data_mounts"`
}

type TelemetryConfig struct {
	MetricsEnabled bool   `toml:"metrics_enabled"` // default: false
	OTLPEndpoint   string `toml:"otlp_endpoint"`   // e.g. http://otel-collector:4317
}

type UpdateConfig struct {
	Schedule    string   `toml:"schedule"`     // cron expression; empty = disabled
	Channel     string   `toml:"channel"`      // "stable" (default) or "main"
	WatchPeriod Duration `toml:"watch_period"` // health monitoring after update completes

	// Repo is the GitHub owner/repo to query for releases and the
	// origin/main HEAD comparison (e.g. "cynkra/blockyard"). Empty
	// keeps the upstream default. Operators of forks override this
	// to point the update check at their own repo.
	Repo string `toml:"repo"`

	// AltBindRange is the port range the process orchestrator picks
	// an alternate bind from when spawning the new server during a
	// rolling update. Operator-configured, separate from
	// [process] port_range (worker pool). Default: "8090-8099".
	// Ignored by the Docker variant.
	AltBindRange string `toml:"alt_bind_range"`

	// DrainIdleWait is the maximum time Finish will wait for the
	// local server's session count to reach zero before tearing
	// down. Used by the process orchestrator to let active sessions
	// finish naturally during a rolling-update drain. Default: 5m.
	// Ignored by the Docker variant, which cuts over hard and
	// relies on the reverse proxy to drain in-flight requests.
	DrainIdleWait Duration `toml:"drain_idle_wait"`
}