tls

type ACMEConfig struct {
	// Type selects the ACME challenge mechanism: ACMEChallengeTLSALPN01 or
	// ACMEChallengeDNS01. An absent/empty Type (the zero value) defaults to
	// ACMEChallengeTLSALPN01, so callers who only need TLS-ALPN-01 can omit
	// this field entirely.
	Type string `mapstructure:"type" json:",omitempty"`

	Email          string `mapstructure:"email" json:",omitempty"`
	DirectoryURL   string `mapstructure:"directory-url" json:",omitempty"`
	CacheDirectory string `mapstructure:"cache-directory" json:",omitempty"`

	// Domains is, for Type=dns-01, the SANs to include on the single
	// certificate obtained upfront (may include wildcards, e.g.
	// "*.example.com"); for Type=tls-alpn-01 (default), the whitelist of
	// hosts autocert will provision certificates for on demand via
	// autocert.HostWhitelist. Wildcard entries are rejected for
	// tls-alpn-01 - TLS-ALPN-01 cannot validate wildcard identifiers (RFC
	// 8555 permits wildcards only via dns-01), and autocert's HostWhitelist
	// silently ignores such entries rather than erroring, so
	// NewACMETLSConfig validates this upfront instead.
	Domains []string `mapstructure:"domains" json:",omitempty"`

	// DNS01 holds fields that apply only when Type is ACMEChallengeDNS01.
	DNS01 DNS01Options `mapstructure:"dns01,squash" json:",omitzero"`
}

type CertificateSubject struct {
	Country            []string `mapstructure:"c" json:"country,omitzero"`
	Organization       []string `mapstructure:"o" json:"organization,omitzero"`
	OrganizationalUnit []string `mapstructure:"ou" json:"organizational_unit,omitzero"`
	Locality           []string `mapstructure:"l" json:"locality,omitzero"`
	Province           []string `mapstructure:"st" json:"province,omitzero"`
	StreetAddress      []string `mapstructure:"street" json:"street_address,omitzero"`
	PostalCode         []string `mapstructure:"postalcode" json:"postal_code,omitzero"`
	SerialNumber       string   `mapstructure:"serialnumber" json:"serial_number,omitzero"`
	CommonName         string   `mapstructure:"cn" json:"common_name,omitzero"`
}

type ClientConfig struct {
	RootCAFile         string `mapstructure:"root-ca-file" json:",omitempty"`
	Certificate        string `mapstructure:"cert" json:",omitempty"`
	Key                string `mapstructure:"key" json:",omitempty"`
	InsecureSkipVerify bool   `mapstructure:"insecure-skip-verify"`
}

type ConfigFunc func() (*tls.Config, error)

type DNS01Options struct {
	// PropagationTimeout bounds how long lego waits for DNS propagation of
	// the challenge TXT record. Zero uses lego's default (60s).
	PropagationTimeout time.Duration `mapstructure:"dns01-propagation-timeout" json:",omitempty"`

	// PollingInterval controls how often lego polls while waiting for
	// propagation. Zero uses lego's default (2s).
	PollingInterval time.Duration `mapstructure:"dns01-polling-interval" json:",omitempty"`

	// Provider performs Present/CleanUp of the ACME dns-01 challenge TXT
	// record. Must be set programmatically; it is not config-decodable.
	Provider challenge.Provider `mapstructure:"-" json:"-"`
}

type FileWaitConfig struct {
	WaitInterval uint `mapstructure:"file-wait-interval" json:",omitzero"`
	WaitMax      uint `mapstructure:"file-wait-max" json:",omitzero"`
}

type LocalConfig struct {
	SinglePEMFile string         `mapstructure:"single-pem-file" json:",omitzero"`
	Certificate   string         `mapstructure:"cert" json:",omitzero"`
	Key           string         `mapstructure:"key" json:",omitzero"`
	FileWait      FileWaitConfig `mapstructure:"file-wait,squash" json:",omitzero"`
}

type SANConfig struct {
	DNSNames    []string `mapstructure:"dns-names" json:"dns_names,omitzero"`
	IPAddresses []string `mapstructure:"ip-addresses" json:"ip_addresses,omitzero"`
}

type SelfSignedConfig struct {
	Subject        CertificateSubject `mapstructure:"subject" json:"subject"`
	SAN            SANConfig          `mapstructure:"san" json:"san"`
	Duration       string             `mapstructure:"duration" json:"duration,omitzero"`
	IsCA           bool               `mapstructure:"ca" json:"is_ca,omitzero"`
	Bits           int                `mapstructure:"bits" json:"bits,omitzero"`
	CacheDirectory string             `mapstructure:"cache-directory" json:"cache_directory,omitzero"`
	Alias          string             `mapstructure:"alias" json:"alias,omitzero"`
}

type ServerConfig struct {
	ServerName string `json:"server_name,omitzero" mapstructure:"server-name"`

	ACME ACMEConfig `json:"acme" mapstructure:"acme"`

	SelfSigned SelfSignedConfig `json:"self_signed" mapstructure:"self-signed"`

	LocalConfig LocalConfig `json:"local" mapstructure:"local"`

	ClientAuthType string `mapstructure:"client-auth-type" json:"client_auth_type,omitzero"`
	ClientCAFile   string `mapstructure:"client-ca-file" json:"client_ca_file,omitzero"`

	NextProtos    []string `json:"next_protos,omitzero" mapstructure:"next-protos"`
	TLSMinVersion string   `json:"tls_min_version,omitzero" mapstructure:"tls-min-version"`
}