tls

type ACMEConfig struct {
	// Type selects the ACME challenge mechanism: ACMEChallengeTLSALPN01 or
	// ACMEChallengeDNS01. An absent/empty Type (the zero value) defaults to
	// ACMEChallengeTLSALPN01, so callers who only need TLS-ALPN-01 can omit
	// this field entirely.
	Type string `json:"type,omitempty" mapstructure:"type"`

	Email          string `json:"email,omitempty"           mapstructure:"email"`
	DirectoryURL   string `json:"directory_url,omitempty"   mapstructure:"directory-url"`
	CacheDirectory string `json:"cache_directory,omitempty" mapstructure:"cache-directory"`

	// Domains is, for Type=dns-01, the SANs to include on the single
	// certificate obtained upfront (may include wildcards, e.g.
	// "*.example.com"); for Type=tls-alpn-01 (default), the whitelist of
	// hosts autocert will provision certificates for on demand via
	// autocert.HostWhitelist. Wildcard entries are rejected for
	// tls-alpn-01 - TLS-ALPN-01 cannot validate wildcard identifiers (RFC
	// 8555 permits wildcards only via dns-01), and autocert's HostWhitelist
	// silently ignores such entries rather than erroring, so
	// NewACMETLSConfig validates this upfront instead.
	Domains []string `json:"domains,omitempty" mapstructure:"domains"`

	// DNS01 holds fields that apply only when Type is ACMEChallengeDNS01.
	DNS01 DNS01Options `json:"dns01,omitzero" mapstructure:"dns01,squash"`
}

type CertificateSubject struct {
	Country            []string `json:"country,omitzero"             mapstructure:"c"`
	Organization       []string `json:"organization,omitzero"        mapstructure:"o"`
	OrganizationalUnit []string `json:"organizational_unit,omitzero" mapstructure:"ou"`
	Locality           []string `json:"locality,omitzero"            mapstructure:"l"`
	Province           []string `json:"province,omitzero"            mapstructure:"st"`
	StreetAddress      []string `json:"street_address,omitzero"      mapstructure:"street"`
	PostalCode         []string `json:"postal_code,omitzero"         mapstructure:"postalcode"`
	SerialNumber       string   `json:"serial_number,omitzero"       mapstructure:"serialnumber"`
	CommonName         string   `json:"common_name,omitzero"         mapstructure:"cn"`
}

type ClientConfig struct {
	RootCAFile         string `json:"root_ca_file,omitempty"         mapstructure:"root-ca-file"`
	Certificate        string `json:"certificate,omitempty"          mapstructure:"cert"`
	Key                string `json:"key,omitempty"                  mapstructure:"key"`
	InsecureSkipVerify bool   `json:"insecure_skip_verify,omitempty" mapstructure:"insecure-skip-verify"`
}

type ConfigFunc func() (*tls.Config, error)

type DNS01Options struct {
	// PropagationTimeout bounds how long lego waits for DNS propagation of
	// the challenge TXT record. Zero uses lego's default (60s).
	PropagationTimeout time.Duration `json:"propagation_timeout,omitempty" mapstructure:"dns01-propagation-timeout"`

	// PollingInterval controls how often lego polls while waiting for
	// propagation. Zero uses lego's default (2s).
	PollingInterval time.Duration `json:"polling_interval,omitempty" mapstructure:"dns01-polling-interval"`

	// Provider performs Present/CleanUp of the ACME dns-01 challenge TXT
	// record. Must be set programmatically; it is not config-decodable.
	Provider challenge.Provider `json:"-" mapstructure:"-"`
}

type FileWaitConfig struct {
	WaitInterval uint `json:"wait_interval,omitzero" mapstructure:"file-wait-interval"`
	WaitMax      uint `json:"wait_max,omitzero"      mapstructure:"file-wait-max"`
}

type LocalConfig struct {
	SinglePEMFile string         `json:"single_pem_file,omitzero" mapstructure:"single-pem-file"`
	Certificate   string         `json:"certificate,omitzero"     mapstructure:"cert"`
	Key           string         `json:"key,omitzero"             mapstructure:"key"`
	FileWait      FileWaitConfig `json:"file_wait,omitzero"       mapstructure:"file-wait,squash"`
}

type SANConfig struct {
	DNSNames    []string `json:"dns_names,omitzero"    mapstructure:"dns-names"`
	IPAddresses []string `json:"ip_addresses,omitzero" mapstructure:"ip-addresses"`
}

type SelfSignedConfig struct {
	Subject        CertificateSubject `json:"subject"                  mapstructure:"subject"`
	SAN            SANConfig          `json:"san"                      mapstructure:"san"`
	Duration       string             `json:"duration,omitzero"        mapstructure:"duration"`
	IsCA           bool               `json:"is_ca,omitzero"           mapstructure:"ca"`
	Bits           int                `json:"bits,omitzero"            mapstructure:"bits"`
	CacheDirectory string             `json:"cache_directory,omitzero" mapstructure:"cache-directory"`
	Alias          string             `json:"alias,omitzero"           mapstructure:"alias"`
}

type ServerConfig struct {
	ServerName string `json:"server_name,omitzero" mapstructure:"server-name"`

	ACME ACMEConfig `json:"acme" mapstructure:"acme"`

	SelfSigned SelfSignedConfig `json:"self_signed" mapstructure:"self-signed"`

	LocalConfig LocalConfig `json:"local" mapstructure:"local"`

	ClientAuthType string `json:"client_auth_type,omitzero" mapstructure:"client-auth-type"`
	ClientCAFile   string `json:"client_ca_file,omitzero"   mapstructure:"client-ca-file"`

	NextProtos    []string `json:"next_protos,omitzero"     mapstructure:"next-protos"`
	TLSMinVersion string   `json:"tls_min_version,omitzero" mapstructure:"tls-min-version"`
}