config

type Cache struct {
	Hosts           []string `yaml:"hosts" envconfig:"REDIS_HOSTS"`
	Password        string   `yaml:"password" envconfig:"REDIS_PASSWORD"`
	DB              int      `yaml:"db" envconfig:"REDIS_DB"`
	TTL             int      `yaml:"ttl" envconfig:"DEFAULT_TTL"`
	AllowedStatuses []int    `yaml:"allowed_statuses" envconfig:"CACHE_ALLOWED_STATUSES" split_words:"true"`
	AllowedMethods  []string `yaml:"allowed_methods" envconfig:"CACHE_ALLOWED_METHODS" split_words:"true"`
	// EvictionPolicy - Redis maxmemory-policy applied on connect. One of:
	// noeviction, allkeys-lru, allkeys-lfu, volatile-lru, volatile-lfu,
	// allkeys-random, volatile-random, volatile-ttl. Empty leaves Redis's own
	// default (noeviction) untouched.
	EvictionPolicy string `yaml:"eviction_policy" envconfig:"REDIS_EVICTION_POLICY"`
	// NegativeTTL - Per-status TTL override (in seconds), e.g. {404: 30, 502: 10},
	// to cache error responses briefly and shield the origin without waiting on
	// its (often absent/wrong) Cache-Control headers. YAML-only: envconfig has no
	// clean map[int]int support, unlike the slice fields above.
	NegativeTTL map[int]int `yaml:"negative_ttl"`
	// OverrideTTL - Forced TTL (in seconds) for storable responses, replacing
	// the origin's Expires / max-age / s-maxage and the default TTL. It never
	// makes a response storable, and NegativeTTL wins for its statuses.
	// 0 = off (default); negative values are rejected.
	OverrideTTL int `yaml:"override_ttl" envconfig:"OVERRIDE_TTL"`
}

type Configuration struct {
	Server         Server                        `yaml:"server"`
	Cache          Cache                         `yaml:"cache"`
	CircuitBreaker circuitbreaker.CircuitBreaker `yaml:"circuit_breaker"`
	Domains        Domains                       `yaml:"domains"`
	Log            Log                           `yaml:"log"`
	Tracing        Tracing                       `yaml:"tracing"`

	Jwt Jwt `yaml:"jwt"`
	// contains filtered or unexported fields
}

type DomainSet struct {
	Host   string
	Scheme string
}

type Domains map[string]Configuration

type HSTS struct {
	Enabled           bool `yaml:"enabled" envconfig:"TLS_HSTS_ENABLED"`
	MaxAge            int  `yaml:"max_age" envconfig:"TLS_HSTS_MAX_AGE" default:"31536000"`
	IncludeSubdomains bool `yaml:"include_subdomains" envconfig:"TLS_HSTS_INCLUDE_SUBDOMAINS"`
	Preload           bool `yaml:"preload" envconfig:"TLS_HSTS_PRELOAD"`
}

type HealthCheck struct {
	StatusCodes []string      `yaml:"status_codes" envconfig:"HEALTHCHECK_STATUS_CODES" split_words:"true"`
	Timeout     time.Duration `yaml:"timeout" envconfig:"HEALTHCHECK_TIMEOUT"`
	Interval    time.Duration `yaml:"interval" envconfig:"HEALTHCHECK_INTERVAL"`
	// No defaults on these two: unset has to stay representable, so the
	// balancer can inherit the upstream's scheme and port. Defaulting them to
	// https/443 here probed a plain-HTTP upstream over TLS and failed every
	// check with "server gave HTTP response to HTTPS client".
	Port          string `yaml:"port" envconfig:"HEALTHCHECK_PORT"`
	Scheme        string `yaml:"scheme" envconfig:"HEALTHCHECK_SCHEME"`
	AllowInsecure bool   `yaml:"allow_insecure" envconfig:"HEALTHCHECK_ALLOW_INSECURE"`
}

type Internals struct {
	ListeningAddress string `yaml:"listening_address" envconfig:"INTERNAL_LISTENING_ADDRESS" default:"127.0.0.1"`
	ListeningPort    string `yaml:"listening_port" envconfig:"INTERNAL_LISTENING_PORT" default:"52021"`
}

type Jwt struct {
	ExcludedPaths       []string `yaml:"excluded_paths" envconfig:"JWT_EXCLUDED_PATHS" split_words:"true"`
	AllowedScopes       []string `yaml:"allowed_scopes" envconfig:"JWT_ALLOWED_SCOPES" split_words:"true"`
	JwksUrl             string   `yaml:"jwks_url" envconfig:"JWT_JWKS_URL"`
	JwksRefreshInterval int      `yaml:"jwks_refresh_interval" envconfig:"JWT_REFRESH_INTERVAL" default:"15"`
	JwkCache            *jwk.Cache
	Context             context.Context
	Logger              *logrus.Logger
}

type JwtError struct {
	ErrorCode        string `json:"errorCode"`
	ErrorDescription string `json:"errorDescription"`
}

type Log struct {
	TimeFormat     string `yaml:"time_format"`
	Format         string `yaml:"format"`
	SentryDsn      string `yaml:"sentry_dsn" envconfig:"SENTRY_DSN"`
	SyslogProtocol string `yaml:"syslog_protocol" envconfig:"SYSLOG_PROTOCOL"`
	SyslogEndpoint string `yaml:"syslog_endpoint" envconfig:"SYSLOG_ENDPOINT"`
}

type Port struct {
	HTTPS string `yaml:"https" envconfig:"SERVER_HTTPS_PORT"`
	HTTP  string `yaml:"http" envconfig:"SERVER_HTTP_PORT"`
}

type Purge struct {
	// AllowedIPs - Allowlist of client IPs/CIDRs permitted to issue PURGE. The
	// direct connection IP (RemoteAddr) is checked, not the spoofable
	// X-Forwarded-For header.
	AllowedIPs []string `yaml:"allowed_ips" envconfig:"PURGE_ALLOWED_IPS" split_words:"true"`
	// Secret - Shared secret that must be presented in SecretHeader.
	Secret string `yaml:"secret" envconfig:"PURGE_SECRET"`
	// SecretHeader - HTTP header carrying the shared secret. Defaults to
	// DefaultPurgeSecretHeader when Secret is set but no header is specified.
	SecretHeader string `yaml:"secret_header" envconfig:"PURGE_SECRET_HEADER"`
}

type Server struct {
	Port      Port      `yaml:"port"`
	TLS       TLS       `yaml:"tls"`
	Timeout   Timeout   `yaml:"timeout"`
	Upstream  Upstream  `yaml:"upstream"`
	GZip      bool      `yaml:"gzip" envconfig:"GZIP_ENABLED"`
	Internals Internals `yaml:"internals"`
	Purge     Purge     `yaml:"purge"`
}

type TLS struct {
	Auto     bool        `yaml:"auto" envconfig:"TLS_AUTO_CERT"`
	Email    string      `yaml:"email" envconfig:"TLS_EMAIL"`
	CertFile string      `yaml:"cert_file" envconfig:"TLS_CERT_FILE"`
	KeyFile  string      `yaml:"key_file" envconfig:"TLS_KEY_FILE"`
	Override *tls.Config `yaml:"override"`
	// CertCacheDir - Directory where ACME (Let's Encrypt) certificates are
	// cached. Must be persistent: an ephemeral directory forces re-issuance on
	// every restart, burning through the CA's rate limits.
	CertCacheDir string `yaml:"cert_cache_dir" envconfig:"TLS_CERT_CACHE_DIR"`
	HSTS         HSTS   `yaml:"hsts"`
}

type Timeout struct {
	Read       time.Duration `yaml:"read" envconfig:"TIMEOUT_READ"`
	ReadHeader time.Duration `yaml:"read_header" envconfig:"TIMEOUT_READ_HEADER"`
	Write      time.Duration `yaml:"write" envconfig:"TIMEOUT_WRITE"`
	Idle       time.Duration `yaml:"idle" envconfig:"TIMEOUT_IDLE"`
	Handler    time.Duration `yaml:"handler" envconfig:"TIMEOUT_HANDLER"`
}

type Tracing struct {
	JaegerEndpoint string  `yaml:"jaeger_endpoint" envconfig:"TRACING_JAEGER_ENDPOINT"`
	Enabled        bool    `yaml:"enabled" envconfig:"TRACING_ENABLED"`
	SamplingRatio  float64 `yaml:"sampling_ratio" envconfig:"TRACING_SAMPLING_RATIO" default:"1.0"`
}

type Upstream struct {
	Host               string      `yaml:"host" envconfig:"FORWARD_HOST"`
	Port               string      `yaml:"port" envconfig:"FORWARD_PORT"`
	Scheme             string      `yaml:"scheme" envconfig:"FORWARD_SCHEME"`
	BalancingAlgorithm string      `yaml:"balancing_algorithm" envconfig:"BALANCING_ALGORITHM" default:"round-robin"`
	Endpoints          []string    `yaml:"endpoints" envconfig:"LB_ENDPOINT_LIST" split_words:"true"`
	InsecureBridge     bool        `yaml:"insecure_bridge"`
	HTTP2HTTPS         bool        `yaml:"http_to_https" envconfig:"HTTP2HTTPS"`
	RedirectStatusCode int         `yaml:"redirect_status_code" envconfig:"REDIRECT_STATUS_CODE" default:"301"`
	HealthCheck        HealthCheck `yaml:"health_check"`
	// CollapsedForwarding - Feature flag for collapsed forwarding, off by
	// default. When true, concurrent identical GET/HEAD cache misses are
	// coalesced into a single upstream round-trip.
	CollapsedForwarding bool `yaml:"collapsed_forwarding" envconfig:"COLLAPSED_FORWARDING"`
}