config

type ConsoleValues struct {
	Host string
	Port int
	// DatabaseURL is the server's Postgres connection string; never echoed.
	DatabaseURL string
	// PublicURL is the console's browser-facing origin; AppURL is the app's,
	// used in invite and member reset links.
	PublicURL       string
	AppURL          string
	InsecureCookies bool
	// Google is the console's own OAuth client, with its callback on PublicURL.
	Google         Google
	AuthRateLimit  bool
	ClientIPHeader string
}

type FetcherValues struct {
	ServerURL      string
	Secret         string
	Mirrors        string
	DiskLimitBytes int64
	Concurrency    int
}

type GitHub struct {
	AppID          int64  `json:"appId"`
	ClientID       string `json:"clientId"`
	PrivateKeyFile string `json:"privateKeyFile"`
	PublicURL      string `json:"publicUrl"`
	ClientSecret   string `json:"-"`
	WebhookSecret  string `json:"-"`
	TokenKey       string `json:"-"`
	// FetcherSecret authenticates diffx-fetcher on the internal listener.
	FetcherSecret string `json:"-"`
}

type Google struct {
	ClientID     string `json:"clientId"`
	ClientSecret string `json:"-"`
}

type LocalValues struct {
	Host          string `json:"host"`
	Port          *int   `json:"port"`
	State         string `json:"state"`
	WebDir        string `json:"webDir"`
	RetentionDays int    `json:"retentionDays"`
}

type RemoteValues struct {
	URL   string `json:"url"`
	Token string `json:"token"`
}

type ServerSettings struct {
	Host          string `json:"host"`
	Port          int    `json:"port"`
	State         string `json:"state"`
	WebDir        string `json:"webDir"`
	RetentionDays int    `json:"retentionDays"`
}

type ServerValues struct {
	Host string `json:"host"`
	Port int    `json:"port"`
	// DatabaseURL is the Postgres connection string. It holds credentials, so it
	// comes only from DIFFX_SERVER_DATABASE_URL, never a file or flag, and is never echoed.
	DatabaseURL     string `json:"-"`
	PublicURL       string `json:"publicUrl"`
	InsecureCookies bool   `json:"insecureCookies"`
	RetentionDays   int    `json:"retentionDays"`
	// InternalPort listens beside Port, on the same host, when GitHub is enabled.
	InternalPort int    `json:"internalPort"`
	GitHub       GitHub `json:"github"`
	Google       Google `json:"google"`
	// AuthRateLimit bounds authentication attempts per client IP across
	// replicas. The IP comes from ClientIPHeader, which a trusted ingress must
	// set; both come only from the environment.
	AuthRateLimit  bool   `json:"-"`
	ClientIPHeader string `json:"-"`
}

type Values struct {
	Local  LocalValues  `json:"local"`
	Remote RemoteValues `json:"remote"`
}