config

type AgentConfig struct {
	ServerURL        string        `yaml:"server_url"`
	DataDir          string        `yaml:"data_dir"`
	SigningKeyPath   string        `yaml:"signing_key_path"`
	PollInterval     time.Duration `yaml:"poll_interval"`
	NebulaConfigPath string        `yaml:"nebula_config_path"`
	NebulaCAPath     string        `yaml:"nebula_ca_path,omitempty"`
	NebulaCertPath   string        `yaml:"nebula_cert_path,omitempty"`
	NebulaKeyPath    string        `yaml:"nebula_key_path,omitempty"`
	ImportSessionID  string        `yaml:"import_session_id,omitempty"`
	NebulaPIDFile    string        `yaml:"nebula_pid_file"`

	// NebulaReloadCommand, when set, is run through the system shell after
	// config/cert changes instead of sending SIGHUP to nebula_pid_file
	// (which it takes precedence over). Lets operators hook their service
	// manager (e.g. "systemctl reload nebula") and gives Windows — where
	// SIGHUP does not exist — a working reload path.
	NebulaReloadCommand string `yaml:"nebula_reload_command,omitempty"`

	// AllowInsecureHTTP opts out of the https-required guard on server_url.
	// Without it a plaintext http:// URL is only accepted for loopback
	// hosts — over any other network the enrollment token, certificates,
	// and the Nebula config the agent installs would transit in cleartext,
	// where an on-path attacker can steal the token or inject a malicious
	// config. Mirrors the server's allow_insecure_http (#179).
	AllowInsecureHTTP bool `yaml:"allow_insecure_http,omitempty"`
}

type AlertsConfig struct {
	Enabled           bool   `yaml:"enabled,omitempty"`
	Interval          string `yaml:"interval,omitempty"`
	Threshold         string `yaml:"threshold,omitempty"`
	WebhookURL        string `yaml:"webhook_url,omitempty"`
	WebhookHMACSecret string `yaml:"webhook_hmac_secret,omitempty"`

	// AllowPrivateWebhook permits webhook_url to point at a loopback/private/
	// link-local address. Default false rejects such targets at startup as an
	// SSRF guard (#188); set true for an intentional internal sink (e.g. a
	// co-located Alertmanager).
	AllowPrivateWebhook bool `yaml:"allow_private_webhook,omitempty"`
}

type CAAutoRotateConfig struct {
	Enabled   bool          `yaml:"enabled,omitempty"`
	Interval  time.Duration `yaml:"interval,omitempty"`
	Threshold float64       `yaml:"threshold,omitempty"`
}

type CAImportConfig struct {
	MaxArgon2MemoryKiB   uint32 `yaml:"max_argon2_memory_kib,omitempty"`
	MaxArgon2Iterations  uint32 `yaml:"max_argon2_iterations,omitempty"`
	MaxArgon2Parallelism uint8  `yaml:"max_argon2_parallelism,omitempty"`
}

type MetricsConfig struct {
	// Prometheus is a pointer so an unset value (yaml omitted) is treated
	// as the default (true). A user setting `prometheus: false` cleanly
	// disables the exporter.
	Prometheus *bool `yaml:"prometheus,omitempty"`

	// RequireAuth gates the /metrics endpoint behind the same bearer auth as
	// the API (#187). It is a pointer so an unset value (yaml omitted) takes
	// the default (true, #262): the metric labels expose host/network/CA IDs
	// and operational counters, so unauthenticated scraping is opt-in. Set
	// `require_auth: false` to allow it on a trusted network.
	RequireAuth *bool `yaml:"require_auth,omitempty"`
}

type OIDCConfig struct {
	Enabled       bool     `yaml:"enabled"`
	Issuer        string   `yaml:"issuer"`
	ClientID      string   `yaml:"client_id"`
	ClientSecret  string   `yaml:"client_secret"`
	RedirectURL   string   `yaml:"redirect_url"`
	Scopes        []string `yaml:"scopes,omitempty"`
	UsernameClaim string   `yaml:"username_claim,omitempty"` // default "preferred_username"
	NameClaim     string   `yaml:"name_claim,omitempty"`     // default "name"
	GroupsClaim   string   `yaml:"groups_claim,omitempty"`   // default "groups"
	AllowedGroups []string `yaml:"allowed_groups,omitempty"`
	AllowedEmails []string `yaml:"allowed_emails,omitempty"`
	DefaultRole   string   `yaml:"default_role,omitempty"`

	// RequireEmailVerified gates the post-callback email_verified claim
	// check. Pointer-bool to distinguish unset (default true: the IdP
	// must assert email_verified before the address counts toward
	// AllowedEmails) from an explicit `false` opt-out. The explicit
	// opt-out is the escape hatch for legacy IdPs that omit the claim
	// or send it in a shape HandleCallback can't decode (numeric,
	// nested object, etc). emailVerifiedRequired() resolves nil → true.
	RequireEmailVerified *bool `yaml:"require_email_verified,omitempty"`

	// TLSCACert optionally pins the IdP's TLS trust to a PEM CA bundle at this
	// path (#264). When set, OIDC discovery, JWKS fetch, and token exchange use
	// a dedicated HTTP client whose RootCAs is this bundle, so a CA compromise
	// in the system trust store cannot MITM the IdP. Empty = use the system
	// trust store (default). The system store is untouched for every other
	// connection.
	TLSCACert string `yaml:"tls_ca_cert,omitempty"`
}

type PasswordConfig struct {
	MinLength      *int  `yaml:"min_length,omitempty"`
	RequireClasses *int  `yaml:"require_classes,omitempty"`
	BlockCommon    *bool `yaml:"block_common,omitempty"`
	BlockUsername  *bool `yaml:"block_username,omitempty"`
}

type RateLimitConfig struct {
	// Enabled is a pointer so an absent YAML block defaults to "true"
	// (issue #52 requires on-by-default) while still allowing a
	// `rate_limit: { enabled: false }` to disable it.
	Enabled          *bool                           `yaml:"enabled,omitempty"`
	TrustProxyHeader bool                            `yaml:"trust_proxy_header,omitempty"`
	Groups           map[string]RateLimitGroupConfig `yaml:"groups,omitempty"`
}

type RateLimitGroupConfig struct {
	Rate  float64 `yaml:"rate"`
	Burst int     `yaml:"burst"`
}

type ServerConfig struct {
	Listen     string      `yaml:"listen"`
	DataDir    string      `yaml:"data_dir"`
	DBPath     string      `yaml:"db_path"`
	UIPassword string      `yaml:"ui_password,omitempty"`
	LogLevel   string      `yaml:"log_level"`
	TLSCert    string      `yaml:"tls_cert,omitempty"`
	TLSKey     string      `yaml:"tls_key,omitempty"`
	OIDC       *OIDCConfig `yaml:"oidc,omitempty"`

	// AllowInsecureHTTP opts out of the plaintext-HTTP guard (#179). Without
	// TLS, the server only binds a loopback address (safe behind a local
	// reverse proxy); binding a routable address in cleartext is refused
	// unless this is set true (or the --insecure-http flag is passed). Keep
	// it false in production — credentials would otherwise transit in the clear.
	AllowInsecureHTTP bool `yaml:"allow_insecure_http,omitempty"`

	// TrustedSecretIngressProxy allows a local TLS-terminating proxy to mark
	// private-key import requests with X-Forwarded-Proto: https. The request
	// policy additionally requires a loopback listener and peer and a public
	// Host value. The proxy must overwrite, not append, the header.
	TrustedSecretIngressProxy bool `yaml:"trusted_secret_ingress_proxy,omitempty"`

	// CAImport sets resource caps for encrypted CA private-key import.
	CAImport CAImportConfig `yaml:"ca_import,omitempty"`

	// MasterKey is a base64-encoded 32-byte AES-256 key used to wrap
	// per-CA DEKs in the cas table. May be supplied via the
	// NEBULA_MGMT_MASTER_KEY env var instead.
	MasterKey string `yaml:"master_key,omitempty"`

	// AllowSelfRegistration controls whether unauthenticated visitors can
	// create their own operator account through /ui/register. Defaults to
	// false so closed deployments stay closed by default; administrators
	// can still create operators manually via the existing
	// `nebula-mgmt user create` CLI or `POST /api/v1/operators` API.
	AllowSelfRegistration bool `yaml:"allow_self_registration,omitempty"`

	// Metrics configures the optional /metrics Prometheus exporter. Default
	// is "enabled" so out-of-the-box installs can be scraped immediately;
	// air-gapped deployments can set Prometheus=false to drop the route.
	Metrics MetricsConfig `yaml:"metrics,omitempty"`

	// Alerts configures the cert-expiry alerter (see issue #41). Disabled
	// by default — operators must opt in by setting Enabled=true.
	Alerts AlertsConfig `yaml:"alerts,omitempty"`

	// Webhooks configures outbound lifecycle-event delivery (#256). Disabled
	// by default — operators opt in by setting Enabled=true and a URL.
	Webhooks WebhooksConfig `yaml:"webhooks,omitempty"`

	// RateLimit configures the per-IP, per-route-group token-bucket
	// limiter that fronts the Web UI and API (see issue #52). Enabled
	// by default so login + enrolment endpoints are protected from
	// online brute-force out of the box.
	RateLimit RateLimitConfig `yaml:"rate_limit,omitempty"`

	// Password configures the password policy applied to every server-
	// side password-setting path (see issue #48). All knobs are
	// optional: unset values fall back to the production defaults
	// (10-char min, 3-of-4 classes, common-pw + username block on).
	Password PasswordConfig `yaml:"password,omitempty"`

	// EnforceTOTP toggles admin-enforced 2FA (issue #49). When set, the
	// value is written into the server_settings table on startup so it
	// stays in effect across restarts. A nil pointer (unset YAML) leaves
	// the DB value alone — the future Settings UI (#47) will edit the
	// same row at runtime.
	EnforceTOTP *bool `yaml:"enforce_2fa,omitempty"`

	// EnrollmentTokenTTL is the default lifetime applied to freshly minted
	// enrollment tokens (ADR 0004 / #75). Per-network overrides live in
	// the `network_config` table under the `enrollment_token_ttl` key.
	// Empty / unparseable value falls back to 24h.
	EnrollmentTokenTTL string `yaml:"enrollment_token_ttl,omitempty"`

	// CAAutoRotate configures the periodic CA auto-rotation scanner (issue #110).
	// Disabled by default — operators must opt in by setting Enabled=true.
	CAAutoRotate CAAutoRotateConfig `yaml:"ca_auto_rotate,omitempty"`

	// CookieSecure controls the `Secure` attribute on session and OIDC
	// state cookies (GHSA-rqfj-vv8r-xhqc). When unset, the effective
	// value is inferred from the TLS configuration: true if both
	// tls_cert and tls_key are populated, false otherwise. Operators
	// terminating TLS at a reverse proxy must set this to true
	// explicitly — `rate_limit.trust_proxy_header` is not a reliable
	// signal that the proxy speaks TLS to clients.
	CookieSecure *bool `yaml:"cookie_secure,omitempty"`
	// contains filtered or unexported fields
}

type WebhooksConfig struct {
	Enabled      bool     `yaml:"enabled,omitempty"`
	URL          string   `yaml:"url,omitempty"`
	HMACSecret   string   `yaml:"hmac_secret,omitempty"`
	AllowPrivate bool     `yaml:"allow_private,omitempty"`
	Events       []string `yaml:"events,omitempty"`
}