configgen

type AdvancedUnsafeRoute struct {
	Route string
	Via   string
}

type FirewallRule struct {
	Port      string // "any", "22", "443"
	Proto     string // "any", "tcp", "udp", "icmp"
	Group     string // "any", "admin", etc.
	Cidr      string // "", "any", "10.0.0.0/24" — remote (peer) address
	LocalCidr string // "", "any", "10.0.0.0/24" — local address
}

type GeneratorInput struct {
	HostName         string
	NebulaIPs        []string
	IsLighthouse     bool
	IsRelay          bool
	CACertPath       string
	CertPath         string
	KeyPath          string
	ListenPort       int
	Lighthouses      []LighthouseInfo
	Relays           []string
	FirewallInbound  []FirewallRule
	FirewallOutbound []FirewallRule
	// HostFirewallInbound holds per-host inbound rules appended after the
	// network-wide FirewallInbound policy in the rendered config.
	HostFirewallInbound []FirewallRule
	Mobile              *MobileProfile

	// Optional per-host overrides. Zero values mean "use the default".
	PunchyOverride *bool
	// PunchyRespondOverride maps to punchy.respond. Nil leaves Nebula's own
	// default (false) in place, so an unset override renders as before.
	PunchyRespondOverride *bool
	ListenHost            string
	MTU                   int
	TunDevice             string
	UnsafeRoutes          []AdvancedUnsafeRoute

	// Optional inline PEM blocks. When CACertPEM is non-empty, CertPEM and
	// KeyPEM must also be non-empty; all three are emitted as literal-block
	// scalars in the pki section. When empty, the path-based fields above
	// are used instead. Mobile Nebula clients use the inline form since
	// they import a self-contained YAML config.
	CACertPEM string
	CertPEM   string
	KeyPEM    string

	// Blocklist is the per-CA list of revoked certificate fingerprints.
	// Emitted as pki.blocklist in config.yml so the Nebula daemon rejects
	// handshakes from revoked peers (GHSA-cm26-5974-52h8).
	Blocklist []string
}

type LighthouseInfo struct {
	NebulaIPs  []string
	PublicAddr string // "1.2.3.4:4242"
}

type MobileProfile struct {
	DNSResolvers        []string
	MatchDomains        []string
	AllowPrivateRemotes bool
}