configgen

type AdvancedUnsafeRoute struct {
	Route string
	Via   string
}

type FirewallRule struct {
	Port  string // "any", "22", "443"
	Proto string // "any", "tcp", "udp", "icmp"
	Group string // "any", "admin", etc.
}

type GeneratorInput struct {
	HostName         string
	NebulaIPs        []string
	IsLighthouse     bool
	IsRelay          bool
	CACertPath       string
	CertPath         string
	KeyPath          string
	ListenPort       int
	Lighthouses      []LighthouseInfo
	Relays           []string
	FirewallInbound  []FirewallRule
	FirewallOutbound []FirewallRule

	// Optional per-host overrides. Zero values mean "use the default".
	PunchyOverride *bool
	ListenHost     string
	MTU            int
	TunDevice      string
	UnsafeRoutes   []AdvancedUnsafeRoute

	// Optional inline PEM blocks. When CACertPEM is non-empty, CertPEM and
	// KeyPEM must also be non-empty; all three are emitted as literal-block
	// scalars in the pki section. When empty, the path-based fields above
	// are used instead. Mobile Nebula clients use the inline form since
	// they import a self-contained YAML config.
	CACertPEM string
	CertPEM   string
	KeyPEM    string
}

type LighthouseInfo struct {
	NebulaIPs  []string
	PublicAddr string // "1.2.3.4:4242"
}