config

type Config struct {
	// Git
	RepoURL              string
	Branch               string
	PollInterval         time.Duration
	HCLDir               string
	GitToken             string
	GitSSHKeyPath        string
	GitSSHKeyPass        string
	GitSSHKnownHostsFile string

	// Nomad
	NomadAddr      string
	NomadToken     string
	NomadNamespace string

	// NomadTokenFile is a path to a file containing a Nomad ACL token SecretID,
	// re-read periodically so a rotating token stays current. Use it for a real
	// SecretID written to a file (e.g. by a sidecar). Note: this must be a
	// 36-char ACL SecretID, not a workload-identity JWT — a raw WI JWT is
	// rejected by Nomad's Job.Plan RPC (see NomadLoginAuthMethod).
	NomadTokenFile string
	// NomadTokenPollInterval is how often the token file is re-read for changes.
	NomadTokenPollInterval time.Duration

	// NomadLoginAuthMethod, when set, enables Nomad workload-identity login: the
	// identity JWT (NomadLoginJWTFile) is exchanged for a real ACL token via
	// POST /v1/acl/login against this JWT auth method, and re-exchanged before
	// it expires. This is the working way to use workload identity — a raw WI
	// JWT authenticates read RPCs but is rejected by Job.Plan, which
	// nomad-gitops needs for every drift check (issue #74).
	NomadLoginAuthMethod string
	// NomadLoginJWTFile is the path to the workload-identity JWT to exchange.
	// Defaults to ${NOMAD_SECRETS_DIR}/nomad_token; point it at a named
	// identity's file (nomad_<name>.jwt) when the auth method's audience does
	// not match the default identity.
	NomadLoginJWTFile string

	// Server
	ListenAddr    string
	WebhookSecret string
	WebhookPath   string
	APIKey        string // PSK for /api/ endpoints; empty disables the API

	// Diff
	DiffInterval    time.Duration
	IncludeDeadJobs bool
	RedactSecrets   bool

	// Apply (GitOps mutation)
	DefaultUpdatePolicy string
	EnableJobCreation   bool
	ApplyInterval       time.Duration

	// Managed-meta-only changes: a diff confined to nomad-gitops's own
	// meta keys (e.g. gitops_managed). By default these neither trigger an
	// update nor count as drift; the keys converge opportunistically on the
	// next real update.
	ApplyMetaOnlyChanges bool
	CountMetaOnlyChanges bool

	// ApplyExistingDrift controls whether drift that already existed when a
	// change widened a job's scope is applied. Scope widens two ways, treated
	// the same: a job gains the managed meta tag (enablement), or its update
	// policy is widened to cover drift it was deferring (e.g. image-only → full).
	// Off by default: a scope change does not retroactively mutate the job; only
	// changes committed after it apply.
	ApplyExistingDrift bool

	// Deregistration of jobs removed from the repo (file deleted or job
	// renamed). Off by default; the one destructive write nomad-gitops can
	// make, so heavily gated.
	EnableDeregister bool
	DeregisterPurge  bool
	DeregisterGrace  time.Duration

	// FlapGuard controls how nomad-gitops avoids re-applying a job spec that
	// a recent Nomad job version already failed to deploy (the
	// apply→fail→revert→re-apply loop). One of: history (Approach A: compare
	// spec fingerprints against Nomad's in-cluster version history, ephemeral
	// and GC-bounded), tag (Approach B: additionally tag the failed version so
	// the block survives version GC), or off (disabled). Per-job overridable
	// via the <prefix>_flap_guard meta key. Only applies to deployment-producing
	// jobs (service jobs with an update stanza and health checks).
	FlapGuard string

	// AllowRollback enables active rollback: for managed deployment-producing
	// jobs whose update stanza does not set auto_revert, nomad-gitops reverts
	// the job to its last stable version when a deployment fails. Off by
	// default. Per-job overridable via the <prefix>_rollback meta key. Where a
	// job's update stanza sets auto_revert=true, Nomad's own rollback always
	// wins and nomad-gitops stands down.
	AllowRollback bool

	// Job selection. Git is always the source of truth for nomad-gitops's
	// own meta keys: when a job has an HCL file in the repo, that file alone
	// decides selection and policy. There is deliberately no flag to invert
	// this.
	JobSelectorGlob   string
	ManagedMetaPrefix string

	// Staleness
	MaxGitStaleness   time.Duration
	MaxNomadStaleness time.Duration

	// Logging
	LogLevel string
}