config

type AuthConfig struct {
	// Type is the authentication type: "bearer", "basic", or "header".
	Type string `json:"type" yaml:"type"`

	// Token is used for bearer authentication.
	// Can reference environment variables with ${VAR_NAME} syntax.
	Token string `json:"token" yaml:"token"`

	// Username is used for basic authentication.
	Username string `json:"username" yaml:"username"`

	// Password is used for basic authentication.
	// Can reference environment variables with ${VAR_NAME} syntax.
	Password string `json:"password" yaml:"password"`

	// HeaderName is the custom header name (for type "header").
	HeaderName string `json:"header_name" yaml:"header_name"`

	// HeaderValue is the custom header value (for type "header").
	// Can reference environment variables with ${VAR_NAME} syntax.
	HeaderValue string `json:"header_value" yaml:"header_value"`
}

type Config struct {
	// Listen is the address to listen on (e.g., ":8080", "127.0.0.1:8080").
	Listen string `json:"listen" yaml:"listen"`

	// BaseURL is the public URL where package endpoints are reachable.
	// Used for rewriting package metadata URLs and shown to humans on the
	// install guide so they know what to point their package manager at.
	// Example: "https://proxy.example.com" or "http://localhost:8080"
	BaseURL string `json:"base_url" yaml:"base_url"`

	// UIBaseURL is the public URL where the web UI is reachable. Defaults to
	// BaseURL when unset. Set this separately when the UI is served on a
	// different hostname than the package endpoints — for example, the UI on a
	// public domain behind auth while build machines hit a Docker network alias
	// for the package endpoints.
	// Example: "https://proxy.example.com/ui"
	UIBaseURL string `json:"ui_base_url" yaml:"ui_base_url"`

	// Storage configures artifact storage.
	Storage StorageConfig `json:"storage" yaml:"storage"`

	// Database configures the cache database.
	Database DatabaseConfig `json:"database" yaml:"database"`

	// Log configures logging.
	Log LogConfig `json:"log" yaml:"log"`

	// Upstream configures upstream registry URLs (optional overrides).
	Upstream UpstreamConfig `json:"upstream" yaml:"upstream"`

	// Cooldown configures version age filtering to mitigate supply chain attacks.
	Cooldown CooldownConfig `json:"cooldown" yaml:"cooldown"`

	// CacheMetadata enables caching of upstream metadata responses for offline fallback.
	// When enabled, metadata is stored in the database and storage backend.
	// The mirror command always enables this regardless of this setting.
	CacheMetadata bool `json:"cache_metadata" yaml:"cache_metadata"`

	// MetadataTTL is how long cached metadata is considered fresh before
	// revalidating with upstream. Uses Go duration syntax (e.g. "5m", "1h").
	// Default: "5m". Set to "0" to always revalidate.
	MetadataTTL string `json:"metadata_ttl" yaml:"metadata_ttl"`

	// MetadataMaxSize is the maximum size of an upstream metadata response
	// the proxy will buffer (e.g. "100MB", "250MB"). Responses over this
	// size return ErrMetadataTooLarge. Default: "100MB".
	MetadataMaxSize string `json:"metadata_max_size" yaml:"metadata_max_size"`

	// HTTPTimeout is the timeout for individual upstream HTTP requests made
	// by protocol handlers (metadata fetches, pass-through file requests).
	// Uses Go duration syntax (e.g. "30s", "2m"). Default: "30s".
	// Set to "0" to disable the timeout entirely.
	HTTPTimeout string `json:"http_timeout" yaml:"http_timeout"`

	// MirrorAPI enables the /api/mirror endpoints for starting mirror jobs via HTTP.
	// Disabled by default to prevent unauthenticated users from triggering downloads.
	MirrorAPI bool `json:"mirror_api" yaml:"mirror_api"`

	// Gradle configures Gradle HttpBuildCache behavior.
	Gradle GradleConfig `json:"gradle" yaml:"gradle"`

	// Health configures the /health endpoint behavior.
	Health HealthConfig `json:"health" yaml:"health"`
}

type CooldownConfig struct {
	// Default is the global default cooldown (e.g., "3d", "48h", "0" to disable).
	Default string `json:"default" yaml:"default"`

	// Ecosystems overrides the default for specific ecosystems.
	Ecosystems map[string]string `json:"ecosystems" yaml:"ecosystems"`

	// Packages overrides the cooldown for specific packages (keyed by PURL).
	// Valid PURL keys are normalized to canonical form before use.
	Packages map[string]string `json:"packages" yaml:"packages"`
}

type DatabaseConfig struct {
	// Driver is the database driver: "sqlite" or "postgres".
	Driver string `json:"driver" yaml:"driver"`

	// Path is the path to the SQLite database file.
	Path string `json:"path" yaml:"path"`

	// URL is the PostgreSQL connection string.
	URL string `json:"url" yaml:"url"`
}

type GradleBuildCacheConfig struct {
	// ReadOnly disables PUT uploads and keeps cache reads (GET/HEAD) enabled.
	ReadOnly bool `json:"read_only" yaml:"read_only"`

	// MaxUploadSize caps a single PUT body size (e.g., "100MB"). Must be > 0.
	// Default: "100MB".
	MaxUploadSize string `json:"max_upload_size" yaml:"max_upload_size"`

	// MaxAge evicts entries older than this duration (e.g., "24h", "7d").
	// Empty or "0" disables age-based eviction.
	MaxAge string `json:"max_age" yaml:"max_age"`

	// MaxSize evicts oldest entries until total Gradle cache size is <= MaxSize.
	// Empty or "0" disables size-based eviction.
	MaxSize string `json:"max_size" yaml:"max_size"`

	// SweepInterval controls periodic eviction frequency.
	// Default: "10m".
	SweepInterval string `json:"sweep_interval" yaml:"sweep_interval"`
}

type GradleConfig struct {
	// BuildCache configures the /gradle HttpBuildCache endpoint.
	BuildCache GradleBuildCacheConfig `json:"build_cache" yaml:"build_cache"`
}

type HealthConfig struct {
	// StorageProbeInterval is the minimum time between storage backend probes.
	// Uses Go duration syntax (e.g. "30s", "1m"). Default: "30s".
	// Set to "0" to probe on every /health request (useful for low-traffic deployments).
	StorageProbeInterval string `json:"storage_probe_interval" yaml:"storage_probe_interval"`
}

type LogConfig struct {
	// Level is the minimum log level: "debug", "info", "warn", "error".
	Level string `json:"level" yaml:"level"`

	// Format is the log format: "text" or "json".
	Format string `json:"format" yaml:"format"`
}

type StorageConfig struct {
	// URL is the storage backend URL.
	// Supported schemes:
	//   - file:///path/to/dir - Local filesystem (default)
	//   - s3://bucket-name - Amazon S3
	//   - s3://bucket?endpoint=http://localhost:9000 - S3-compatible (MinIO)
	// If empty, defaults to file:// with the Path value.
	URL string `json:"url" yaml:"url"`

	// Path is the directory where cached artifacts are stored.
	// If URL is empty, this is used as file://{Path}.
	//
	// Deprecated: Use URL with file:// scheme instead.
	Path string `json:"path" yaml:"path"`

	// MaxSize is the maximum cache size (e.g., "10GB", "500MB").
	// When exceeded, least recently used artifacts are evicted.
	// Empty or "0" means unlimited.
	MaxSize string `json:"max_size" yaml:"max_size"`

	// DirectServe enables redirecting cached artifact downloads to presigned
	// storage URLs (HTTP 302) instead of streaming bytes through the proxy.
	// Only effective for backends that support URL signing (S3, Azure).
	DirectServe bool `json:"direct_serve" yaml:"direct_serve"`

	// DirectServeTTL is how long presigned URLs remain valid.
	// Uses Go duration syntax (e.g. "5m", "1h"). Default: "15m".
	DirectServeTTL string `json:"direct_serve_ttl" yaml:"direct_serve_ttl"`

	// DirectServeBaseURL overrides the scheme and host of presigned URLs
	// before returning them to clients. Useful when the proxy reaches
	// storage at an internal address (e.g. 127.0.0.1 or a Docker hostname)
	// but clients must use a public one.
	DirectServeBaseURL string `json:"direct_serve_base_url" yaml:"direct_serve_base_url"`
}

type UpstreamConfig struct {
	// NPM is the upstream npm registry URL.
	// Default: https://registry.npmjs.org
	NPM string `json:"npm" yaml:"npm"`

	// Maven is the upstream Maven repository URL.
	// Default: https://repo1.maven.org/maven2
	Maven string `json:"maven" yaml:"maven"`

	// GradlePluginPortal is the upstream Gradle Plugin Portal Maven URL.
	// Used to resolve Gradle plugin marker artifacts.
	// Default: https://plugins.gradle.org/m2
	GradlePluginPortal string `json:"gradle_plugin_portal" yaml:"gradle_plugin_portal"`

	// Cargo is the upstream cargo index URL.
	// Default: https://index.crates.io
	Cargo string `json:"cargo" yaml:"cargo"`

	// CargoDownload is the upstream cargo download URL.
	// Default: https://static.crates.io/crates
	CargoDownload string `json:"cargo_download" yaml:"cargo_download"`

	// Auth configures authentication for upstream registries.
	// Keys are URL prefixes that are matched against request URLs.
	// Example: "https://npm.pkg.github.com" matches all requests to that host.
	Auth map[string]AuthConfig `json:"auth" yaml:"auth"`
}