config

type AccessLogConfig struct {
	// Path is the file to append activity records to. Empty disables the access log.
	Path string `json:"path" yaml:"path"`
}

type AuthConfig struct {
	// Type is the authentication type: "bearer", "basic", "header", or "ecr".
	Type string `json:"type" yaml:"type"`

	// Token is used for bearer authentication.
	// Can reference environment variables with ${VAR_NAME} syntax.
	Token string `json:"token" yaml:"token"`

	// Username is used for basic authentication.
	Username string `json:"username" yaml:"username"`

	// Password is used for basic authentication.
	// Can reference environment variables with ${VAR_NAME} syntax.
	Password string `json:"password" yaml:"password"`

	// HeaderName is the custom header name (for type "header").
	HeaderName string `json:"header_name" yaml:"header_name"`

	// HeaderValue is the custom header value (for type "header").
	// Can reference environment variables with ${VAR_NAME} syntax.
	HeaderValue string `json:"header_value" yaml:"header_value"`

	// Region is the AWS region for ECR authentication (for type "ecr").
	// If empty, the region is inferred from private ECR registry URLs before
	// falling back to the AWS SDK default region chain.
	Region string `json:"region" yaml:"region"`
}

type Config struct {
	// Listen is the address to listen on (e.g., ":8080", "127.0.0.1:8080").
	Listen string `json:"listen" yaml:"listen"`

	// BaseURL is the public URL where package endpoints are reachable.
	// Used for rewriting package metadata URLs and shown to humans on the
	// install guide so they know what to point their package manager at.
	// Example: "https://proxy.example.com" or "http://localhost:8080"
	BaseURL string `json:"base_url" yaml:"base_url"`

	// UIBaseURL is the public URL where the web UI is reachable. Defaults to
	// BaseURL when unset. Set this separately when the UI is served on a
	// different hostname than the package endpoints — for example, the UI on a
	// public domain behind auth while build machines hit a Docker network alias
	// for the package endpoints.
	// Example: "https://proxy.example.com/ui"
	UIBaseURL string `json:"ui_base_url" yaml:"ui_base_url"`

	// Storage configures artifact storage.
	Storage StorageConfig `json:"storage" yaml:"storage"`

	// Database configures the cache database.
	Database DatabaseConfig `json:"database" yaml:"database"`

	// Log configures logging.
	Log LogConfig `json:"log" yaml:"log"`

	// AccessLog configures the JSONL activity log.
	AccessLog AccessLogConfig `json:"access_log" yaml:"access_log"`

	// Upstream configures upstream registry URLs (optional overrides).
	Upstream UpstreamConfig `json:"upstream" yaml:"upstream"`

	// Cooldown configures version age filtering to mitigate supply chain attacks.
	Cooldown CooldownConfig `json:"cooldown" yaml:"cooldown"`

	// Scanning configures pre-cache artifact scanning (trivy, ClamAV, Wiz,
	// or a custom service) to mitigate supply chain attacks.
	Scanning ScanningConfig `json:"scanning" yaml:"scanning"`

	// CacheMetadata enables caching of upstream metadata responses for offline fallback.
	// When enabled, metadata is stored in the database and storage backend.
	// The mirror command always enables this regardless of this setting.
	CacheMetadata bool `json:"cache_metadata" yaml:"cache_metadata"`

	// MetadataTTL is how long cached metadata is considered fresh before
	// revalidating with upstream. Uses Go duration syntax (e.g. "5m", "1h").
	// Default: "5m". Set to "0" to always revalidate.
	MetadataTTL string `json:"metadata_ttl" yaml:"metadata_ttl"`

	// MetadataMaxSize is the maximum size of an upstream metadata response
	// the proxy will buffer (e.g. "100MB", "250MB"). Responses over this
	// size return ErrMetadataTooLarge. Default: "100MB".
	MetadataMaxSize string `json:"metadata_max_size" yaml:"metadata_max_size"`

	// HTTPTimeout is the timeout for individual upstream HTTP requests made
	// by protocol handlers (metadata fetches, pass-through file requests).
	// Uses Go duration syntax (e.g. "30s", "2m"). Default: "30s".
	// Set to "0" to disable the timeout entirely.
	HTTPTimeout string `json:"http_timeout" yaml:"http_timeout"`

	// MirrorAPI enables the /api/mirror endpoints for starting mirror jobs via HTTP.
	// Disabled by default to prevent unauthenticated users from triggering downloads.
	MirrorAPI bool `json:"mirror_api" yaml:"mirror_api"`

	// Gradle configures Gradle HttpBuildCache behavior.
	Gradle GradleConfig `json:"gradle" yaml:"gradle"`

	// Health configures the /health endpoint behavior.
	Health HealthConfig `json:"health" yaml:"health"`
}

type CooldownConfig struct {
	// Default is the global default cooldown (e.g., "3d", "48h", "0" to disable).
	Default string `json:"default" yaml:"default"`

	// Ecosystems overrides the default for specific ecosystems.
	Ecosystems map[string]string `json:"ecosystems" yaml:"ecosystems"`

	// Packages overrides the cooldown for specific packages (keyed by PURL).
	// Valid PURL keys are normalized to canonical form before use.
	Packages map[string]string `json:"packages" yaml:"packages"`
}

type DatabaseConfig struct {
	// Driver is the database driver: "sqlite" or "postgres".
	Driver string `json:"driver" yaml:"driver"`

	// Path is the path to the SQLite database file.
	Path string `json:"path" yaml:"path"`

	// URL is the PostgreSQL connection string.
	URL string `json:"url" yaml:"url"`
}

type GradleBuildCacheConfig struct {
	// ReadOnly disables PUT uploads and keeps cache reads (GET/HEAD) enabled.
	ReadOnly bool `json:"read_only" yaml:"read_only"`

	// MaxUploadSize caps a single PUT body size (e.g., "100MB"). Must be > 0.
	// Default: "100MB".
	MaxUploadSize string `json:"max_upload_size" yaml:"max_upload_size"`

	// MaxAge evicts entries older than this duration (e.g., "24h", "7d").
	// Empty or "0" disables age-based eviction.
	MaxAge string `json:"max_age" yaml:"max_age"`

	// MaxSize evicts oldest entries until total Gradle cache size is <= MaxSize.
	// Empty or "0" disables size-based eviction.
	MaxSize string `json:"max_size" yaml:"max_size"`

	// SweepInterval controls periodic eviction frequency.
	// Default: "10m".
	SweepInterval string `json:"sweep_interval" yaml:"sweep_interval"`
}

type GradleConfig struct {
	// BuildCache configures the /gradle HttpBuildCache endpoint.
	BuildCache GradleBuildCacheConfig `json:"build_cache" yaml:"build_cache"`
}

type HealthConfig struct {
	// StorageProbeInterval is the minimum time between storage backend probes.
	// Uses Go duration syntax (e.g. "30s", "1m"). Default: "30s".
	// Set to "0" to probe on every /health request (useful for low-traffic deployments).
	StorageProbeInterval string `json:"storage_probe_interval" yaml:"storage_probe_interval"`
}

type LogConfig struct {
	// Level is the minimum log level: "debug", "info", "warn", "error".
	Level string `json:"level" yaml:"level"`

	// Format is the log format: "text" or "json".
	Format string `json:"format" yaml:"format"`
}

type ScannerConfig struct {
	// Name identifies this scanner in logs and metrics.
	Name string `json:"name" yaml:"name"`

	// URL is the endpoint the proxy POSTs scan notifications to.
	URL string `json:"url" yaml:"url"`

	// Mode is "block" (default) or "monitor". A "block" scanner's verdict
	// can prevent caching; a "monitor" scanner's findings are logged but
	// never gate caching.
	Mode string `json:"mode" yaml:"mode"`

	// Ecosystems restricts this scanner to specific ecosystems (e.g.
	// "npm", "pypi"). Empty means all ecosystems.
	Ecosystems []string `json:"ecosystems" yaml:"ecosystems"`

	// Headers are additional HTTP headers sent with every scan request
	// (e.g. for authenticating to the scanner service). Values support
	// ${VAR_NAME} expansion like AuthConfig fields.
	Headers map[string]string `json:"headers" yaml:"headers"`
}

type ScanningConfig struct {
	// Enabled turns on the scan gate. When false (default), artifacts are
	// cached exactly as if scanning didn't exist.
	Enabled bool `json:"enabled" yaml:"enabled"`

	// FailOpen treats scanner errors and timeouts as an allow verdict
	// instead of a block. Default is fail-closed, since the default
	// posture for a security gate should block on infrastructure failure.
	FailOpen bool `json:"fail_open" yaml:"fail_open"`

	// Timeout bounds each scan call. Uses Go duration syntax (e.g. "30s").
	// Default: "30s".
	Timeout string `json:"timeout" yaml:"timeout"`

	// SigningKey authenticates pull requests to the internal scan-fetch
	// route used by every storage backend. Required whenever Enabled is
	// true. Supports ${VAR_NAME} expansion like AuthConfig fields.
	SigningKey string `json:"signing_key" yaml:"signing_key"`

	// FetchBaseURL is the address scanners use to reach this proxy to pull
	// staged artifacts. Defaults to BaseURL. Set this separately when
	// scanners reach the proxy over an internal address different from the
	// public-facing BaseURL (mirrors DirectServeBaseURL/UIBaseURL).
	FetchBaseURL string `json:"fetch_base_url" yaml:"fetch_base_url"`

	// Scanners is the list of external scanning services to call.
	Scanners []ScannerConfig `json:"scanners" yaml:"scanners"`
}

type StorageConfig struct {
	// URL is the storage backend URL.
	// Supported schemes:
	//   - file:///path/to/dir - Local filesystem (default)
	//   - s3://bucket-name - Amazon S3
	//   - s3://bucket?endpoint=http://localhost:9000 - S3-compatible (MinIO)
	//   - gs://bucket-name - Google Cloud Storage (Workload Identity supported)
	//   - azblob://container-name - Azure Blob Storage
	// If empty, defaults to file:// with the Path value.
	URL string `json:"url" yaml:"url"`

	// Path is the directory where cached artifacts are stored.
	// If URL is empty, this is used as file://{Path}.
	//
	// Deprecated: Use URL with file:// scheme instead.
	Path string `json:"path" yaml:"path"`

	// MaxSize is the maximum cache size (e.g., "10GB", "500MB").
	// When exceeded, least recently used artifacts are evicted.
	// Empty or "0" means unlimited.
	MaxSize string `json:"max_size" yaml:"max_size"`

	// DirectServe enables redirecting cached artifact downloads to presigned
	// storage URLs (HTTP 302) instead of streaming bytes through the proxy.
	// Only effective for backends that support URL signing (S3, GCS, Azure).
	DirectServe bool `json:"direct_serve" yaml:"direct_serve"`

	// DirectServeTTL is how long presigned URLs remain valid.
	// Uses Go duration syntax (e.g. "5m", "1h"). Default: "15m".
	DirectServeTTL string `json:"direct_serve_ttl" yaml:"direct_serve_ttl"`

	// DirectServeBaseURL overrides the scheme and host of presigned URLs
	// before returning them to clients. Useful when the proxy reaches
	// storage at an internal address (e.g. 127.0.0.1 or a Docker hostname)
	// but clients must use a public one.
	DirectServeBaseURL string `json:"direct_serve_base_url" yaml:"direct_serve_base_url"`
}

type UpstreamConfig struct {
	// AllowPrivateHosts permits listed upstream hosts to resolve to private addresses.
	AllowPrivateHosts []string `json:"allow_private_hosts" yaml:"allow_private_hosts"`

	// AllowLoopback permits upstream requests and redirects to loopback addresses.
	AllowLoopback bool `json:"allow_loopback" yaml:"allow_loopback"`

	// NPM is the upstream npm registry URL.
	// Default: https://registry.npmjs.org
	NPM string `json:"npm" yaml:"npm"`

	// NPMFullMetadata always requests the full packument (application/json)
	// from the npm upstream, so served metadata carries the "time" map even
	// when cooldown is disabled. Clients that gate on publish age (for
	// example Yarn's npmMinimalAgeGate) need this.
	// Default: false (the abbreviated format is preferred).
	NPMFullMetadata bool `json:"npm_full_metadata" yaml:"npm_full_metadata"`

	// Cargo is the upstream cargo index URL.
	// Default: https://index.crates.io
	Cargo string `json:"cargo" yaml:"cargo"`

	// CargoDownload is the upstream cargo download URL.
	// Default: https://static.crates.io/crates
	CargoDownload string `json:"cargo_download" yaml:"cargo_download"`

	// Gem is the upstream RubyGems registry URL.
	// Default: https://rubygems.org
	Gem string `json:"gem" yaml:"gem"`

	// Go is the upstream Go module proxy URL.
	// Default: https://proxy.golang.org
	Go string `json:"go" yaml:"go"`

	// Hex is the upstream Hex repository URL.
	// Default: https://repo.hex.pm
	Hex string `json:"hex" yaml:"hex"`

	// HexAPI is the upstream Hex API URL used for package timestamps.
	// Default: https://hex.pm
	HexAPI string `json:"hex_api" yaml:"hex_api"`

	// Pub is the upstream pub registry URL.
	// Default: https://pub.dev
	Pub string `json:"pub" yaml:"pub"`

	// PyPI is the upstream PyPI index and API URL.
	// Default: https://pypi.org
	PyPI string `json:"pypi" yaml:"pypi"`

	// PyPIDownload is the upstream PyPI package download URL.
	// Default: https://files.pythonhosted.org
	PyPIDownload string `json:"pypi_download" yaml:"pypi_download"`

	// Maven is the upstream Maven repository URL.
	// Default: https://repo1.maven.org/maven2
	Maven string `json:"maven" yaml:"maven"`

	// GradlePluginPortal is the upstream Gradle Plugin Portal Maven URL.
	// Used to resolve Gradle plugin marker artifacts.
	// Default: https://plugins.gradle.org/m2
	GradlePluginPortal string `json:"gradle_plugin_portal" yaml:"gradle_plugin_portal"`

	// NuGet is the upstream NuGet API URL.
	// Default: https://api.nuget.org
	NuGet string `json:"nuget" yaml:"nuget"`

	// NuGetSearch is the upstream NuGet search API URL.
	// Default: https://azuresearch-usnc.nuget.org
	NuGetSearch string `json:"nuget_search" yaml:"nuget_search"`

	// Composer is the upstream Packagist API URL.
	// Default: https://packagist.org
	Composer string `json:"composer" yaml:"composer"`

	// ComposerRepository is the upstream Packagist repository URL.
	// Default: https://repo.packagist.org
	ComposerRepository string `json:"composer_repository" yaml:"composer_repository"`

	// Conan is the upstream Conan registry URL.
	// Default: https://center.conan.io
	Conan string `json:"conan" yaml:"conan"`

	// Conda is the upstream Conda channel base URL.
	// Default: https://conda.anaconda.org
	Conda string `json:"conda" yaml:"conda"`

	// CRAN is the upstream CRAN mirror URL.
	// Default: https://cloud.r-project.org
	CRAN string `json:"cran" yaml:"cran"`

	// Julia is the upstream Julia package server URL.
	// Default: https://pkg.julialang.org
	Julia string `json:"julia" yaml:"julia"`

	// OCIDefault is the default upstream OCI registry URL.
	// Default: https://registry-1.docker.io
	OCIDefault string `json:"oci_default" yaml:"oci_default"`

	// Swift is the upstream Swift Package Registry URL.
	// Default: https://tuist.dev/api/registry/swift
	Swift string `json:"swift" yaml:"swift"`

	// Debian is the upstream APT repository base URL.
	// Example: http://archive.ubuntu.com/ubuntu would get Ubuntu.
	// Default: http://deb.debian.org/debian
	Debian string `json:"debian" yaml:"debian"`

	// RPM is the upstream RPM repository base URL.
	// Default: https://dl.fedoraproject.org/pub/fedora/linux
	RPM string `json:"rpm" yaml:"rpm"`

	// HomebrewAPI is the upstream Homebrew JSON API URL.
	// Default: https://formulae.brew.sh/api
	HomebrewAPI string `json:"homebrew_api" yaml:"homebrew_api"`

	// HomebrewArtifact is the upstream registry URL for Homebrew artifacts.
	// Default: https://ghcr.io
	HomebrewArtifact string `json:"homebrew_artifact" yaml:"homebrew_artifact"`

	// Helm maps repository names to HTTP Helm chart repository URLs.
	// Requests use /helm/{name}/index.yaml and chart URLs in the index are
	// rewritten to the same named proxy endpoint.
	Helm map[string]string `json:"helm" yaml:"helm"`

	// APK maps repository names to Alpine APK repository base URLs, served
	// at /apk/{name}/. The remaining request path mirrors the upstream
	// layout, e.g. /apk/alpine/v3.22/main/x86_64/APKINDEX.tar.gz.
	// Default when empty: {"alpine": "https://dl-cdn.alpinelinux.org/alpine"}.
	APK map[string]string `json:"apk" yaml:"apk"`

	// OCI maps names to OCI registry URLs. Requests to a named registry use
	// the repository prefix upstream/{name}/, for example
	// oci://proxy.example.com/upstream/ghcr/owner/chart.
	OCI map[string]string `json:"oci" yaml:"oci"`

	// Generic maps names to plain HTTP upstream base URLs, served at
	// /generic/{name}/. The remaining request path and query string are
	// appended to the upstream URL. GitHub release asset paths
	// ({owner}/{repo}/releases/download/{tag}/{asset}) are cached in the
	// artifact cache; everything else goes through the metadata cache.
	// Example: {"github": "https://github.com", "github-api": "https://api.github.com"}.
	Generic map[string]string `json:"generic" yaml:"generic"`

	// Auth configures authentication for upstream registries.
	// Keys are absolute URL scopes matched by scheme, host, effective port,
	// and path-segment prefix.
	// Example: "https://npm.pkg.github.com" matches all requests to that host.
	Auth map[string]AuthConfig `json:"auth" yaml:"auth"`
}