config

type Config struct {
	DatabaseURL          string `show:"redact"`
	BindPort             string
	BindHost             string
	Env                  string
	EncryptionMasterKey  string `show:"redact"`
	BasePath             string
	BaseURL              string
	FrontendMode         string
	ViteDevURL           string
	JWTSecret            string `show:"redact"`
	JWTIssuer            string
	JWTAccessTTLMin      int
	JWTRefreshTTLHour    int
	OAuthRedirectBase    string `key:"oauth_redirect_base"`
	GoogleClientID       string
	GoogleClientSecret   string `show:"redact"`
	GithubClientID       string
	GithubClientSecret   string `show:"redact"`
	KeycloakClientID     string
	KeycloakClientSecret string `show:"redact"`
	// Unlike Google's, a self-hosted issuer is not a constant: it carries the
	// deployment's host, port and realm, so discovery has nowhere to look
	// without it.
	KeycloakIssuerURL  string
	WebAuthnRPID       string `key:"webauthn_rp_id"`
	WebAuthnRPOrigin   string `key:"webauthn_rp_origin"`
	WebAuthnRPName     string `key:"webauthn_rp_name"`
	CORSAllowedOrigins string `key:"cors_allowed_origins"`

	TrustedProxyCIDRs string `key:"trusted_proxy_cidrs"`
	SMTPHost          string
	SMTPPort          int
	SMTPUser          string `show:"redact"`
	SMTPPassword      string `show:"redact"`
	SMTPFrom          string

	ProvisionerDatabaseURL string `show:"redact"`
	// DatabasePrefix names each tenant provisioned from now on: its database is
	// <prefix>_<org uuid> and its role <prefix>_role_<org uuid>. Unset, it is
	// "tenant". Existing tenants keep the name they were given, so it is safe to
	// change.
	DatabasePrefix string

	TenantPoolMaxSize            int
	TenantPoolMaxConns           int
	TenantPoolMaxIdleConns       int
	TenantPoolConnMaxIdleMin     int
	TenantPoolConnMaxLifetimeMin int
	TenantPoolEvictGraceSec      int

	OrgsMaxTotal      int
	OrgsMaxNewPerHour int

	AuthSocialLinkByEmail     bool
	AuthSeedPublicDomainRules bool

	AdmissionUnprovenOrgsPerDomain int
	AdmissionProvenDistinctDays    int
	AdmissionProvingIntervalHours  int
	AdmissionCohortIntervalHours   int
	AdmissionCohortMinSample       int
	AdmissionCohortProvenRatio     float64

	// FleetObservationMaxAge is how stale a capacity sync may be and still support
	// a decision that a hypervisor is empty.
	//
	// It gates a destructive step: a departure acts on "this node has no guests" by
	// dismantling the node's cluster membership. Past this age the drain state is
	// reported as unknown and the departure is refused rather than guessed at.
	FleetObservationMaxAge time.Duration

	// FleetCapacitySyncInterval is how often every hive's capacity is refreshed.
	//
	// It must be comfortably SHORTER than FleetObservationMaxAge. The drain state
	// reads an observation older than that max age as unknown and refuses the
	// departure, so a sync interval at or above it makes every departure refuse
	// most of the time — the gate working exactly as designed against a fleet
	// nobody is observing often enough.
	FleetCapacitySyncInterval time.Duration

	// FleetOnboardingTickInterval is how often pending machines are claimed and
	// handed to an onboarding worker.
	//
	// It is the LATENCY an operator sees between asking for a machine to be
	// onboarded and anything happening, so it is short. It costs one query per
	// organization per tick and nothing else when there is no work — the tick
	// claims and enqueues, and does no SSH of its own.
	FleetOnboardingTickInterval time.Duration
}