standalone

type ControlPlaneTunables struct {
	// LeaseDuration bounds how long a router lease stays valid.
	LeaseDuration time.Duration
	// KeyRotationInterval is how often the biscuit signing key rotates.
	KeyRotationInterval time.Duration
	// KeyGracePeriod keeps rotated-out keys valid for verification.
	KeyGracePeriod time.Duration
	// SigningKeyPath is the operator's PEM file of signing keys; see
	// controlplane.Options.SigningKeyPath. Empty lets the control plane
	// generate and rotate its own.
	SigningKeyPath string
	// DHTReplication and DHTReprovideInterval are the mesh's directory
	// parameters; see controlplane.Options.
	DHTReplication       int
	DHTReprovideInterval time.Duration
	// BiscuitTTL is the lifespan minted into issued biscuits.
	BiscuitTTL time.Duration
	// WorkloadSessionTTL is how long a workload-issuer enrollment stays
	// refreshable without presenting a fresh platform JWT on /refresh.
	WorkloadSessionTTL time.Duration
	// NodeRetention is how long a node record is kept after its session
	// expired, or after its last refresh for a bootstrap enrollment, before
	// the control plane deletes it.
	NodeRetention time.Duration
	// EphemeralNodeRetention is NodeRetention for a node an ephemeral
	// bootstrap token enrolled.
	EphemeralNodeRetention time.Duration
	// ManualEnrollment queues bootstrap enrollments for admin approval
	// instead of auto-approving them.
	ManualEnrollment bool
}

type Options struct {
	// BindAddress is the host:port of the single public listener. The host
	// must be empty or an IP literal.
	BindAddress string
	// ExternalURL is the public URL nodes reach this server on; it is turned
	// into the ws/wss multiaddr the router advertises. Optional.
	ExternalURL string
	// P2PListen holds optional extra native libp2p listen multiaddrs.
	P2PListen []string
	// DataDir stores the SQLite database, the router identity key and the
	// generated token files.
	DataDir string
	// DBDriver selects "sqlite" (default) or "postgres".
	DBDriver string
	// DBDSN is the database connection string; defaults to
	// <DataDir>/agentmesh.db for sqlite.
	DBDSN string
	// JoinToken is the cluster join token; auto-generated and persisted in
	// DataDir when empty.
	JoinToken string
	// DisableJoinToken runs without any standing join token: devices then
	// enroll only with explicitly minted bootstrap tokens or through OIDC.
	// The right setting for a fleet; the default keeps `agentmesh-node join` on a
	// laptop zero-config.
	DisableJoinToken bool
	// AdminToken protects the admin REST API; auto-generated and persisted in
	// DataDir when empty.
	AdminToken string
	// PolicyFile optionally seeds the mesh policy on first boot from a
	// protojson PolicyConfig payload.
	PolicyFile string
	// OIDCIssuer optionally enables full OIDC enrollment.
	OIDCIssuer       string
	WorkloadIssuer   string
	AllowedAudiences []string
	// OIDCClientID is the OAuth client id advertised via /info.
	OIDCClientID string

	// ControlPlane and Router forward operator tunables to the embedded
	// components; zero values keep each component's defaults.
	ControlPlane ControlPlaneTunables
	Router       RouterTunables
}

type RouterTunables struct {
	// ControlPlaneSyncInterval is how often the router renews its lease and
	// pulls keys, routers, bans and policy from the control plane.
	ControlPlaneSyncInterval time.Duration
	// LowWaterMark / HighWaterMark bound the connection manager.
	LowWaterMark  int
	HighWaterMark int
	// ConnsPerSourceIP scales libp2p's per-source-IP budgets; defaults to
	// the connection manager high watermark (proxied deployments share
	// source IPs, so the global cap should be what binds).
	ConnsPerSourceIP int
	// RelayLimitDuration / RelayLimitData cap each relayed connection.
	RelayLimitDuration time.Duration
	RelayLimitData     router.ByteSize
	// ShutdownLeaseTTL is the lease the embedded router asks for as it stops;
	// see router.Options.ShutdownLeaseTTL.
	ShutdownLeaseTTL time.Duration
	// AuthDeadline closes inbound connections that do not pass the handshake
	// in time; see router.Options.AuthDeadline.
	AuthDeadline time.Duration
	// DisallowLoopback stops advertising loopback addresses (useful on
	// public deployments; the default keeps local development working).
	DisallowLoopback bool
}

type Server struct {
	// contains filtered or unexported fields
}