standalone

type ControlPlaneTunables struct {
	// LeaseDuration bounds how long a router lease stays valid.
	LeaseDuration time.Duration
	// KeyRotationInterval is how often the biscuit signing key rotates.
	KeyRotationInterval time.Duration
	// KeyGracePeriod keeps rotated-out keys valid for verification.
	KeyGracePeriod time.Duration
	// BiscuitTTL is the lifespan minted into issued biscuits.
	BiscuitTTL time.Duration
	// ManualEnrollment queues bootstrap enrollments for admin approval
	// instead of auto-approving them.
	ManualEnrollment bool
}

type Options struct {
	// BindAddress is the host:port of the single public listener. The host
	// must be empty or an IP literal.
	BindAddress string
	// ExternalURL is the public URL nodes reach this server on; it is turned
	// into the ws/wss multiaddr the router advertises. Optional.
	ExternalURL string
	// P2PListen holds optional extra native libp2p listen multiaddrs.
	P2PListen []string
	// DataDir stores the SQLite database, the router identity key and the
	// generated token files.
	DataDir string
	// DBDriver selects "sqlite" (default) or "postgres".
	DBDriver string
	// DBDSN is the database connection string; defaults to
	// <DataDir>/sam.db for sqlite.
	DBDSN string
	// JoinToken is the cluster join token; auto-generated and persisted in
	// DataDir when empty.
	JoinToken string
	// DisableJoinToken runs without any standing join token: devices then
	// enroll only with explicitly minted bootstrap tokens or through OIDC.
	// The right setting for a fleet; the default keeps `sam-node join` on a
	// laptop zero-config.
	DisableJoinToken bool
	// AdminToken protects the admin REST API; auto-generated and persisted in
	// DataDir when empty.
	AdminToken string
	// PolicyFile optionally seeds the mesh policy on first boot from a
	// protojson PolicyConfigUpdateRequest payload.
	PolicyFile string
	// OIDCIssuer optionally enables full OIDC enrollment.
	OIDCIssuer       string
	AllowedAudiences []string
	// OIDCClientID is the OAuth client id advertised via /info.
	OIDCClientID string

	// ControlPlane and Router forward operator tunables to the embedded
	// components; zero values keep each component's defaults.
	ControlPlane ControlPlaneTunables
	Router       RouterTunables
}

type RouterTunables struct {
	// KeysSyncInterval is how often biscuit public keys are refreshed.
	KeysSyncInterval time.Duration
	// LeaseRenewInterval is how often the router renews its lease.
	LeaseRenewInterval time.Duration
	// LowWaterMark / HighWaterMark bound the connection manager.
	LowWaterMark  int
	HighWaterMark int
	// ConnsPerSourceIP scales libp2p's per-source-IP budgets; defaults to
	// the connection manager high watermark (proxied deployments share
	// source IPs, so the global cap should be what binds).
	ConnsPerSourceIP int
	// DHTProviderAddrTTL / DHTMaxRecordAge tune DHT record lifetimes.
	DHTProviderAddrTTL time.Duration
	DHTMaxRecordAge    time.Duration
	// DisallowLoopback stops advertising loopback addresses (useful on
	// public deployments; the default keeps local development working).
	DisallowLoopback bool
}

type Server struct {
	// contains filtered or unexported fields
}