link

type Config struct {
	// ConfigPath is the on-disk path to the JSON RuntimeConfig. Its parent dir is
	// watched so in-place updates are picked up without a restart.
	ConfigPath string `envconfig:"GATEWAY_CONFIG_PATH" default:"/etc/gateway/config/config.json"`
	// WGKeyPath is the WireGuard private key path, kept out of the RuntimeConfig so
	// the key Secret and the config ConfigMap rotate independently.
	WGKeyPath string `envconfig:"GATEWAY_WG_KEY_PATH" default:"/etc/gateway/wg/private"`
	// PeerPubKeyPath is the path to the gateway's WireGuard public key.
	PeerPubKeyPath string `envconfig:"GATEWAY_WG_PEER_PUBKEY_PATH" default:"/etc/gateway/wg/peerPublicKey"`
	// HealthAddr is the listen address for the readiness HTTP server.
	HealthAddr string `envconfig:"GATEWAY_HEALTH_ADDR" default:":8080"`
	// ReconcileInterval backstops the fsnotify-driven reload loop in case a
	// filesystem event is missed.
	ReconcileInterval time.Duration `envconfig:"GATEWAY_RECONCILE_INTERVAL" default:"10s"`
	// PodNamespace is the namespace the leader-election Lease lives in. Required
	// because the Lease lock is namespaced and the in-cluster client has no
	// implicit namespace.
	PodNamespace string `envconfig:"POD_NAMESPACE" required:"true"`
	// PodName is this replica's leader-election identity, recorded as the Lease
	// holder. Required and unique per pod.
	PodName string `envconfig:"POD_NAME" required:"true"`
	// LeaseName is the coordination.k8s.io Lease the replicas contend for. Shared
	// across a gateway's replicas so exactly one holds it at a time.
	LeaseName string `envconfig:"GATEWAY_LEASE_NAME" required:"true"`
}

type Forward struct {
	Name       string `json:"name"`
	PublicPort int    `json:"publicPort"`
	// Protocol is tcp or udp; it is lowercased during validation.
	Protocol   string `json:"protocol"`
	Service    string `json:"service"`
	TargetPort int    `json:"targetPort"`
}

type Peer struct {
	// Endpoint is the gateway's public host:port. Optional on disk because the
	// operator's observation of the gateway address may trail the link's start, in
	// which case the reload loop waits for it.
	Endpoint string `json:"endpoint"`
	// AllowedIPs is the set of source ranges accepted from and routed to the peer,
	// typically the wg0 subnet.
	AllowedIPs []string `json:"allowedIPs"`
	// PersistentKeepalive in seconds keeps the NAT pinhole open; 0 disables it.
	PersistentKeepalive int `json:"persistentKeepalive"`
}

type ResolvedForward struct {
	Name       string
	PublicPort int
	Protocol   string
	ClusterIP  string
	TargetPort int
}

type RuntimeConfig struct {
	WireGuard WireGuard `json:"wireguard"`
	Forwards  []Forward `json:"forwards"`
}

type WireGuard struct {
	// Address is the wg0 address in CIDR form (e.g. 10.99.0.2/32).
	Address string `json:"address"`
	// ListenPort is the optional local UDP listen port; 0 picks an ephemeral port.
	ListenPort int `json:"listenPort"`
	// MTU is the optional wg0 MTU; 0 leaves the kernel default.
	MTU  int  `json:"mtu"`
	Peer Peer `json:"peer"`
}