config

type AuthPolicy struct {
	ID    string   `toml:"id"`
	Users []string `toml:"users,omitempty"` // allowed user IDs (passkey login)
	// Header overrides the identity header name (default x-Gatecrash-User).
	Header string `toml:"header,omitempty"`
	// SecretHash is the bcrypt hash of a machine-generated service secret for
	// non-interactive clients (CI, scripts, webhooks). It is generated server-side
	// and shown once. Clients send it as the HTTP Basic password — by convention
	// with the username "service" (the username is not checked). A service secret
	// grants access INDEPENDENT of the Users list, so it is for trusted automation.
	SecretHash string `toml:"secret_hash,omitempty"`
}

type Config struct {
	Server     ServerConfig `toml:"server"`
	TLS        TLSConfig    `toml:"tls"`
	Update     UpdateConfig `toml:"update"`
	Tunnel     []Tunnel     `toml:"tunnel"`
	Redirect   []Redirect   `toml:"redirect"`
	IPPolicy   []IPPolicy   `toml:"ip_policy"`
	AuthPolicy []AuthPolicy `toml:"auth_policy"`
}

type IPPolicy struct {
	ID          string    `toml:"id"`
	Ranges      []IPRange `toml:"range,omitempty"`
	EnrollToken string    `toml:"enroll_token,omitempty"`
}

type IPRange struct {
	CIDR    string `toml:"cidr" json:"cidr"`
	Comment string `toml:"comment,omitempty" json:"comment,omitempty"`
}

type Redirect struct {
	From         string `toml:"from"`
	To           string `toml:"to"`
	PreservePath bool   `toml:"preserve_path"`
}

type ServerConfig struct {
	Secret    string `toml:"secret"`
	SSHPort   int    `toml:"ssh_port"`
	HTTPSPort int    `toml:"https_port"`
	HTTPPort  int    `toml:"http_port"`
	AdminHost string `toml:"admin_host"`
	BindAddr  string `toml:"bind_addr"`
}

type TLSConfig struct {
	ACMEEmail string `toml:"acme_email"`
	CertDir   string `toml:"cert_dir"`
	Staging   bool   `toml:"staging"`
}

type Tunnel struct {
	ID             string   `toml:"id"`
	Type           string   `toml:"type"`
	Hostnames      []string `toml:"hostnames,omitempty"`
	ListenPort     int      `toml:"listen_port,omitempty"`
	SecretHash     string   `toml:"secret_hash,omitempty"`
	PreserveHost   bool     `toml:"preserve_host,omitempty"`
	TLSPassthrough bool     `toml:"tls_passthrough,omitempty"`
	// IPPolicy / AuthPolicy reference reusable access policies by ID. They are
	// independent gates: when both are set a request must pass both (AND). Auth
	// policies apply to HTTP tunnels only.
	IPPolicy   string `toml:"ip_policy,omitempty"`
	AuthPolicy string `toml:"auth_policy,omitempty"`
}

type UpdateConfig struct {
	Enabled       bool   `toml:"enabled"`
	CheckInterval string `toml:"check_interval"`
	GitHubRepo    string `toml:"github_repo"`
}

type Watcher struct {
	// contains filtered or unexported fields
}