bootstrap

type App struct {
	// contains filtered or unexported fields
}

type Config struct {

	// HTTPPort is the port the API server listens on (default: 8080).
	HTTPPort int

	// DatabaseURL is the Postgres connection string (required).
	DatabaseURL string

	// LogLevel controls the minimum log severity: debug, info, warn, error.
	LogLevel string

	// CORSAllowedOrigins is the list of allowed CORS origins.
	// An empty list permits all origins (development mode).
	CORSAllowedOrigins []string

	// OIDCAuthority is the OIDC provider issuer URL used for JWT verification.
	OIDCAuthority string

	// OIDCClientID is the expected audience claim in incoming JWTs.
	OIDCClientID string

	// IntrospectURL is the OAuth2 token introspection endpoint (RFC 7662).
	IntrospectURL string

	// IntrospectClientID is the OAuth2 client ID for introspection requests.
	IntrospectClientID string

	// IntrospectClientSecret is the OAuth2 client secret for introspection.
	IntrospectClientSecret string

	// JWKSUri is the OIDC JWKS endpoint for JWT signature verification.
	JWKSUri string

	// CrateRegistryURL is the base URL of the crate registry.
	// Default: https://raw.githubusercontent.com/kleffio/crate-registry/main
	// For local dev, use: file:///absolute/path/to/crate-registry
	CrateRegistryURL string

	// RuntimeProvider selects the container runtime for plugin management.
	// Values: "docker" (default), "kubernetes", "manual".
	RuntimeProvider string

	// PluginRegistryURL overrides the plugin catalog URL.
	// Default: https://raw.githubusercontent.com/kleff/plugin-registry/main/plugins.json
	PluginRegistryURL string

	// PluginNetwork is the Docker network plugins are attached to (default: "kleff").
	PluginNetwork string

	// PluginGRPCPort is the port plugins listen on inside their container (default: 50051).
	PluginGRPCPort int

	// PluginRegistryTTL is the seconds between catalog re-fetches (default: 3600).
	PluginRegistryTTL int

	// PluginNamespace is the k8s namespace for plugin Deployments (default: "kleff").
	PluginNamespace string

	// SecretKey is the AES-256 key (any length; hashed with SHA-256) for
	// encrypting plugin secrets at rest. Required in production.
	SecretKey string

	// CompanionEnv holds env vars to inject into every companion container.
	// Populated from COMPANION_* env vars on the API: COMPANION_SMTP_HOST → SMTP_HOST.
	// Manifest-declared env vars take precedence over these globals.
	CompanionEnv map[string]string
}

type Container struct {
	Config        *Config
	Logger        *slog.Logger
	DB            *sql.DB
	TokenVerifier middleware.TokenVerifier
	// Plugin manager — owns all plugin lifecycle and gRPC connections.
	PluginManager *pluginapplication.Manager

	// HTTP handler groups per domain module
	AuthHandler          *pluginhttp.AuthHandler
	SetupHandler         *pluginhttp.SetupHandler
	CatalogHandler       *cataloghttp.Handler
	OrganizationsHandler *organizationshttp.Handler
	DeploymentsHandler   *deploymentshttp.Handler
	NodesHandler         *nodeshttp.Handler
	BillingHandler       *billinghttp.Handler
	UsageHandler         *usagehttp.Handler
	AuditHandler         *audithttp.Handler
	AdminHandler         *adminhttp.Handler
	PluginsHandler       *pluginhttp.Handler
}