models

type Agent struct {
	Address string    `json:"addr"`
	TLS     *AgentTLS `json:"tls,omitempty"`

	// MonitoringDisabled, when true, turns off the agent's CPU/RAM/network/
	// peer metrics collection (see Service.SetServerMonitoring). Zero value
	// (false) keeps monitoring enabled, matching the agent's own default.
	MonitoringDisabled bool `json:"monitoringDisabled,omitempty"`

	// ProfilingEnabled mirrors MonitoringDisabled for the agent's Go runtime
	// profiling (the /debug/pprof endpoints, see Service.SetServerProfiling).
	// Off by default; when true the admin has turned the agent's profiling on
	// and SyncServer re-applies it after a redeploy (the agent starts with
	// profiling off). Surfaced on the dashboard as an icon by the server name.
	ProfilingEnabled bool `json:"profilingEnabled,omitempty"`
}

type AgentReleaseAsset struct {
	// Name is the release-relative asset filename, e.g.
	// "awg-agent-userspace_linux_amd64".
	Name string `json:"name"`
	// Version is the release version: the agent/v* tag with the "agent/" prefix
	// stripped, e.g. "v1.0.0".
	Version string `json:"version"`
	// Arch is the target CPU architecture parsed from the asset name
	// ("amd64"/"arm64"), or "" if it couldn't be determined.
	Arch string `json:"arch"`
	// Userspace is true for the userspace agent binary (awg-agent-userspace),
	// false for the kernel one (awg-agent). It maps straight onto
	// AgentSource.Userspace so a source created from this asset skips (or keeps)
	// the AmneziaWG kernel-module pre-check on deploy correctly.
	Userspace bool `json:"userspace"`
	// URL is the asset's direct download URL (GitHub's browser_download_url).
	URL string `json:"url"`
	// Size is the asset size in bytes.
	Size int64 `json:"size"`
	// PublishedAt is the owning release's publish time (RFC3339), for display
	// and ordering in the picker.
	PublishedAt string `json:"publishedAt"`
}

type AgentSource struct {
	ID   uuid.UUID `json:"id"`
	Name string    `json:"name"`
	URL  string    `json:"url,omitempty"`
	// Path, when set instead of URL, is a path to the agent binary already
	// present on the filesystem of the machine running awg-admin (desktop:
	// the user's own machine; standalone server: that server's host) — read
	// directly and uploaded over SSH the same way a CacheLocally URL preset
	// is, without ever downloading anything. Exactly one of URL or Path is
	// set; CacheLocally is meaningless here (there's nothing to cache) and
	// is always false for a Path-based source.
	Path string `json:"path,omitempty"`
	// CacheLocally, when false (the default), has the *managed server*
	// download URL itself over SSH (curl/wget — see internal/sshclient's
	// DownloadFile) so the binary's bytes never pass through the machine
	// running awg-admin. When true, awg-admin downloads URL once into a
	// local cache (keyed by ID) and uploads it the traditional way on
	// every deploy that uses this source — for servers without outbound
	// internet access to URL, at the cost of awg-admin's own bandwidth.
	CacheLocally bool `json:"cacheLocally,omitempty"`
	// Image, when set instead of URL/Path, is a Docker image reference (e.g.
	// ghcr.io/ks-tool/awg-agent-userspace:latest). Deploying such a source runs
	// the agent as a Docker container on the server (see deploy.ToAgent's docker
	// path) rather than as a systemd unit — for hosts using the userspace
	// amneziawg-go image. Exactly one of URL, Path or Image is set; CacheLocally
	// is meaningless here (Docker pulls the image itself) and is always false.
	Image string `json:"image,omitempty"`
	// Userspace marks a URL/Path source as the *userspace* agent binary
	// (awg-agent-userspace), which runs over systemd with no kernel module. The
	// systemd deploy then skips its AmneziaWG-kernel-module pre-check (which
	// otherwise fails fast, as it must for the kernel agent — see
	// deploy.deploySystemd). Meaningless for an Image source (a Docker image is
	// inherently the userspace agent) — always false there.
	Userspace bool `json:"userspace,omitempty"`
}

type AgentStatus string

type AgentTLS struct {
	CA     CertKeyPair `json:"ca"`
	Server CertKeyPair `json:"server"`
	Client CertKeyPair `json:"client"`
}

type AuthCredentials struct {
	Username string `json:"username"`
	// PasswordHash is a bcrypt hash, never the plaintext password.
	PasswordHash string `json:"passwordHash"`
	// BasicAuthEnabled gates the standalone web server behind HTTP Basic
	// Auth (checked against this same Username/PasswordHash) in addition
	// to the existing session-cookie login — off by default. Useful as an
	// extra layer in front of the whole app (including the login page and
	// static assets) when exposing it directly without a reverse proxy.
	BasicAuthEnabled bool `json:"basicAuthEnabled,omitempty"`
}

type CertKeyPair struct {
	Certificate string `json:"cert"`
	PrivateKey  string `json:"pk"`
}

type DeployStatus struct {
	// Step is one of internal/deploy.ToAgent's step-name keys ("connect",
	// "upload_binary", "upload_unit", "upload_env", "upload_tls",
	// "start_service") — deliberately not human-readable text, so the
	// frontend localizes it itself rather than displaying whatever
	// language the backend happens to log in.
	Step string `json:"step"`
	Done bool   `json:"done"`
	// Error is the deploy's final error message, set only once Done is
	// true and the deploy failed.
	Error string `json:"error,omitempty"`
}

type Interface struct {
	ID uuid.UUID `json:"id"`

	// json:",inline" flattens the fields under jsonv2 (this module builds with
	// GOEXPERIMENT=jsonv2), matching the YAML "inline" convention. tstype
	// additionally tells tygo to emit "extends InterfaceConfig" on the
	// generated TS type instead of a nested field — tygo only understands
	// plain v1 json tag semantics and doesn't infer this on its own.
	agentmodels.InterfaceConfig `json:",inline" tstype:",extends"`

	// Sync status of this interface's config against the agent. Updated
	// after every push attempt (see internal/service's agent push wiring);
	// not touched by the agent itself.
	InSync        bool      `json:"inSync"`
	LastSyncError string    `json:"lastSyncError,omitempty"`
	LastSyncedAt  time.Time `json:"lastSyncedAt,omitempty"`

	// Tunnel groups the interfaces that together form one multi-hop tunnel
	// (see Service.BuildTunnel / the tunnel wizard): every interface a tunnel
	// is built from carries the same id, nil means "not part of any tunnel".
	// Admin-only bookkeeping — never pushed to the agent (only the embedded
	// InterfaceConfig is), not shown or editable in the UI. Its only visible
	// effects: it blocks deleting the interface while the tunnel exists, and
	// the dashboard counts distinct tunnel ids.
	Tunnel *uuid.UUID `json:"tunnel,omitempty"`
}

type Peer struct {
	Name        string          `json:"name"`
	PrivateKey  agentmodels.Key `json:"pk"`
	InterfaceId uuid.UUID       `json:"interface"`
	Disabled    bool            `json:"disabled,omitempty"`
	// DNS is the client-side DNS for this peer's generated wg-quick config
	// (the `[Interface] DNS = …` line). Admin-only: it's never pushed to the
	// agent (DNS is a client setting). Empty falls back to the owning
	// interface's DNS in GetPeerConfig.
	DNS []string `json:"dns,omitempty"`
}

type SSHConfig struct {
	Host string `json:"host"`
	Port uint16 `json:"port,omitempty"`
	User string `json:"user,omitempty"`
	// Key is a path to the private key file on the machine running awg-admin,
	// not the key body itself. Mutually exclusive with KeyData; KeyData takes
	// precedence when both are set (see internal/sshclient).
	Key string `json:"key,omitempty"`
	// KeyData holds an uploaded private key's raw PEM content, stored
	// directly in the database instead of referencing a path on disk.
	KeyData  string `json:"keyData,omitempty"`
	Password string `json:"password,omitempty"`
}

type Server struct {
	ID   uuid.UUID  `json:"id"`
	Name string     `json:"name"`
	Info ServerInfo `json:"info"`

	SSH   SSHConfig `json:"ssh"`
	Agent Agent     `json:"agent"`

	Interfaces []uuid.UUID `json:"interfaces,omitempty"`
}

type ServerInfo struct {
	Description string   `json:"description,omitempty"`
	Location    string   `json:"location,omitempty"`
	Tags        []string `json:"tags,omitempty"`
}

type Tunnel struct {
	ID      uuid.UUID      `json:"id"`
	Members []TunnelMember `json:"members"`
}

type TunnelMember struct {
	ServerID   uuid.UUID `json:"serverId"`
	ServerName string    `json:"serverName"`
	IfaceID    uuid.UUID `json:"ifaceId"`
	Interface  string    `json:"interface"`
	Role       string    `json:"role"`
}

type TunnelStep struct {
	ServerID uuid.UUID `json:"serverId"`
	IfaceID  uuid.UUID `json:"ifaceId"`
}

type User struct {
	ID          uuid.UUID `json:"id"`
	Name        string    `json:"name"`
	Description string    `json:"description,omitempty"`
	Disabled    bool      `json:"disabled,omitempty"`
	Peers       []Peer    `json:"peers,omitempty"`
}