config

type ACMEConfig struct {
	// Email for the ACME account (used for certificate expiration notices).
	Email string `json:"email"`

	// CA directory URL. Defaults to Let's Encrypt production.
	// Shorthand values: "staging" → Let's Encrypt staging,
	//                   "zerossl" → ZeroSSL production.
	CA string `json:"ca,omitempty"`

	// CAs defines fallback certificate authorities, tried in order.
	// When set, CA is ignored and CAs takes precedence.
	CAs []string `json:"cas,omitempty"`

	// Challenge type: "alpn" (TLS-ALPN-01, default), "http" (HTTP-01),
	// or "dns" (DNS-01, required for wildcards).
	Challenge string `json:"challenge,omitempty"`

	// DNS configures the DNS-01 challenge provider.
	// Required when challenge is "dns".
	DNS *ACMEDNSConfig `json:"dns,omitempty"`

	// StorageType selects the storage backend for certificates and ACME
	// account data: "file" (default) or "s3".
	StorageType string `json:"storage_type,omitempty"`

	// Storage path for certificates and ACME account data (file backend).
	// Default: "acme/" directory next to the config file.
	Storage string `json:"storage,omitempty"`

	// S3 configures S3-compatible object storage for ACME data.
	// Required when storage_type is "s3".
	S3 *ACMES3Config `json:"s3,omitempty"`

	// Domains to manage. If empty, domains are auto-discovered
	// from route match.domain patterns in this service.
	Domains []string `json:"domains,omitempty"`
}

type ACMEDNSConfig struct {
	// Provider name: "cloudflare".
	Provider string `json:"provider"`

	// Token is the API token for the DNS provider.
	// If empty, read from the provider's environment variable:
	//   cloudflare → CF_DNS_API_TOKEN
	Token string `json:"token,omitempty"`

	// Discover fetches all domains from the provider account and manages
	// certificates for each zone (zone + *.zone). When enabled, acme.domains
	// and route auto-discovery are ignored.
	Discover bool `json:"discover,omitempty"`

	// Resolvers overrides the default DNS resolvers used for ACME zone
	// detection and challenge propagation checks. This is useful in
	// containerized environments (e.g., Docker) where the default
	// resolver cannot properly return SOA records for certain TLDs.
	// Format: ["1.1.1.1:53", "8.8.8.8:53"]
	Resolvers []string `json:"resolvers,omitempty"`
}

type ACMES3Config struct {
	// Bucket is the S3 bucket name (required).
	Bucket string `json:"bucket"`

	// Region is the AWS region. Default: "us-east-1".
	Region string `json:"region,omitempty"`

	// Endpoint is a custom S3-compatible endpoint URL (e.g., MinIO, Cloudflare R2).
	// When empty, the default AWS S3 endpoint is used.
	Endpoint string `json:"endpoint,omitempty"`

	// AccessKey and SecretKey are static credentials.
	// When empty, the default AWS credential chain is used
	// (environment variables, shared config, IAM role, IMDS).
	AccessKey string `json:"access_key,omitempty"`
	SecretKey string `json:"secret_key,omitempty"`

	// Prefix is the key prefix within the bucket. Default: "" (bucket root).
	// Set to e.g. "acme/" to store under a subdirectory.
	Prefix string `json:"prefix"`

	// UsePathStyle forces path-style addressing (required for MinIO and
	// some S3-compatible providers that don't support virtual-hosted buckets).
	UsePathStyle bool `json:"use_path_style,omitempty"`
}

type Action struct {
	Type      ActionType `json:"type"`
	Plugins   []string   `json:"plugins,omitempty"`
	AccessLog string     `json:"access_log,omitempty"` // "off" to disable, or file path for per-action log

	// Proxy-specific fields.
	Upstream string   `json:"upstream,omitempty"`
	Rewrite  string   `json:"rewrite,omitempty"` // Replace incoming request path with this value.
	Timeout  Duration `json:"timeout,omitempty"`
	Stream   bool     `json:"stream,omitempty"` // Use raw HTTP tunnel for bidirectional streaming.
	Proto    string   `json:"proto,omitempty"`  // Upstream protocol: "" (auto), "h2" (HTTP/2 cleartext).

	// Fallback action name — invoked when the primary action fails
	// (e.g. no target selected, upstream unreachable).
	Fallback string `json:"fallback,omitempty"`

	// Shared fields (proxy, static).
	Headers map[string]string `json:"headers,omitempty"`

	// Static-specific fields.
	Status  int         `json:"status,omitempty"`
	BodyRef ResourceRef `json:"body_ref,omitempty"`

	// Serve-specific fields.
	Root string `json:"root,omitempty"` // Directory to serve (e.g. "./public").
	File string `json:"file,omitempty"` // Single file to serve (e.g. "./index.html").
}

type ActionRef struct {
	Name   string
	Inline *Action
}

type ActionType string

type AdminConfig struct {
	Listen string `json:"listen"`          // TCP ("127.0.0.1:9090") or Unix socket ("unix:///var/run/prox.sock")
	Token  string `json:"token,omitempty"` // Bearer token for authentication (optional)
}

type BalancerConfig struct {
	Type     BalancerType `json:"type"`
	Targets  []string     `json:"targets"`
	Fallback bool         `json:"fallback,omitempty"` // When true and using grouped targets, pick a random target from all groups if the key has no match.
}

type BalancerType string

type Config struct {
	Services  map[string]*Service  `json:"services"`
	Plugins   map[string]*Plugin   `json:"plugins"`
	Actions   map[string]*Action   `json:"actions"`
	Resources map[string]*Resource `json:"resources"`
	Logging   *LoggingConfig       `json:"logging,omitempty"`
	Admin     *AdminConfig         `json:"admin,omitempty"`
}

type Duration struct {
	time.Duration
}

type LoadResult struct {
	Config    *Config
	Paths     []string
	ConfigDir string // directory containing the root config file
}

type LoggingConfig struct {
	Level     string `json:"level,omitempty"`      // debug, info, warn, error (overridden by LOG_LEVEL env)
	AccessLog string `json:"access_log,omitempty"` // global access log file path
	ErrorLog  string `json:"error_log,omitempty"`  // global error log file path
}

type Match struct {
	Path         string   `json:"path,omitempty"`
	Domain       string   `json:"domain,omitempty"`
	Methods      []string `json:"methods,omitempty"`
	ForwardProxy bool     `json:"forward_proxy,omitempty"`
}

type Plugin struct {
	Path      string `json:"path"`
	Autostart bool   `json:"autostart,omitempty"` // start at proxy startup without route bindings
}

type Resource struct {
	Text string `json:"text,omitempty"`
	JSON any    `json:"json,omitempty"`
	File string `json:"file,omitempty"`
}

type ResourceRef struct {
	Name   string
	Inline *Resource
}

type Route struct {
	Match         *Match            `json:"match"`
	Plugins       []string          `json:"plugins,omitempty"`
	PluginTimeout Duration          `json:"plugin_timeout,omitempty"` // per-request timeout for plugin hooks (default: 5s)
	Balancer      *BalancerConfig   `json:"balancer,omitempty"`
	Speed         *SpeedConfig      `json:"speed,omitempty"`
	Set           map[string]string `json:"set,omitempty"`
	Action        ActionRef         `json:"action"`
	AccessLog     string            `json:"access_log,omitempty"` // per-route access log file path
}

type ServerConfig struct {
	// HTTP server timeouts.
	ReadTimeout  Duration `json:"read_timeout,omitempty"`
	WriteTimeout Duration `json:"write_timeout,omitempty"`
	IdleTimeout  Duration `json:"idle_timeout,omitempty"`

	// Proxy transport settings.
	ResponseHeaderTimeout Duration `json:"response_header_timeout,omitempty"`

	// FlushInterval controls how often buffered response data is flushed
	// to the client. Negative value (-1) flushes immediately (streaming).
	// Zero uses the default buffered behavior.
	FlushInterval Duration `json:"flush_interval,omitempty"`

	// Transport tuning — connection pool and keep-alive.
	DialTimeout         Duration `json:"dial_timeout,omitempty"`            // TCP dial timeout (default: action timeout)
	KeepAlive           Duration `json:"keep_alive,omitempty"`              // TCP keep-alive interval (default: 30s)
	MaxIdleConns        int      `json:"max_idle_conns,omitempty"`          // Max idle connections (default: 4096)
	MaxIdleConnsPerHost int      `json:"max_idle_conns_per_host,omitempty"` // Max idle per host (default: 4096)
	TLSHandshakeTimeout Duration `json:"tls_handshake_timeout,omitempty"`   // TLS handshake deadline (default: 10s)

	// Transport I/O buffer sizes in bytes (default: 32768).
	ReadBufferSize  int `json:"read_buffer_size,omitempty"`
	WriteBufferSize int `json:"write_buffer_size,omitempty"`

	// DisableCompression prevents the proxy from requesting gzip from upstreams.
	// When true (default), the client's Accept-Encoding is forwarded as-is and
	// compressed responses pass through without re-encoding — more efficient
	// for reverse proxy workloads. Set to false to let Go decompress upstream
	// responses transparently.
	DisableCompression *bool `json:"disable_compression,omitempty"`

	// HTTP/2 transport tuning.
	H2ReadIdleTimeout Duration `json:"h2_read_idle_timeout,omitempty"` // Ping after idle (default: 30s)
	H2PingTimeout     Duration `json:"h2_ping_timeout,omitempty"`      // Ping response deadline (default: 15s)

	// Connection limiting.
	MaxConnections int `json:"max_connections,omitempty"` // Maximum concurrent connections (0 = unlimited)
}

type Service struct {
	Listen  string        `json:"listen"`
	TLS     bool          `json:"tls"`
	TLSCert string        `json:"tls_cert,omitempty"`
	TLSKey  string        `json:"tls_key,omitempty"`
	ACME    *ACMEConfig   `json:"acme,omitempty"`
	H2      *bool         `json:"h2,omitempty"` // Enable HTTP/2 on TLS listener (default: true). Set to false for WebSocket support.
	Config  *ServerConfig `json:"config,omitempty"`
	Plugins []string      `json:"plugins,omitempty"`
	Routes  []*Route      `json:"routes"`
}

type SpeedConfig struct {
	DownloadMbps float64 `json:"download_mbps,omitempty"` // upstream→client limit in Mbps (0 = unlimited)
	UploadMbps   float64 `json:"upload_mbps,omitempty"`   // client→upstream limit in Mbps (0 = unlimited)
	Shared       bool    `json:"shared,omitempty"`        // share bandwidth across all connections
}

type ValidationError struct {
	Issues []string
}