config

type CTConfig struct {
	Enabled             bool     `yaml:"enabled"`
	Provider            string   `yaml:"provider"` // certspotter or crtsh
	Interval            Duration `yaml:"interval"`
	AutoWatchStoredSANs bool     `yaml:"auto_watch_stored_sans"`
}

type Config struct {
	Database DatabaseConfig `yaml:"database"`
	Vault    VaultConfig    `yaml:"vault"`
	TLS      TLSConfig      `yaml:"tls"`
	CT       CTConfig       `yaml:"ct"`
	Server   ServerConfig   `yaml:"server"`
	Expiry   ExpiryConfig   `yaml:"expiry"`
	Remote   RemoteConfig   `yaml:"remote"`
}

type DatabaseConfig struct {
	Path string `yaml:"path"`
}

type Duration time.Duration

type ExpiryConfig struct {
	WarningDays  int `yaml:"warning_days"`
	CriticalDays int `yaml:"critical_days"`
}

type RemoteConfig struct {
	// Type is "" (no remote) or "vault".
	Type      string `yaml:"type"`
	Address   string `yaml:"address,omitempty"`   // default $VAULT_ADDR
	Namespace string `yaml:"namespace,omitempty"` // default $VAULT_NAMESPACE
	CACert    string `yaml:"ca_cert,omitempty"`   // default $VAULT_CACERT
	Mount     string `yaml:"mount"`               // KV version 2 mount
	Path      string `yaml:"path"`                // prefix inside the mount
	// AuthMethod is token, approle, userpass or ldap.
	AuthMethod   string `yaml:"auth_method"`
	AuthMount    string `yaml:"auth_mount,omitempty"` // default: the method name
	Username     string `yaml:"username,omitempty"`   // userpass/ldap login
	RoleID       string `yaml:"role_id,omitempty"`    // approle
	SecretIDFile string `yaml:"secret_id_file,omitempty"`
	TokenFile    string `yaml:"token_file,omitempty"` // default ~/.vault-token
	// TransitKey, when set, encrypts private keys with this Vault Transit
	// key before they are stored in KV.
	TransitKey   string `yaml:"transit_key,omitempty"`
	TransitMount string `yaml:"transit_mount,omitempty"` // default transit
	// AutoSync syncs before and after every command that opens the vault.
	AutoSync bool `yaml:"auto_sync"`
	// Interval is how often `sslknife server` syncs.
	Interval Duration `yaml:"interval"`
}

type ServerConfig struct {
	Listen string `yaml:"listen"`
	// RefreshInterval is how often known TLS endpoints are re-inspected
	// by the server (0 disables).
	RefreshInterval Duration `yaml:"refresh_interval"`
}

type TLSConfig struct {
	Timeout     Duration `yaml:"timeout"`
	Concurrency int      `yaml:"concurrency"`
	Proxy       string   `yaml:"proxy,omitempty"`
}

type VaultConfig struct {
	// UnlockCache keeps the vault unlocked in a background process for this
	// long after its last use, once a password or Touch ID unlocked it
	// (0 disables).
	UnlockCache Duration `yaml:"unlock_cache"`
}