configuration

type Configuration struct {
	ListenAddress string   `json:"listen_address"`
	Secret_jwt    string   `json:"secret"`
	V1Protocol    string   `json:"v1_protocol"`
	V1ApiEndpoint string   `json:"v1_api_endpoint"`
	V1WsEndpoint  string   `json:"v1_ws_endpoint"`
	V1ApiPath     string   `json:"v1_api_path"`
	V1WsPath      string   `json:"v1_ws_path"`
	SensitiveList []string `json:"sensitive_list"`
	FreePBXAPIs   []string `json:"freepbx_apis"`

	SecretsDir string `json:"secrets_dir"`
	Issuer2FA  string `json:"issuer_2fa"`

	// MQTT Configuration for satellite transcriptions
	MQTTHost     string `json:"mqtt_host"`
	MQTTPort     string `json:"mqtt_port"`
	MQTTUsername string `json:"mqtt_username"`
	MQTTPassword string `json:"mqtt_password"`
	MQTTEnabled  bool   `json:"mqtt_enabled"`

	// Middleware MariaDB Configuration for phonebook and persistence layer
	MiddlewareMariaDBHost        string `json:"nethvoice_middleware_mariadb_host"`
	MiddlewareMariaDBPort        string `json:"nethvoice_middleware_mariadb_port"`
	MiddlewareMariaDBUser        string `json:"nethvoice_middleware_mariadb_user"`
	MiddlewareMariaDBPassword    string `json:"nethvoice_middleware_mariadb_password"`
	MiddlewareMariaDBDatabase    string `json:"nethvoice_middleware_mariadb_database"`
	MiddlewareMariaDBCDRDatabase string `json:"nethvoice_middleware_mariadb_cdr_database"`

	// Satellite PostgreSQL Configuration for transcripts
	SatellitePgSQLDB       string `json:"satellite_pgsql_db"`
	SatellitePgSQLUser     string `json:"satellite_pgsql_user"`
	SatellitePgSQLPassword string `json:"satellite_pgsql_password"`
	SatellitePgSQLHost     string `json:"satellite_pgsql_host"`
	SatellitePgSQLPort     string `json:"satellite_pgsql_port"`

	// Super Admin Configuration
	SuperAdminToken      string   `json:"super_admin_token"`
	SuperAdminAllowedIPs []string `json:"super_admin_allowed_ips"`

	// Profiles and Users configuration paths
	ProfilesConfigPath string `json:"profiles_config_path"`
	UsersConfigPath    string `json:"users_config_path"`
	TrustedProxy       string `json:"trusted_proxy"`

	// Trusted SSO login: when set, a login carrying the pre-authenticated
	// username in SsoUserHeader is accepted without a password (see middleware).
	SsoTrustedSecret string `json:"sso_trusted_secret"`
	// Separate key deriving the legacy token (HMAC), matching the V1 server's
	// sso_token_key; falls back to SsoTrustedSecret when empty.
	SsoTokenKey   string `json:"sso_token_key"`
	SsoUserHeader string `json:"sso_user_header"`
	// Secret injected by Traefik on the mint route AFTER forwardAuth: proves the
	// request came through the proxy (not a direct local call). When set, the SSO
	// header is honored only if SsoProxyHeader carries this value.
	SsoProxySecret string `json:"sso_proxy_secret"`
	SsoProxyHeader string `json:"sso_proxy_header"`

	// JWT lifetime in hours (default 336 = 14 days)
	JwtTimeoutHours int `json:"jwt_timeout_hours"`

	// Generous global per-IP rate limit applied to every API route as a coarse
	// safety net; 0 disables it
	GlobalRateLimitAverage int `json:"global_rate_limit_average"`
	GlobalRateLimitBurst   int `json:"global_rate_limit_burst"`
}