config

type CredentialConfig struct {
	CACert     string `toml:"ca_cert"`
	ClientCert string `toml:"client_cert"`
	ClientKey  string `toml:"client_key"`
	// EnrollmentToken is the single-use token an operator created for this
	// executor's ID on the dispatcher host. It is presented once, in the
	// first Hello, to bind this node's client certificate to that ID; after
	// that it is spent and the key can be removed.
	EnrollmentToken string `toml:"enrollment_token"`
}

type DatabaseConfig struct {
	Path string
}

type DispatcherConfig struct {
	Addr      string
	YamuxAddr string `toml:"yamux_addr"`
}

type ExecutorConfig struct {
	Identity    IdentityConfig
	Dispatcher  DispatcherConfig
	TLS         TLSConfig
	Resources   ResourcesConfig
	Tesla       TeslaConfig
	Network     NetworkConfig
	Logging     LoggingConfig
	Credentials CredentialConfig
	Database    DatabaseConfig
	Pricing     PricingConfig
}

type IdentityConfig struct {
	ExecutorID string `toml:"executor_id"`
	Version    string
}

type LoggingConfig struct {
	LogLevel string `toml:"log_level"`
	JSONLogs bool   `toml:"json_logs"`
}

type NetworkConfig struct {
	PacketCounter string `toml:"packet_counter"` // empty and auto retain interface discovery
	// DisableSCIONEnvironment skips external configuration loading; it does
	// not restrict traffic or enforce a network policy.
	DisableSCIONEnvironment bool `toml:"disable_scion_environment"`
	Interface               string
	PublicHost              string `toml:"public_host"`  // public IP or domain for TCP/UDP listeners; empty disables listening
	PublicPorts             string `toml:"public_ports"` // allowed public listener ports as comma-separated ranges, e.g. "2022,2025-3005,56000-62000"
	// Policy is the operator's traffic policy for guests.
	Policy PolicyConfig `toml:"policy"`
}

type PolicyConfig struct {
	TCP     *bool `toml:"tcp"`
	TLS     *bool `toml:"tls"`
	UDP     *bool `toml:"udp"`
	ICMP    *bool `toml:"icmp"`
	SCION   *bool `toml:"scion"`
	Inbound *bool `toml:"inbound"`
	// LocalTargets keeps loopback destinations reachable. It belongs to the
	// local profile, where the guest, the executor and the measured target run
	// on one machine; an executor that serves submitters it does not trust
	// sets it to false.
	LocalTargets *bool `toml:"local_targets"`
	// DeniedDestinations are operator denials in addition to the reserved and
	// internal ranges, as a comma-separated list of CIDR blocks, IP addresses
	// and DNS names. A name denies the name and the addresses it resolves to,
	// which is how a destination that opted out stays unreachable.
	DeniedDestinations string `toml:"denied_destinations"`
	// PermittedPorts are the destination ports a guest may reach, written as
	// comma-separated ports and ranges. Empty permits every port.
	PermittedPorts string `toml:"permitted_ports"`
}

type PricingConfig struct {
	PricePerBwS     int64  `toml:"price_per_bw_s"`
	Currency        string `toml:"currency"`
	SuiWallet       string `toml:"sui_wallet"`
	TrialPriceLimit int64  `toml:"trial_price_limit"`
	TrialTimeLimit  int64  `toml:"trial_time_limit"`
}

type ResourcesConfig struct {
	Capacity     int64
	MaxDebuglets int `toml:"max_debuglets"`
}

type TLSConfig struct {
	Disable bool
	// ServerName overrides the dispatcher name verified in the certificate
	// presented on both control channels. Empty verifies the host part of
	// dispatcher.addr and dispatcher.yamux_addr, which is what a certificate
	// issued for the dispatcher's own name carries. Set it when the executor
	// dials an address that is not that name, such as a literal IP or the
	// service name of a TLS terminator standing in front of the dispatcher.
	ServerName string `toml:"server_name"`
}

type TeslaConfig struct {
	Seed  string `toml:"seed"`
	Delay int64  `toml:"delay"` // epoch duration, in seconds
	// ChainLength is the number of epochs the hash chain covers. Zero
	// derives it from Delay so the chain lasts tesla.DefaultChainHorizon.
	// The schedule stops advancing once the chain runs out, and packets
	// tagged after that point can never be verified, so this must exceed
	// the executor's expected uptime between restarts.
	ChainLength int64 `toml:"chain_length"`
}