config

type ClockConfig struct {
	MaxErrorMS int64 `toml:"max_error_ms"`
}

type ConnectivityConfig struct {
	IPv4Reflector   string `toml:"ipv4_reflector"`
	IPv6Reflector   string `toml:"ipv6_reflector"`
	Listeners       bool   `toml:"listeners"`
	SCIONPathTarget string `toml:"scion_path_target"`
	// ObserveAddresses (default true) lets the dispatcher observe this
	// executor's address in each family: every 10 minutes, for each family
	// without a configured reflector, the executor resolves dispatcher.addr
	// and calls the address reflection over that family. It feeds the
	// listing's address_v4 and address_v6 only, never admission.
	ObserveAddresses bool `toml:"observe_addresses"`
}

type CredentialConfig struct {
	CACert     string `toml:"ca_cert"`
	ClientCert string `toml:"client_cert"`
	ClientKey  string `toml:"client_key"`
	// EnrollmentToken is the single-use token an operator created for this
	// executor's ID on the dispatcher host. It is presented once, in the
	// first Hello, to bind this node's client certificate to that ID; after
	// that it is spent and the key can be removed.
	EnrollmentToken string `toml:"enrollment_token"`
}

type DatabaseConfig struct {
	Path string
}

type DispatcherConfig struct {
	Addr      string
	YamuxAddr string `toml:"yamux_addr"`
}

type ExecutorConfig struct {
	Identity     IdentityConfig
	Dispatcher   DispatcherConfig
	TLS          TLSConfig
	Resources    ResourcesConfig
	Tesla        TeslaConfig
	Network      NetworkConfig
	Logging      LoggingConfig
	Credentials  CredentialConfig
	Database     DatabaseConfig
	Pricing      PricingConfig
	Output       OutputConfig
	Isolation    isolation.Config
	Clock        ClockConfig
	Metadata     MetadataConfig
	Connectivity ConnectivityConfig
}

type IdentityConfig struct {
	ExecutorID string `toml:"executor_id"`
	Version    string
}

type LoggingConfig struct {
	LogLevel string `toml:"log_level"`
	JSONLogs bool   `toml:"json_logs"`
}

type MetadataConfig struct {
	LocationOptOut bool `toml:"location_opt_out"`
	// AddressOptOut makes the executor private (is_public false): the public
	// listing then withholds its observed addresses. Prefix, ASN and
	// location stay public, as for a private RIPE Atlas probe.
	AddressOptOut bool `toml:"address_opt_out"`
	// HostTags describe the host from the fixed vocabulary wire.HostTags,
	// such as home or datacentre and dsl or fibre. They are public.
	HostTags []string `toml:"host_tags"`
}

type NetworkConfig struct {
	PacketCounter string `toml:"packet_counter"` // empty and auto retain interface discovery
	// DisableSCIONEnvironment skips external configuration loading; it does
	// not restrict traffic or enforce a network policy.
	DisableSCIONEnvironment bool `toml:"disable_scion_environment"`
	Interface               string
	PublicHost              string `toml:"public_host"`  // public IP or domain for TCP/UDP listeners; empty disables listening
	PublicPorts             string `toml:"public_ports"` // allowed public listener ports as comma-separated ranges, e.g. "2022,2025-3005,56000-62000"
	// Policy is the operator's traffic policy for guests.
	Policy PolicyConfig `toml:"policy"`
}

type OutputConfig struct {
	ControlReserveBytes int64 `toml:"control_reserve_bytes"`
	RunBytes            int64 `toml:"run_bytes"`
	RunFrames           int64 `toml:"run_frames"`
	SpoolBytes          int64 `toml:"spool_bytes"`
	RetainedRuns        int64 `toml:"retained_runs"`
	RateBytesPerSecond  int64 `toml:"rate_bytes_per_second"`
	BurstBytes          int   `toml:"burst_bytes"`
}

type PolicyConfig struct {
	TCP     *bool `toml:"tcp"`
	TLS     *bool `toml:"tls"`
	UDP     *bool `toml:"udp"`
	ICMP    *bool `toml:"icmp"`
	SCION   *bool `toml:"scion"`
	Inbound *bool `toml:"inbound"`
	// LocalTargets keeps loopback destinations reachable. It belongs to the
	// local profile, where the guest, the executor and the measured target run
	// on one machine; an executor that serves submitters it does not trust
	// sets it to false.
	LocalTargets *bool `toml:"local_targets"`
	// DeniedDestinations are operator denials in addition to the reserved and
	// internal ranges, as a comma-separated list of CIDR blocks, IP addresses
	// and DNS names. A name denies the name and the addresses it resolves to,
	// which is how a destination that opted out stays unreachable.
	DeniedDestinations string `toml:"denied_destinations"`
	// PermittedPorts are the destination ports a guest may reach, written as
	// comma-separated ports and ranges. Empty permits every port.
	PermittedPorts string `toml:"permitted_ports"`
}

type PricingConfig struct {
	PricePerBwS     int64  `toml:"price_per_bw_s"`
	Currency        string `toml:"currency"`
	SuiWallet       string `toml:"sui_wallet"`
	TrialPriceLimit int64  `toml:"trial_price_limit"`
	TrialTimeLimit  int64  `toml:"trial_time_limit"`
}

type ResourcesConfig struct {
	Capacity     int64
	MaxDebuglets int `toml:"max_debuglets"`
}

type TLSConfig struct {
	Disable bool
	// ServerName overrides the dispatcher name verified in the certificate
	// presented on both control channels. Empty verifies the host part of
	// dispatcher.addr and dispatcher.yamux_addr, which is what a certificate
	// issued for the dispatcher's own name carries. Set it when the executor
	// dials an address that is not that name, such as a literal IP or the
	// service name of a TLS terminator standing in front of the dispatcher.
	ServerName string `toml:"server_name"`
}

type TeslaConfig struct {
	Seed string `toml:"seed"`
	// EpochSeconds is the epoch length I in seconds: each chain key signs
	// for one epoch. Zero keeps tesla.DefaultEpochLength.
	EpochSeconds int64 `toml:"epoch_seconds"`
	// Delay is the deprecated name of EpochSeconds, read when EpochSeconds is
	// unset. It never was a disclosure delay; see DisclosureDelayEpochs.
	Delay int64 `toml:"delay"`
	// DisclosureDelayEpochs is the disclosure delay d: the key of epoch i is
	// disclosed once epoch i+d starts. Zero derives the smallest d whose
	// d·EpochSeconds covers tesla.DefaultDisclosureWindow; an explicit value
	// must be at least tesla.MinDisclosureDelay.
	DisclosureDelayEpochs int64 `toml:"disclosure_delay_epochs"`
	// ChainLength is the number of epochs the hash chain covers. Zero
	// derives it from EpochSeconds so the chain lasts tesla.DefaultChainHorizon.
	// The schedule stops advancing once the chain runs out, and packets
	// tagged after that point can never be verified, so this must exceed
	// the executor's expected uptime between restarts.
	ChainLength int64 `toml:"chain_length"`
}