config

type AuthConfig struct {
	MasterKey     string
	OPAPolicyFile string // optional path to a Rego policy file; empty = AllowAll
}

type Config struct {
	Server        ServerConfig
	Database      DatabaseConfig
	Redis         RedisConfig
	Docker        DockerConfig
	Workspace     WorkspaceConfig
	Auth          AuthConfig
	Observability ObservabilityConfig
	SSO           SSOConfig
	MultiRegion   MultiRegionConfig
	Production    ProductionConfig
}

type DatabaseConfig struct {
	DSN             string
	MaxOpenConns    int
	MaxIdleConns    int
	ConnMaxLifetime time.Duration
	// TLS / SSL configuration for the PostgreSQL connection.
	// These take effect via injectSSLParams in internal/db/db.go and override
	// any sslmode already present in the DSN.
	SSLMode     string // DB_SSL_MODE: disable|require|verify-ca|verify-full (empty = use DATABASE_URL)
	SSLRootCert string // DB_SSL_ROOT_CERT: path to CA certificate file
	SSLCert     string // DB_SSL_CERT: path to client certificate file
	SSLKey      string // DB_SSL_KEY: path to client private key file
}

type DockerConfig struct {
	Host            string
	NetworkName     string
	DefaultImage    string
	ContainerPrefix string
	IdleTimeoutMins int
	// ImageAllowlist is an optional set of permitted images.
	// An empty slice means all images are allowed.
	ImageAllowlist []string
	// WarmPoolSize is the number of containers to pre-start for WarmPoolImage.
	// 0 = disabled (default).
	WarmPoolSize int
	// WarmPoolImage is the image to pre-warm (e.g. "python:3.12-slim").
	// When empty, warm pool is disabled regardless of WarmPoolSize.
	WarmPoolImage string
	// GPUDevices enables NVIDIA GPU access in sessions that request it.
	// "all" = all GPUs; "0,1" = specific GPU indices; "" = disabled.
	GPUDevices string
}

type MultiRegionConfig struct {
	Region          string // REGION — e.g. "us-east-1" or "eu-west-1"; included in health responses
	DatabaseReadURL string // DATABASE_READ_URL — optional read-replica DSN for list/get queries
}

type ObservabilityConfig struct {
	LogLevel                 string // LOG_LEVEL: debug|info|warn|error (default: info)
	StopContainersOnShutdown bool   // STOP_CONTAINERS_ON_SHUTDOWN: gracefully stop all running containers on SIGTERM
	WebhookSecret            string // WEBHOOK_SECRET: HMAC-SHA256 key for signing async-run callback payloads
	AuditLogRetentionDays    int    // AUDIT_LOG_RETENTION_DAYS: delete audit logs older than N days (0 = keep forever)
	AuditHMACKey             string // AUDIT_HMAC_KEY: HMAC-SHA256 key for audit log integrity signatures; empty = disabled
}

type ProductionConfig struct {
	Enabled      bool   // VAULTRUN_PRODUCTION: refuse to start when ProductionProblems() is non-empty
	OPAAllowAll  bool   // OPA_ALLOW_ALL: explicitly accept running without an OPA policy
	TLSDisabled  bool   // TLS_DISABLED: explicitly accept plain HTTP (e.g. TLS terminated by a proxy)
	MetricsToken string // METRICS_TOKEN: bearer token protecting /metrics
}

type RedisConfig struct {
	Addr     string
	Password string
	DB       int
}

type SSOConfig struct {
	// OIDC / OpenID Connect
	OIDCEnabled      bool
	OIDCIssuerURL    string // OIDC_ISSUER_URL — e.g. https://accounts.google.com
	OIDCClientID     string // OIDC_CLIENT_ID
	OIDCClientSecret string // OIDC_CLIENT_SECRET
	OIDCRedirectURL  string // OIDC_REDIRECT_URL — must match the IdP's allowed redirect list
	OIDCScopes       []string

	// SAML 2.0 Service Provider
	SAMLEnabled         bool
	SAMLRootURL         string // SAML_ROOT_URL — public base URL of this server
	SAMLEntityID        string // SAML_ENTITY_ID (default: SAML_ROOT_URL/auth/saml/metadata)
	SAMLIDPMetadataURL  string // SAML_IDP_METADATA_URL — URL of the IdP metadata XML
	SAMLIDPMetadataFile string // SAML_IDP_METADATA_FILE — local file path (preferred; avoids live-URL MITM)
	SAMLCertFile        string // SAML_CERT_FILE — PEM certificate for this SP
	SAMLKeyFile         string // SAML_KEY_FILE  — PEM private key for this SP

	// Session cookie
	SessionSecret string // SSO_SESSION_SECRET — ≥32 bytes; used to sign session JWTs
	SessionMaxAge int    // SSO_SESSION_MAX_AGE_HOURS (default: 24)
	SessionSecure bool   // SSO_SESSION_SECURE (default: true when TLS is active)
}

type ServerConfig struct {
	Host            string
	Port            int
	ReadTimeout     time.Duration
	WriteTimeout    time.Duration
	ShutdownTimeout time.Duration
	CORSOrigins     []string // allowed CORS origins; empty = same-origin only
	RateLimit       int      // max requests per minute per IP (0 = disabled)
	ActorRateLimit  int      // max requests per minute per actor/API-key (0 = same as RateLimit; -1 = disabled)
	// Static TLS: when both are set the server listens over HTTPS using the provided cert/key files.
	TLSCertFile string // TLS_CERT_FILE — PEM certificate chain
	TLSKeyFile  string // TLS_KEY_FILE  — PEM private key
	// ACME / Let's Encrypt: when set, the server obtains and auto-renews a certificate.
	// Requires port 443 access and a publicly routable hostname.
	// Takes precedence over TLS_CERT_FILE/TLS_KEY_FILE when set.
	ACMEDomain   string // ACME_DOMAIN  — hostname to obtain a cert for (e.g. "api.example.com")
	ACMECacheDir string // ACME_CACHE_DIR — directory to persist ACME account keys + certs (default: /data/acme-cache)
	ACMEEmail    string // ACME_EMAIL — contact email registered with Let's Encrypt (optional but recommended)
}

type SessionLimits struct {
	MaxCPU              float64
	MaxMemoryMB         int
	MaxTimeoutSec       int
	MaxSessionsPerActor int // 0 = unlimited
}

type WorkspaceConfig struct {
	BaseDir              string
	DockerHostBaseDir    string // DOCKER_HOST_WORKSPACE_BASE_DIR: path on Docker host for bind mounts (defaults to BaseDir)
	MaxFileMB            int64
	MaxOutputMB          int64
	MaxWorkspaceMB       int64 // MAX_WORKSPACE_MB: total workspace size cap per session (0 = unlimited)
	MaxArtifactStorageMB int64 // MAX_ARTIFACT_STORAGE_MB: total artifact storage cap per actor (0 = unlimited)
	// S3 artifact storage — when ArtifactS3Bucket is set, artifacts are stored
	// in S3 instead of the local filesystem. Supports AWS S3 and S3-compatible
	// stores (MinIO, etc.) via the endpoint override.
	ArtifactS3Bucket          string // ARTIFACT_S3_BUCKET
	ArtifactS3Region          string // ARTIFACT_S3_REGION (default: us-east-1)
	ArtifactS3Prefix          string // ARTIFACT_S3_PREFIX (optional key prefix, e.g. "artifacts/")
	ArtifactS3Endpoint        string // ARTIFACT_S3_ENDPOINT (custom endpoint for MinIO / S3-compatible)
	ArtifactS3AccessKeyID     string // ARTIFACT_S3_ACCESS_KEY_ID
	ArtifactS3SecretAccessKey string // ARTIFACT_S3_SECRET_ACCESS_KEY
	ArtifactS3ForcePathStyle  bool   // ARTIFACT_S3_FORCE_PATH_STYLE (required for MinIO)
}