internal

type Config struct {
	worker.Config `config:",squash"`

	// configs for starting and introspecting service
	GitRef                   string   `config:"git_ref" validate:"required"`
	Version                  string   `config:"version" validate:"required"`
	MetricsTags              []string `config:"metrics_tags"`
	DisableMetrics           bool     `config:"disable_metrics"`
	OTELExporterOTLPEndpoint string   `config:"otel_exporter_otlp_endpoint"`
	OTELExporterOTLPProtocol string   `config:"otel_exporter_otlp_protocol"`

	StateTelemetryEnabled bool `config:"state_telemetry_enabled"`

	ServiceName       string `config:"service_name" validate:"required"`
	ServiceType       string `config:"service_type" validate:"required"`
	ServiceDeployment string `config:"service_deployment"`

	RootDomain string `config:"root_domain"` // for all services

	HTTPPort               string `config:"http_port" validate:"required"`
	InternalHTTPPort       string `config:"internal_http_port" validate:"required"`
	RunnerHTTPPort         string `config:"runner_http_port" validate:"required"`
	AuthHTTPPort           string `config:"auth_http_port" validate:"required"`
	AdminDashboardHTTPPort string `config:"admin_dashboard_http_port" validate:"required"`
	AdminDashboardDistDir  string `config:"admin_dashboard_dist_dir"`
	SlackHTTPPort          string `config:"slack_http_port" validate:"required"`
	MCPHTTPPort            string `config:"mcp_http_port"`
	NuonctlMCPHTTPPort     string `config:"nuonctl_mcp_http_port"`

	WorkerHealthcheckPort    string `config:"worker_healthcheck_port"`
	WorkerHealthcheckEnabled bool   `config:"worker_healthcheck_enabled"`

	GracefulShutdownTimeout time.Duration `config:"graceful_shutdown_timeout" validate:"required"`

	// psql connection parameters
	DBName                       string `config:"db_name" validate:"required"`
	DBHost                       string `config:"db_host" validate:"required"`
	DBReplicaHost                string `config:"db_replica_host"`
	DBGormReplicaHost            string `config:"db_gorm_replica_host"`
	DBReplicaEnabled             bool   `config:"db_replica_enabled"`
	DBReplicaBypassOptIn         bool   `config:"db_replica_bypass_opt_in"`
	DBPort                       string `config:"db_port" validate:"required"`
	DBSSLMode                    string `config:"db_ssl_mode" validate:"required"`
	DBPassword                   string `config:"db_password"`
	DBUser                       string `config:"db_user" validate:"required"`
	DBZapLog                     bool   `config:"db_use_zap"`
	DBUseIAM                     bool   `config:"db_use_iam"`
	DBRegion                     string `config:"db_region" validate:"required"`
	CloudProvider                string `config:"cloud_provider"`
	DBLogQueries                 bool   `config:"db_log_queries"`
	DebugEnableQueryCollector    bool   `config:"debug_enable_query_collector"`
	QueryCollectorDisabledTables string `config:"query_collector_disabled_tables"`
	DBMaxConnections             int32  `config:"db_max_connections"`

	// clickhouse connection parameters
	ClickhouseDBName         string        `config:"clickhouse_db_name" validate:"required"`
	ClickhouseDBHost         string        `config:"clickhouse_db_host" validate:"required"`
	ClickhouseDBUser         string        `config:"clickhouse_db_user" validate:"required"`
	ClickhouseDBPassword     string        `config:"clickhouse_db_password" validate:"required"`
	ClickhouseDBPort         string        `config:"clickhouse_db_port" validate:"required"`
	ClickhouseDBUseTLS       bool          `config:"clickhouse_db_use_tls"`
	ClickhouseDBReadTimeout  time.Duration `config:"clickhouse_db_read_timeout" validate:"required"`
	ClickhouseDBWriteTimeout time.Duration `config:"clickhouse_db_write_timeout" validate:"required"`
	ClickhouseDBDialTimeout  time.Duration `config:"clickhouse_db_dial_timeout" validate:"required"`

	// kafka configuration. Two security protocols: PLAINTEXT locally, and SSL
	// with the client certificate Strimzi issues our KafkaUser in deployed
	// environments. KafkaEnabled gates whether producers use Kafka vs writing
	// straight to ClickHouse.
	KafkaEnabled          bool   `config:"kafka_enabled"`
	KafkaBrokers          string `config:"kafka_brokers"`
	KafkaSecurityProtocol string `config:"kafka_security_protocol"`
	KafkaTLSCAPath        string `config:"kafka_tls_ca_path"`
	KafkaTLSCertPath      string `config:"kafka_tls_cert_path"`
	KafkaTLSKeyPath       string `config:"kafka_tls_key_path"`
	KafkaClientID         string `config:"kafka_client_id"`
	// Bounds a synchronous produce, used by the log write paths. franz-go retries
	// a buffered record effectively forever, so this is what keeps a broker outage
	// from blocking a runner's log write rather than falling back to ClickHouse.
	KafkaProduceTimeout time.Duration `config:"kafka_produce_timeout"`
	// Each consumer derives its own group as <prefix>-<name>, so one consumer
	// restarting doesn't rebalance the others.
	KafkaConsumerGroupPrefix            string        `config:"kafka_consumer_group_prefix"`
	KafkaConsumerFetchMaxWait           time.Duration `config:"kafka_consumer_fetch_max_wait"`
	KafkaConsumerFetchMinBytes          int32         `config:"kafka_consumer_fetch_min_bytes"`
	KafkaConsumerFetchMaxBytes          int32         `config:"kafka_consumer_fetch_max_bytes"`
	KafkaConsumerFetchMaxPartitionBytes int32         `config:"kafka_consumer_fetch_max_partition_bytes"`
	KafkaConsumerMaxConcurrentFetches   int           `config:"kafka_consumer_max_concurrent_fetches"`
	// Liveness threshold for a stuck handler call — see the healthcheck server
	// in internal/health/consumer.go. Deliberately separate from any consumer's
	// own fetch tuning: it's a backstop against a hang, not a knob to tune.
	KafkaConsumerLivenessTimeout time.Duration `config:"kafka_consumer_liveness_timeout"`
	ConsumerHealthcheckPort      string        `config:"consumer_healthcheck_port"`

	// temporal configuration
	TemporalHost                          string        `config:"temporal_host"  validate:"required"`
	TemporalStickyWorkflowCacheSize       int           `config:"temporal_sticky_workflow_cache_size"`
	TemporalDataConverterLargePayloadSize int           `config:"temporal_dataconverter_large_payload_size"`
	LargePayloadType                      string        `config:"large_payload_type"`
	TemporalBlobS3Prefix                  string        `config:"temporal_blob_s3_prefix"`
	TemporalBlobCacheDir                  string        `config:"temporal_blob_cache_dir"`
	TemporalBlobCacheMaxCount             int           `config:"temporal_blob_cache_max_count"`
	TemporalBlobCacheMaxSizeMB            int           `config:"temporal_blob_cache_max_size_mb"`
	TemporalBlobS3Timeout                 time.Duration `config:"temporal_blob_s3_timeout"`
	TemporalWorkflowFailurePanic          bool          `config:"temporal_workflow_failure_panic"`
	TemporalDisableRegistrationAliasing   bool          `config:"temporal_disable_registration_aliasing"`
	TemporalStickyScheduleToStartTimeout  time.Duration `config:"temporal_sticky_schedule_to_start_timeout"`
	TemporalDeadlockDetectionTimeout      time.Duration `config:"temporal_deadlock_detection_timeout"`

	// github configuration
	GithubAppID            string `config:"github_app_id" validate:"required"`
	GithubAppKey           string `config:"github_app_key" validate:"required"`
	GithubAppKeySecretName string `config:"github_app_key_secret_name" validate:"required"`

	// base urls for filling in various fields on objects
	SandboxArtifactsBaseURL string `config:"sandbox_artifacts_base_url" validate:"required"`

	// middleware configuration
	Middlewares               []string `config:"middlewares"`
	InternalMiddlewares       []string `config:"internal_middlewares"`
	RunnerMiddlewares         []string `config:"runner_middlewares"`
	AuthMiddlewares           []string `config:"auth_middlewares"`
	AdminDashboardMiddlewares []string `config:"admin_dashboard_middlewares"`
	SlackMiddlewares          []string `config:"slack_middlewares"`

	// Slack app configuration (Phase 0–4 of slackbot integration).
	// Tokens are stored plaintext in DB; these env-var-driven values back
	// OAuth + signed-webhook verification at the listener layer.
	SlackClientID         string `config:"slack_client_id"`
	SlackClientSecret     string `config:"slack_client_secret"`
	SlackSigningSecret    string `config:"slack_signing_secret"`
	SlackStateJWTSecret   string `config:"slack_state_jwt_secret"`
	SlackOAuthRedirectURL string `config:"slack_oauth_redirect_url"`

	// Nuon Auth Config
	NuonAuthSessionKey     string   `config:"nuon_auth_session_key"`
	NuonAuthSessionTTL     int      `config:"nuon_auth_session_ttl"`
	NuonAuthTokenTTL       int      `config:"nuon_auth_token_ttl"`
	NuonAuthAllowedDomains []string `config:"nuon_auth_allowed_domains"` // domains from which emails can register
	NuonAuthAllowAllUsers  bool     `config:"nuon_auth_allow_all_users"` // if true, any user with an allowedDomain can sign in

	// OIDC workload identity federation
	OIDCFederationEnabled              bool `config:"oidc_federation_enabled"`                // enables the /v1/oidc token exchange and trust policy endpoints (default off)
	OIDCFederationAllowInsecureIssuers bool `config:"oidc_federation_allow_insecure_issuers"` // allow http:// issuer URLs in trust policies (local dev only)

	// OAuth 2.0 authorization server (MCP clients)
	OAuthDCREnabled      bool `config:"oauth_dcr_enabled"`
	OAuthAccessTokenTTL  int  `config:"oauth_access_token_ttl"`  // minutes
	OAuthRefreshTokenTTL int  `config:"oauth_refresh_token_ttl"` // minutes

	// Nuon Auth: Default Provider ConfigS
	NuonAuthProviderType string `config:"nuon_auth_provider_type"` // NOTE: becomes required after auth is in GA
	NuonAuthClientID     string `config:"nuon_auth_client_id"`
	NuonAuthClientSecret string `config:"nuon_auth_client_secret"`
	NuonAuthIssuerURL    string `config:"nuon_auth_issuer_url"`
	NuonAuthRedirectURL  string `config:"nuon_auth_redirect_url"`
	NuonAuthProviderName string `config:"nuon_auth_provider_name"` // label shown on the sign-in page
	NuonBrandedLogin     bool   `config:"nuon_branded_login"`

	PostHogKey  string `config:"posthog_key"`
	PostHogHost string `config:"posthog_host"`

	// links
	AppURL        string `config:"app_url" validate:"required"`
	RunnerAPIURL  string `config:"runner_api_url" validate:"required"`
	PublicAPIURL  string `config:"public_api_url" validate:"required"`
	AdminAPIURL   string `config:"admin_api_url" validate:"required"`
	TemporalUIURL string `config:"temporal_ui_url" validate:"required"`

	// flags for controlling the background workers
	ForceSandboxMode           bool          `config:"force_sandbox_mode"`
	ForceOnboardingSandboxMode bool          `config:"force_onboarding_sandbox_mode"`
	SandboxModeSleep           time.Duration `config:"sandbox_mode_sleep" validate:"required"`
	SandboxModeEnableRunners   bool          `config:"sandbox_mode_enable_runners"`
	EnableSupportUsers         bool          `config:"enable_support_users"`

	// ForcedEnabledFeatures lists flags this deployment pins on for every org: they
	// resolve enabled regardless of the stored per-org value and cannot be toggled off.
	ForcedEnabledFeatures string `config:"forced_enabled_features"`
	// AutoEnabledFeatures lists flags stored true on newly created orgs. Unlike
	// ForcedEnabledFeatures, they can still be toggled off.
	AutoEnabledFeatures string `config:"auto_enabled_features"`

	// flags for controlling creation of integration users
	IntegrationGithubInstallID string `config:"integration_github_install_id" validate:"required"`

	// notifications configuration
	LoopsAPIKey string `config:"loops_api_key" validate:"required"`
	// Deprecated: legacy Slack webhook send path is gone; field is read only to populate unused NotificationsConfig rows pending a follow-up cleanup.
	InternalSlackWebhookURL string `config:"internal_slack_webhook_url"`
	DisableNotifications    bool   `config:"disable_notifications"`

	// webhook configuration
	WebhookURLs    []string      `config:"webhook_urls"`
	WebhookTimeout time.Duration `config:"webhook_timeout"`

	// Audit export requires its own endpoint; the generic OTLP endpoint does not
	// enable it. An empty endpoint leaves the audit emitter disabled.
	AuditOTLPEndpoint string `config:"audit_otlp_endpoint"`
	AuditOTLPToken    string `config:"audit_otlp_token"`

	TelemetryJWKS          string `config:"telemetry_jwks,secure"`
	TelemetryJWTIssuer     string `config:"telemetry_jwt_issuer"`
	TelemetryRelayEndpoint string `config:"telemetry_relay_endpoint"`

	// configuration for runners
	RunnerContainerImageURL      string `config:"runner_container_image_url" validate:"required"`
	RunnerContainerImageURLGCP   string `config:"runner_container_image_url_gcp"`
	RunnerContainerImageURLAzure string `config:"runner_container_image_url_azure"`
	RunnerContainerImageTag      string `config:"runner_container_image_tag" validate:"required"`
	UseLocalRunners              bool   `config:"use_local_runners"`

	// Runner VMs verify the runner image's keyless signature before running it: warn logs a failure,
	// enforce refuses to run an image that fails.
	RunnerContainerImageVerificationMode        string `config:"runner_container_image_verification_mode" validate:"omitempty,oneof=disabled warn enforce"`
	RunnerContainerImageSignatureIssuer         string `config:"runner_container_image_signature_issuer"`
	RunnerContainerImageSignatureIdentityRegexp string `config:"runner_container_image_signature_identity_regexp"`

	// AWS IID auth
	AWSIIDCertsDir string `config:"aws_iid_certs_dir"`

	// cloudformation phone home
	AWSCloudFormationStackTemplateBucketRegion string `config:"aws_cloudformation_stack_template_bucket_region"`
	AWSCloudFormationStackTemplateBucket       string `config:"aws_cloudformation_stack_template_bucket"`
	AWSCloudFormationStackTemplateBaseURL      string `config:"aws_cloudformation_stack_template_base_url"`
	AWSCloudFormationStackTemplateRoleARN      string `config:"aws_cloudformation_stack_template_role_arn"`
	RunnerEnableSupport                        bool   `config:"runner_enable_support"`
	RunnerDefaultSupportIAMRole                string `config:"runner_default_support_iam_role_arn"`

	// configuration for managing cloud infra for orgs, apps and installs
	ManagementAccountID string `config:"management_account_id" validate:"required"`

	// ManagementRegion is where management-account resources live. Distinct from
	// AppRegion: it is baked into customer-deployed artifacts (the phone-home
	// Lambda's NUON_PHONE_HOME_SECRET_REGION), so it must be stated explicitly
	// rather than inherited from the pod's AWS_REGION.
	ManagementRegion string `config:"management_region"`

	// AWS management (not required for GCP)
	ManagementIAMRoleARN     string `config:"management_iam_role_arn"`
	ManagementECRRegistryID  string `config:"management_ecr_registry_id"`
	ManagementECRRegistryARN string `config:"management_ecr_registry_arn"`

	// phone home auth (see plans/phone-home-auth-shared-secret.md)
	//
	// The phone-home secret always lives in AWS Secrets Manager in a Nuon-owned AWS
	// account, whichever cloud this control plane runs on, because the reader is the
	// customer's phone-home Lambda and Secrets Manager is the only store it can
	// reach. CloudProvider only selects the credential chain — see
	// ManagementSecretsCreds.
	//
	// AWSPhoneHomeCMKARN is the shared CMK encrypting the secret. It is required for
	// cross-account reads: the AWS-managed aws/secretsmanager key policy cannot be
	// edited and is scoped to kms:CallerAccount, so a customer principal fails
	// kms:Decrypt no matter how permissive the secret's resource policy is.
	AWSPhoneHomeCMKARN string `config:"aws_phone_home_cmk_arn"`
	// AWSPhoneHomeSecretsRoleARN is the role in the Nuon AWS account that owns the
	// secret. Set it on GCP-hosted control planes, where ManagementIAMRoleARN is
	// legitimately empty; on AWS it defaults to ManagementIAMRoleARN.
	AWSPhoneHomeSecretsRoleARN string `config:"aws_phone_home_secrets_role_arn"`
	// PhoneHomeScriptURL overrides the phone-home Lambda source for every app in this
	// environment, below a per-app AppRunnerConfig.PhoneHomeScriptURL and above the
	// pinned default. Exists so a dev or staging control plane can exercise an
	// unreleased script without moving the default that production shares.
	PhoneHomeScriptURL string `config:"phone_home_script_url"`

	// GCP management (not required for AWS)
	ManagementGARRepositoryURL string `config:"management_gar_repository_url"`

	// Azure management (not required for AWS/GCP)
	ManagementACRRegistryURL      string `config:"management_acr_registry_url"`
	ManagementAzureTenantID       string `config:"management_azure_tenant_id"`
	ManagementAzureClientID       string `config:"management_azure_client_id"`
	ManagementAzureSubscriptionID string `config:"management_azure_subscription_id"`
	ManagementAzureResourceGroup  string `config:"management_azure_resource_group"`
	ManagementAzureOIDCIssuerURL  string `config:"management_azure_oidc_issuer_url"`

	// configuration for apps
	AppRegion string `config:"app_region" validate:"required"`

	// configuration for managing the public dns zone
	DNSManagementIAMRoleARN string `config:"dns_management_iam_role_arn"` // AWS-only
	DNSZoneID               string `config:"dns_zone_id" validate:"required"`
	DNSRootDomain           string `config:"dns_root_domain" validate:"required"`

	// analytics configuration
	SegmentWriteKey  string `config:"segment_write_key" validate:"required"`
	DisableAnalytics bool   `config:"disable_analytics"`

	MaxRequestSize     int64         `config:"max_request_size" validate:"required"`
	MaxRequestDuration time.Duration `config:"max_request_duration" validate:"required"`

	// Force debug mode for everything
	ForceDebugMode              bool `config:"force_debug_mode"`
	LogRequestBody              bool `config:"log_request_body"`
	EnableHttpBinDebugEndpoints bool `config:"enable_httpbin_debug_endpoints"`
	EnableEndpointAuditing      bool `config:"enable_endpoint_auditing"`
	EvaluationJourneyEnabled    bool `config:"evaluation_journey_enabled"`

	// chaos configuration
	ChaosRate   int           `config:"chaos_rate"`
	ChaosErrors []string      `config:"chaos_errors"`
	ChaosRoutes []string      `config:"chaos_routes"`
	ChaosSleep  time.Duration `config:"chaos_sleep"`

	// Runner process uptime thresholds
	ProcessInstallUptimeThreshold time.Duration `config:"process_install_uptime_threshold"`
	ProcessMngUptimeThreshold     time.Duration `config:"process_mng_uptime_threshold"`

	// Queue handler grace period
	QueueHandlerGracePeriod time.Duration `config:"queue_handler_grace_period"`

	// Queue idle timeout: how long before an idle queue workflow terminates
	QueueIdleTimeout time.Duration `config:"queue_idle_timeout"`

	// Queue continue-as-new hint period: how often the CAN listener checks for restart hints
	QueueContinueAsNewHintPeriod time.Duration `config:"queue_continue_as_new_hint_period"`

	// Queue continue-as-new history max: trigger CAN when workflow history exceeds this length
	QueueContinueAsNewHistoryMax int `config:"queue_continue_as_new_history_max"`

	// Queue drain timeout: how long to wait for in-flight signals before restarting/stopping
	QueueDrainTimeout time.Duration `config:"queue_drain_timeout"`

	// Action crons
	ActionCronsEnabled bool `config:"action_crons_enabled"`

	MinCLIVersion string `config:"min_cli_version"`

	// below this the CLI syncs app configs client-side, which never sends action or
	// runbook ids, so those are silently dropped from installs
	ServerSideSyncMinCLIVersion string `config:"server_side_sync_min_cli_version"`

	GeneralPurgeStaleDataCron        string        `config:"general_purge_stale_data_cron"`
	GeneralPurgeStaleDataDurationAgo time.Duration `config:"general_purge_stale_data_duration_ago" validate:"required"`

	// When enabled (default), the daily cron hard-deletes process_healthcheck and healthcheck queue signals older than 7 days.
	QueueSignalCleanupEnabled bool `config:"queue_signal_cleanup_enabled"`

	// BlobBackfillRatePerSecond caps how many S3 PUTs/sec the blob backfill activity issues. Defaults to 500 when unset.
	BlobBackfillRatePerSecond int `config:"blob_backfill_rate_per_second"`

	// BlobReadEnabled gates reading large fields from the S3 blob. When false
	// (default) reads fall back to the legacy column. Currently gates composite
	// plan reads.
	BlobReadEnabled bool `config:"blob_read_enabled"`

	// Slack auto-link reconciler. TeamID + OrgLabelKey must both be set;
	// ChannelID is optional and seeds a default org-wide subscription per link.
	SlackAutoLinkTeamID        string `config:"slack_auto_link_team_id"`
	SlackAutoLinkChannelID     string `config:"slack_auto_link_channel_id"`
	SlackAutoLinkOrgLabelKey   string `config:"slack_auto_link_org_label_key"`
	SlackAutoLinkOrgLabelValue string `config:"slack_auto_link_org_label_value"`

	// InternalEmailDomains: creator emails matching these skip the default
	// slack-auto-link label seeding in CreateOrg.
	InternalEmailDomains []string `config:"internal_email_domains"`

	// SFTrialEndpoint posts a Salesforce trial-signup record when a user creates
	// their first org. Empty disables the integration (e.g. BYOC/self-hosted).
	SFTrialEndpoint string `config:"sf_trial_access_endpoint"`

	// Blob storage configuration. Provider selects the backend: "s3" (default,
	// AWS-hosted installs) or "gcs" (self-hosted control-plane installs on GCP,
	// where BlobStorageBucket is a native GCS bucket rather than S3).
	BlobStorageBucket string `config:"blob_storage_bucket" validate:"required"`
	BlobStorageRegion string `config:"blob_storage_region" validate:"required"`

	AppBundleStorageProvider          string        `config:"app_bundle_storage_provider" validate:"omitempty,oneof=s3 gcs"`
	AppBundleStorageBucket            string        `config:"app_bundle_storage_bucket"`
	AppBundleStorageRegion            string        `config:"app_bundle_storage_region"`
	AppBundleStorageEndpoint          string        `config:"app_bundle_storage_endpoint"`
	AppBundleStorageForcePathStyle    bool          `config:"app_bundle_storage_force_path_style"`
	AppBundleStoragePrefix            string        `config:"app_bundle_storage_prefix"`
	AppBundleStorageGCSServiceAccount string        `config:"app_bundle_storage_gcs_service_account"`
	AppBundleGrantTTL                 time.Duration `config:"app_bundle_grant_ttl"`

	BlobStorageProvider string `config:"blob_storage_provider" validate:"required,oneof=s3 gcs"`

	// Enqueuer worker pool size — how many signals can be enqueued in parallel.
	EnqueuerMaxWorkers int `config:"enqueuer_max_workers"`

	// Heartbeater configuration — batched ClickHouse writes for runner heartbeats.
	HeartbeaterFlushInterval time.Duration `config:"heartbeater_flush_interval"`
	HeartbeaterBatchSize     int           `config:"heartbeater_batch_size"`

	// DisableEmitterSignals when true causes all emitter-originated signals to be
	// skipped (not emitted and not processed).
	DisableEmitterSignals bool `config:"disable_emitter_signals"`

	// Flow check thresholds
	StalePlanThreshold string `config:"stale_plan_threshold"`

	// UseLegacyMaintenanceRoleDefault keeps component and action defaults on
	// maintenance instead of deriving them from the parent workflow type.
	UseLegacyMaintenanceRoleDefault bool `config:"use_legacy_maintenance_role_default"`
}