config

type Api struct {
	SessionTimeout          time.Duration
	ActivityUpdateBatchSize int
	ActivityUpdateInterval  time.Duration

	Listener      string
	Address       string
	IdentityCaPem []byte
	HttpTimeouts  HttpTimeouts
}

type CertValidatingIdentity struct {
	identity.Identity
}

type Config struct {
	Id                     *identity.TokenId
	SpiffeIdTrustDomain    *url.URL
	AdditionalTrustDomains []*url.URL

	Raft    *RaftConfig
	Network *NetworkConfig
	Edge    *EdgeConfig
	Db      boltz.Db
	Trace   struct {
		Handler *channel.TraceHandler
	}
	Profile struct {
		Memory struct {
			Path     string
			Interval time.Duration
		}
		CPU struct {
			Path string
		}
	}
	Ctrl struct {
		Listener transport.Address
		Options  *CtrlOptions
	}
	HealthChecks struct {
		BoltCheck struct {
			Interval     time.Duration
			Timeout      time.Duration
			InitialDelay time.Duration
		}
	}
	RouterDataModel common.RouterDataModelConfig

	Command struct {
		RateLimiter command.RateLimiterConfig
	}

	TlsHandshakeRateLimiter command.AdaptiveRateLimitTrackerConfig
	Src                     map[interface{}]interface{}
}

type CtrlOptions struct {
	*channel.Options
	NewListener            *transport.Address
	AdvertiseAddress       *transport.Address
	RouterHeartbeatOptions *channel.HeartbeatOptions
	PeerHeartbeatOptions   *channel.HeartbeatOptions
}

type EdgeConfig struct {
	Enabled              bool
	Api                  Api
	Oidc                 Oidc
	Enrollment           Enrollment
	IdentityStatusConfig IdentityStatusConfig

	Totp            Totp
	AuthRateLimiter command.AdaptiveRateLimiterConfig

	DisablePostureChecks bool
	ExternalJwtSigners   ExternalJwtSigners
	// contains filtered or unexported fields
}

type Enrollment struct {
	SigningCert       identity.Identity
	SigningCertConfig identity.Config
	SigningCertCaPem  []byte
	EdgeIdentity      EnrollmentOption
	EdgeRouter        EnrollmentOption
}

type EnrollmentOption struct {
	Duration time.Duration
}

type ExternalJwtSigners struct {
	JwksFetch JwksFetch
}

type HttpTimeouts struct {
	ReadTimeoutDuration       time.Duration
	ReadHeaderTimeoutDuration time.Duration
	WriteTimeoutDuration      time.Duration
	IdleTimeoutsDuration      time.Duration
}

type IdentityStatusConfig struct {
	Source         IdentityStatusSource
	ScanInterval   time.Duration
	UnknownTimeout time.Duration
}

type IdentityStatusSource uint32

type JwksFetch struct {
	// BlockPrivateAddresses blocks private and loopback addresses (address gate tier 4).
	// Defaults to false so deployments with an internal IdP keep working; tier 1 applies
	// regardless.
	BlockPrivateAddresses bool

	// DeniedIPs are CIDRs that are always blocked (address gate tier 2), above
	// AllowedIPs.
	DeniedIPs []*net.IPNet

	// AllowedIPs are CIDRs that carve an exception out of BlockPrivateAddresses
	// (address gate tier 3). They do not override tier 1 or DeniedIPs.
	AllowedIPs []*net.IPNet

	// DeniedHostnames are normalized hostname patterns that are blocked (hostname gate tier 1). Host
	// matching only ever narrows what may be fetched: it cannot authorize an address the
	// address gate blocks, and a caller can still reach the same target under another name,
	// so the address gate remains the boundary.
	DeniedHostnames []string

	// AllowedHostnames are normalized hostname patterns that, when non-empty, are the only hosts that
	// may be fetched (hostname gate tier 2). Entries are an exact hostname (idp.example.com) or a
	// wildcard suffix (*.example.com), which matches any subdomain but not the suffix itself.
	AllowedHostnames []string

	// Timeout bounds the total time spent on a single JWKS fetch, including redirects.
	Timeout time.Duration

	// MaxRedirects bounds how many redirects a JWKS fetch will follow. Every hop is
	// address-checked. Zero disables redirects.
	MaxRedirects int
}

type NetworkConfig struct {
	CreateCircuitRetries    uint32
	CycleSeconds            uint32
	EnableLegacyLinkMgmt    bool
	InitialLinkLatency      time.Duration
	IntervalAgeThreshold    time.Duration
	MetricsReportInterval   time.Duration
	MinRouterCost           uint16
	PendingLinkTimeout      time.Duration
	RouteTimeout            time.Duration
	RouterConnectChurnLimit time.Duration
	RouterComm              struct {
		QueueSize  uint32
		MaxWorkers uint32
	}
	Smart struct {
		RerouteFraction float32
		RerouteCap      uint32
		MinCostDelta    uint32
	}
}

type Oidc struct {
	AccessTokenDuration  time.Duration
	RefreshTokenDuration time.Duration
	IdTokenDuration      time.Duration

	// RevocationMinTokenLifetime skips revocation for refresh tokens that expire
	// within this duration. Unset (zero) means always revoke. Must be less than
	// 50% of RefreshTokenDuration if set.
	RevocationMinTokenLifetime time.Duration

	// RevocationBucketInterval is the bucket window for batching refresh-token
	// revocations before flushing them through raft.
	RevocationBucketInterval time.Duration

	// RevocationBucketMaxSize is the maximum number of revocations per raft
	// log entry / DB transaction when flushing.
	RevocationBucketMaxSize int

	// RevocationMaxQueued is the maximum number of revocations that can
	// accumulate in memory before new ones are dropped.
	RevocationMaxQueued int

	// RevocationEnforcerFrequency is how often the controller purges expired
	// revocation records from the database.
	RevocationEnforcerFrequency time.Duration
}

type RaftConfig struct {
	Recover               bool
	DataDir               string
	AdvertiseAddress      transport.Address
	CommandHandlerOptions struct {
		MaxQueueSize uint16
	}

	SnapshotInterval  time.Duration
	SnapshotThreshold uint32
	TrailingLogs      uint32
	MaxAppendEntries  *uint32

	ElectionTimeout    time.Duration
	CommitTimeout      *time.Duration
	HeartbeatTimeout   time.Duration
	LeaderLeaseTimeout time.Duration

	LogLevel *string
	Logger   hclog.Logger

	WarnWhenLeaderlessFor time.Duration

	ApplyTimeout time.Duration
	RateLimiter  command.AdaptiveRateLimitTrackerConfig
}

type Totp struct {
	Hostname string
}