konfig

type Konfig struct {
	// contains filtered or unexported fields
}

type NotificationConfig struct {
	Email struct {
		Enabled  bool // true when SMTP_* env vars are present
		SMTPHost string
		SMTPPort int
		SMTPUser string
		SMTPPass string
		From     string // optional override for From: header
	}

	Slack struct {
		Enabled bool   // true when SLACK_WEBHOOK_URL is present
		Webhook string // default webhook URL
	}

	// DefaultInterval is the fallback notification interval when neither the
	// team nor the Katalog YAML defines one.
	DefaultInterval time.Duration
}

type SecurityConfig struct {
	// One service name per orkestra instance
	ServiceName string

	DeletionProtection struct {
		Enabled           bool
		CleanupOnShutdown bool
		ServiceName       string
		FailurePolicy     string
	}
	Webhooks struct {
		Admission struct {
			Enabled bool
		}
		CleanupOnShutdown bool
		FailurePolicy     string
		ServiceName       string
		// TLS paths — shared with deletion protection, admission, and conversion.
		// Set by ensureSecurity() after cert generation/loading.
		TLSCert string
		TLSKey  string

		Controller struct {
			Enabled      bool
			SyncInterval time.Duration
		}
	}
	// Conversion is separate from admission webhooks — conversion has its own
	// /convert endpoint, window stats, and CRD patch logic.
	Conversion struct {
		Enabled bool
		// ConversionWindow is the rolling window size for latency/throughput stats.
		ConversionWindow  int
		CleanupOnShutdown bool // TODO
	}

	// NamespaceProtection controls the optional validating webhook that prevents
	// Orkestra-managed CRs from being created or updated in forbidden namespaces.
	//
	// This is an admission-time safeguard only. If disabled, namespace rules are
	// not enforced at apply time. If enabled, the webhook blocks CRs whose target
	// namespace violates the CRD’s declared allowedNamespaces or restrictedNamespaces.
	//
	// The webhook is managed by the WebhookController and will be recreated if
	// deleted, ensuring continuous enforcement when enabled.
	//
	// Precedence: Katalog YAML > SecurityConfig (ENV) > hard default.
	NamespaceProtection struct {
		Enabled           bool
		FailurePolicy     string
		ServiceName       string
		CleanupOnShutdown bool
	}
}