konfig

type Instance string

type Konfig struct {
	// contains filtered or unexported fields
}

type NotificationConfig struct {
	Email struct {
		Enabled  bool // true when SMTP_* env vars are present
		SMTPHost string
		SMTPPort int
		SMTPUser string
		SMTPPass string
		From     string // optional override for From: header
	}

	Slack struct {
		Enabled bool   // true when SLACK_WEBHOOK_URL is present
		Webhook string // default webhook URL
	}

	// DefaultInterval is the fallback notification interval when neither the
	// team nor the Katalog YAML defines one.
	DefaultInterval time.Duration
}

type SecurityConfig struct {
	ServiceName struct {
		Runtime string
		Gateway string
	}

	DeletionProtection struct {
		Enabled           bool
		CleanupOnShutdown bool
		ServiceName       string
		FailurePolicy     string
	}
	Webhooks struct {
		Admission struct {
			Enabled bool
		}
		CleanupOnShutdown bool
		FailurePolicy     string
		ServiceName       string
		// TLS paths — shared with deletion protection, admission, and conversion.
		// Set by ensureSecurity() after cert generation/loading.
		TLSCert string
		TLSKey  string

		Housekeeper struct {
			Enabled      bool
			SyncInterval time.Duration
		}
	}
	// Conversion is separate from admission webhooks — conversion has its own
	// /convert endpoint, window stats, and CRD patch logic.
	Conversion struct {
		Enabled bool
		// ConversionWindow is the rolling window size for latency/throughput stats.
		ConversionWindow  int
		CleanupOnShutdown bool // TODO
	}

	// NamespaceProtection controls the optional validating webhook that prevents
	// Orkestra-managed CRs from being created or updated in forbidden namespaces.
	//
	// This is an admission-time safeguard only. If disabled, namespace rules are
	// not enforced at apply time. If enabled, the webhook blocks CRs whose target
	// namespace violates the CRD’s declared allowedNamespaces or restrictedNamespaces.
	//
	// The webhook is managed by the housekeeper and will be recreated if
	// deleted, ensuring continuous enforcement when enabled.
	//
	// Precedence: Katalog YAML > SecurityConfig (ENV) > hard default.
	NamespaceProtection struct {
		Enabled           bool
		FailurePolicy     string
		ServiceName       string
		CleanupOnShutdown bool
	}

	// CertManager controls the lifecycle of Orkestra’s auto-generated TLS certificate.
	// Only applies when certificates are auto-generated (TLS_CERT/TLS_KEY not set).
	//
	// Precedence: Katalog YAML > SecurityConfig (ENV) > hard default.
	CertManager struct {
		// AutoRotate enables pre-emptive certificate rotation before expiry.
		// Default: true. Set TLS_AUTO_ROTATE=false to opt out.
		AutoRotate bool
		// RotationThreshold is how far before expiry Orkestra rotates.
		// Parsed from TLS_ROTATION_THRESHOLD env (e.g. "30d"). Default: "30d".
		RotationThreshold string
		// ValidFor is the default certificate validity duration.
		// Parsed from TLS_ROTATE_AFTER env (e.g. "30d"). Default: "1y".
		ValidFor string
	}
}