config

type AgentConfig struct {
	AgentID  string `yaml:"agent_id" json:"agent_id"`
	Hostname string `yaml:"hostname" json:"hostname"`
	// ServerURL is the FallBCK server (reverse proxy) URL; HTTP API and Temporal gRPC
	// are both reached through it
	ServerURL string `yaml:"server_url" json:"server_url"`
	DataDir   string `yaml:"data_dir" json:"data_dir"`
	TaskQueue string `yaml:"task_queue" json:"task_queue"`
	Namespace string `yaml:"namespace" json:"namespace"`
	// AuthToken is the agent bearer token issued at enrollment
	AuthToken      string    `yaml:"auth_token" json:"-"`
	TokenExpiresAt time.Time `yaml:"token_expires_at" json:"token_expires_at"`
	// ServerCACertPath optionally trusts a private CA for ServerURL
	ServerCACertPath   string `yaml:"server_ca_cert_path" json:"server_ca_cert_path"`
	InsecureSkipVerify bool   `yaml:"insecure_skip_verify" json:"insecure_skip_verify"`
	// EnrollmentKey triggers self-enrollment on first start
	EnrollmentKey string `yaml:"enrollment_key" json:"-"`
}

type AgentTokensConfig struct {
	TTL time.Duration `yaml:"ttl" json:"ttl"`
}

type AuthConfig struct {
	OIDC       OIDCConfig    `yaml:"oidc" json:"oidc"`
	SessionTTL time.Duration `yaml:"session_ttl" json:"session_ttl"`
	// InsecureDisable turns admin authentication off. Development only; the server
	// refuses it unless started with --dev.
	InsecureDisable bool `yaml:"insecure_disable" json:"insecure_disable"`
}

type DatabaseConfig struct {
	URL             string        `yaml:"url" json:"url"`
	MaxOpenConns    int           `yaml:"max_open_conns" json:"max_open_conns"`
	MaxIdleConns    int           `yaml:"max_idle_conns" json:"max_idle_conns"`
	ConnMaxLifetime time.Duration `yaml:"conn_max_lifetime" json:"conn_max_lifetime"`
	AutoMigrate     bool          `yaml:"auto_migrate" json:"auto_migrate"`
}

type EmbeddedTemporalConfig struct {
	BindIP string `yaml:"bind_ip" json:"bind_ip"`
	// PortBase is the loopback frontend port; the other services use PortBase+1..+6
	PortBase int `yaml:"port_base" json:"port_base"`
	// DatabaseURL defaults to the application database URL (database name is replaced)
	DatabaseURL string `yaml:"database_url" json:"database_url"`
	// HistoryShards is immutable after the first start
	HistoryShards int32         `yaml:"history_shards" json:"history_shards"`
	Retention     time.Duration `yaml:"retention" json:"retention"`
	// ClusterName is immutable after the first start (default "fallbck"); set it to the
	// existing cluster name when adopting databases created by another Temporal deployment
	ClusterName string `yaml:"cluster_name" json:"cluster_name"`
}

type OIDCConfig struct {
	Issuer       string   `yaml:"issuer" json:"issuer"`
	ClientID     string   `yaml:"client_id" json:"client_id"`
	ClientSecret string   `yaml:"client_secret" json:"-"`
	Scopes       []string `yaml:"scopes" json:"scopes"`
	// AllowedGroups restricts login to identities whose groups claim contains one of these (empty = any)
	AllowedGroups []string `yaml:"allowed_groups" json:"allowed_groups"`
	// AllowedEmails restricts login to these email addresses (empty = any)
	AllowedEmails []string `yaml:"allowed_emails" json:"allowed_emails"`
	// GroupsClaim is the ID token claim carrying group membership (default "groups")
	GroupsClaim string `yaml:"groups_claim" json:"groups_claim"`
}

type ServerConfig struct {
	// HTTPPort / HTTPBind: the single plaintext h2c listener behind the reverse proxy
	HTTPPort int    `yaml:"http_port" json:"http_port"`
	HTTPBind string `yaml:"http_bind" json:"http_bind"`
	// PublicURL is the reverse proxy's externally reachable URL (OIDC redirect,
	// install script, enrollment response)
	PublicURL string `yaml:"public_url" json:"public_url"`
	JWTSecret string `yaml:"jwt_secret" json:"jwt_secret"`
	DataDir   string `yaml:"data_dir" json:"data_dir"`
	// AgentCABundlePath optionally points at a PEM bundle agents should trust for the
	// public URL (private CAs); it is handed out at enrollment
	AgentCABundlePath string `yaml:"agent_ca_bundle_path" json:"agent_ca_bundle_path"`

	Auth        AuthConfig           `yaml:"auth" json:"auth"`
	AgentTokens AgentTokensConfig    `yaml:"agent_tokens" json:"agent_tokens"`
	Database    DatabaseConfig       `yaml:"database" json:"database"`
	Temporal    TemporalServerConfig `yaml:"temporal" json:"temporal"`
}

type TemporalConfig struct {
	HostPort           string        `yaml:"host_port" json:"host_port"`
	Namespace          string        `yaml:"namespace" json:"namespace"`
	EnableTLS          bool          `yaml:"enable_tls" json:"enable_tls"`
	CACertPath         string        `yaml:"ca_cert_path" json:"ca_cert_path"`
	ClientCertPath     string        `yaml:"client_cert_path" json:"client_cert_path"`
	ClientKeyPath      string        `yaml:"client_key_path" json:"client_key_path"`
	ServerName         string        `yaml:"server_name" json:"server_name"`
	InsecureSkipVerify bool          `yaml:"insecure_skip_verify" json:"insecure_skip_verify"`
	ConnectTimeout     time.Duration `yaml:"connect_timeout" json:"connect_timeout"`
}

type TemporalServerConfig struct {
	Mode      string                 `yaml:"mode" json:"mode"`
	Namespace string                 `yaml:"namespace" json:"namespace"`
	Embedded  EmbeddedTemporalConfig `yaml:"embedded" json:"embedded"`
	External  TemporalConfig         `yaml:"external" json:"external"`
	UI        TemporalUIConfig       `yaml:"ui" json:"ui"`
}

type TemporalUIConfig struct {
	Enabled bool `yaml:"enabled" json:"enabled"`
	// Port is the loopback port the UI server listens on
	Port int `yaml:"port" json:"port"`
}