config

type AgentConfig struct {
	AgentID  string `yaml:"agent_id" json:"agent_id"`
	Hostname string `yaml:"hostname" json:"hostname"`
	// ServerURL is the FallBCK server (reverse proxy) URL; HTTP API and Temporal gRPC
	// are both reached through it
	ServerURL string `yaml:"server_url" json:"server_url"`
	DataDir   string `yaml:"data_dir" json:"data_dir"`
	TaskQueue string `yaml:"task_queue" json:"task_queue"`
	Namespace string `yaml:"namespace" json:"namespace"`
	// AuthToken is the agent bearer token issued at enrollment
	AuthToken      string    `yaml:"auth_token" json:"-"`
	TokenExpiresAt time.Time `yaml:"token_expires_at" json:"token_expires_at"`
	// ServerCACertPath optionally trusts a private CA for ServerURL
	ServerCACertPath   string `yaml:"server_ca_cert_path" json:"server_ca_cert_path"`
	InsecureSkipVerify bool   `yaml:"insecure_skip_verify" json:"insecure_skip_verify"`
	// VSS (Windows only) backs up from a Volume Shadow Copy of each volume so open
	// and locked files are read consistently; default true
	VSS *bool `yaml:"vss,omitempty" json:"vss,omitempty"`
	// EnrollmentKey triggers self-enrollment on first start
	EnrollmentKey string `yaml:"enrollment_key" json:"-"`
	// LogLevel sets the agent's base log level (debug, info, warn, error); the DEBUG /
	// FALLBCK_LOG_LEVEL environment variables take precedence, and the server can
	// raise the level to debug at runtime (per-agent toggle in the web UI)
	LogLevel string `yaml:"log_level,omitempty" json:"log_level,omitempty"`
	// DBBackup configures database jobs on fallbck-agent (spool, tools, credential profiles)
	DBBackup dbbackup.Config `yaml:"db_backup,omitempty" json:"db_backup"`
	// DockerBackup configures Docker host jobs on fallbck-agent (socket, volume
	// access mode, helper image)
	DockerBackup dockerbackup.Config `yaml:"docker_backup,omitempty" json:"docker_backup"`
	// MaxConcurrentActivities caps how many server-scheduled activities (backup runs,
	// volume uploads, log and inventory requests) the agent runs at once. Default 16:
	// room for a kubernetes job's 8 parallel volumes plus a few runs, while a burst
	// of work (or a misbehaving server) cannot start hundreds of dumps on one host.
	MaxConcurrentActivities int `yaml:"max_concurrent_activities,omitempty" json:"max_concurrent_activities,omitempty"`
}

type AgentTokensConfig struct {
	TTL time.Duration `yaml:"ttl" json:"ttl"`
}

type AuditConfig struct {
	// Retention is how long entries stay in the database; a daily prune deletes older
	// ones. 0 keeps everything. Default 8760h (a year).
	Retention time.Duration `yaml:"retention" json:"retention"`
	// Export receives every entry right before it is pruned, as JSON lines: an
	// absolute file path (appended), http(s)://... (POSTed as application/x-ndjson),
	// udp://host:port or tcp://host:port (syslog), or syslog: (the local syslog).
	// Empty: pruned entries are gone.
	Export string `yaml:"export" json:"export"`
	// ExportHeaders are added to HTTP exports, e.g. Authorization for a log collector
	ExportHeaders map[string]string `yaml:"export_headers" json:"-"`
}

type AuthConfig struct {
	OIDC       OIDCConfig    `yaml:"oidc" json:"oidc"`
	SessionTTL time.Duration `yaml:"session_ttl" json:"session_ttl"`
	// InsecureDisable turns admin authentication off. Development only; the server
	// refuses it unless started with --dev.
	InsecureDisable bool `yaml:"insecure_disable" json:"insecure_disable"`
}

type DatabaseConfig struct {
	URL             string        `yaml:"url" json:"url"`
	MaxOpenConns    int           `yaml:"max_open_conns" json:"max_open_conns"`
	MaxIdleConns    int           `yaml:"max_idle_conns" json:"max_idle_conns"`
	ConnMaxLifetime time.Duration `yaml:"conn_max_lifetime" json:"conn_max_lifetime"`
	AutoMigrate     bool          `yaml:"auto_migrate" json:"auto_migrate"`
}

type EmbeddedTemporalConfig struct {
	BindIP string `yaml:"bind_ip" json:"bind_ip"`
	// PortBase is the loopback frontend port; the other services use PortBase+1..+6
	PortBase int `yaml:"port_base" json:"port_base"`
	// DatabaseURL defaults to the application database URL (database name is replaced)
	DatabaseURL string `yaml:"database_url" json:"database_url"`
	// HistoryShards is immutable after the first start
	HistoryShards int32         `yaml:"history_shards" json:"history_shards"`
	Retention     time.Duration `yaml:"retention" json:"retention"`
	// ClusterName is immutable after the first start (default "fallbck"); set it to the
	// existing cluster name when adopting databases created by another Temporal deployment
	ClusterName string `yaml:"cluster_name" json:"cluster_name"`
}

type OIDCConfig struct {
	Issuer       string   `yaml:"issuer" json:"issuer"`
	ClientID     string   `yaml:"client_id" json:"client_id"`
	ClientSecret string   `yaml:"client_secret" json:"-"`
	Scopes       []string `yaml:"scopes" json:"scopes"`
	// AllowedGroups restricts login to identities whose groups claim contains one of these (empty = any)
	AllowedGroups []string `yaml:"allowed_groups" json:"allowed_groups"`
	// AllowedEmails restricts login to these email addresses (empty = any)
	AllowedEmails []string `yaml:"allowed_emails" json:"allowed_emails"`
	// GroupsClaim is the ID token claim carrying group membership (default "groups")
	GroupsClaim string `yaml:"groups_claim" json:"groups_claim"`
	// BindingClaims are further ID token claims (string or list of strings) that
	// "claim" role bindings can match, e.g. Entra app roles in "roles". Unset: roles.
	// An empty list turns claim bindings off.
	BindingClaims []string `yaml:"binding_claims" json:"binding_claims"`
}

type SecurityConfig struct {
	// MasterKeyFile holds 64 hex characters; generated on first start when missing
	// (default <data_dir>/master.key). Back it up together with the database: the
	// sealed secrets, including backup encryption keys, are unreadable without it.
	MasterKeyFile string `yaml:"master_key_file" json:"master_key_file"`
	// MasterKey is the key itself (64 hex characters) for container deployments
	// (FALLBCK_MASTER_KEY); it takes precedence over the file
	MasterKey string `yaml:"master_key,omitempty" json:"-"`
}

type ServerConfig struct {
	// HTTPPort / HTTPBind: the single plaintext h2c listener behind the reverse proxy
	HTTPPort int    `yaml:"http_port" json:"http_port"`
	HTTPBind string `yaml:"http_bind" json:"http_bind"`
	// PublicURL is the reverse proxy's externally reachable URL (OIDC redirect,
	// install script, enrollment response)
	PublicURL string `yaml:"public_url" json:"public_url"`
	// TrustedProxies are the CIDRs of reverse proxies whose X-Forwarded-For entries are
	// believed when determining a client's IP (default: loopback and private ranges)
	TrustedProxies []string `yaml:"trusted_proxies" json:"trusted_proxies"`
	// JWTSecret signs sessions, agent tokens and tickets; empty = generated into
	// <data_dir>/jwt.secret on first start
	JWTSecret string `yaml:"jwt_secret" json:"jwt_secret"`
	DataDir   string `yaml:"data_dir" json:"data_dir"`
	// AgentCABundlePath optionally points at a PEM bundle agents should trust for the
	// public URL (private CAs); it is handed out at enrollment
	AgentCABundlePath string `yaml:"agent_ca_bundle_path" json:"agent_ca_bundle_path"`
	// Timezone (IANA name) governs cron schedules and next-run display; empty =
	// auto-detect from TZ / the host zone, falling back to UTC
	Timezone string `yaml:"timezone" json:"timezone"`

	Auth        AuthConfig           `yaml:"auth" json:"auth"`
	AgentTokens AgentTokensConfig    `yaml:"agent_tokens" json:"agent_tokens"`
	Database    DatabaseConfig       `yaml:"database" json:"database"`
	Temporal    TemporalServerConfig `yaml:"temporal" json:"temporal"`
	Security    SecurityConfig       `yaml:"security" json:"security"`
	Audit       AuditConfig          `yaml:"audit" json:"audit"`
}

type TemporalConfig struct {
	HostPort           string `yaml:"host_port" json:"host_port"`
	Namespace          string `yaml:"namespace" json:"namespace"`
	EnableTLS          bool   `yaml:"enable_tls" json:"enable_tls"`
	CACertPath         string `yaml:"ca_cert_path" json:"ca_cert_path"`
	ClientCertPath     string `yaml:"client_cert_path" json:"client_cert_path"`
	ClientKeyPath      string `yaml:"client_key_path" json:"client_key_path"`
	ServerName         string `yaml:"server_name" json:"server_name"`
	InsecureSkipVerify bool   `yaml:"insecure_skip_verify" json:"insecure_skip_verify"`
}

type TemporalServerConfig struct {
	Mode      string                 `yaml:"mode" json:"mode"`
	Namespace string                 `yaml:"namespace" json:"namespace"`
	Embedded  EmbeddedTemporalConfig `yaml:"embedded" json:"embedded"`
	External  TemporalConfig         `yaml:"external" json:"external"`
	UI        TemporalUIConfig       `yaml:"ui" json:"ui"`
}

type TemporalUIConfig struct {
	Enabled bool `yaml:"enabled" json:"enabled"`
	// Port is the loopback port the UI server listens on
	Port int `yaml:"port" json:"port"`
	// ReadOnly hides the UI's write actions (terminate, cancel, signal, reset,
	// schedule edits). The UI is not label-scoped, so anyone with temporal:ui could
	// otherwise stop any team's backups. Default true.
	ReadOnly bool `yaml:"read_only" json:"read_only"`
}