bridge

type ACMEConfig struct {
	// Enabled controls whether ACME certificate management is active.
	Enabled bool
	// CacheDir is the directory for caching certificates on disk.
	// Used by autocert.DirCache.
	CacheDir string
	// AllowedHosts is the whitelist of hostnames for which certificates may be obtained.
	AllowedHosts []string
	// Email is the contact email for the ACME account (optional, used in registration).
	Email string
	// ACMEDirectoryURL overrides the default ACME directory (e.g., for Let's Encrypt staging).
	// Empty means use the default (Let's Encrypt production).
	ACMEDirectoryURL string
}

type ACMEManager struct {
	// contains filtered or unexported fields
}

type AccessController interface {
	// CreateInterface creates a WireGuard interface with the given name and listen port.
	// Idempotent: creating an already-existing interface with the same config returns nil.
	CreateInterface(name string, listenPort int) error

	// RemoveInterface removes the WireGuard interface with the given name.
	// Idempotent: removing a non-existent interface returns nil.
	RemoveInterface(name string) error

	// ConfigurePeer adds or updates a peer on the given WireGuard interface.
	// Idempotent: re-applying the same peer config returns nil.
	ConfigurePeer(iface string, publicKey string, allowedIPs []string, psk string) error

	// RemovePeer removes a peer from the given WireGuard interface by public key.
	// Idempotent: removing a non-existent peer returns nil.
	RemovePeer(iface string, publicKey string) error
}

type CommandExecutor interface {
	// Run executes a command and returns its combined output.
	Run(ctx context.Context, name string, args ...string) ([]byte, error)
	// Start starts a command without waiting for it to complete.
	// Returns a CommandHandle that can be used to stop the process.
	Start(ctx context.Context, name string, args ...string) (CommandHandle, error)
}

type CommandHandle interface {
	// Stop terminates the process.
	Stop() error
}

type Config struct {
	// Enabled controls whether bridge mode is active.
	// Default: false
	Enabled bool `yaml:"enabled"`

	// AccessInterface is the name of the access-side network interface.
	AccessInterface string `yaml:"access_interface"`

	// AccessSubnets are the CIDR subnets reachable via the access-side interface.
	AccessSubnets []string `yaml:"access_subnets"`

	// EnableNAT controls whether NAT masquerading is applied on the access-side interface.
	// nil means use default (true); explicit false disables NAT.
	EnableNAT *bool `yaml:"enable_nat"`

	// RelayEnabled controls whether the bridge node serves as a relay.
	// Default: false. Requires Enabled=true.
	RelayEnabled bool `yaml:"relay_enabled"`

	// RelayListenPort is the UDP port for relay traffic.
	// Default: 51821
	RelayListenPort int `yaml:"relay_listen_port"`

	// MaxRelaySessions is the maximum number of concurrent relay sessions.
	// Default: 100
	MaxRelaySessions int `yaml:"max_relay_sessions"`

	// SessionTTL is the time-to-live for relay sessions.
	// Default: 5m. Minimum: 30s.
	SessionTTL time.Duration `yaml:"session_ttl"`

	// UserAccessEnabled controls whether user access integration is active.
	// Default: false. Requires Enabled=true.
	UserAccessEnabled bool `yaml:"user_access_enabled"`

	// UserAccessInterfaceName is the name of the WireGuard interface for user access.
	// Default: "wg-access"
	UserAccessInterfaceName string `yaml:"user_access_interface_name"`

	// UserAccessListenPort is the UDP port for the user access WireGuard interface.
	// Default: 51822
	UserAccessListenPort int `yaml:"user_access_listen_port"`

	// MaxAccessPeers is the maximum number of concurrent user access peers.
	// Default: 50
	MaxAccessPeers int `yaml:"max_access_peers"`

	// UserAccessProviderType selects the external VPN provider for user access.
	// Supported values: "tailscale", "netbird", or "" (disabled).
	UserAccessProviderType string `yaml:"user_access_provider_type"`

	// AuthKeyEnv is the environment variable name containing the auth key
	// for the user access provider (e.g. "PLEXD_TAILSCALE_AUTH_KEY").
	AuthKeyEnv string `yaml:"auth_key_env"`

	// SetupKeyEnv is the environment variable name containing the setup key
	// for the user access provider (e.g. "PLEXD_NETBIRD_SETUP_KEY").
	SetupKeyEnv string `yaml:"setup_key_env"`

	// IngressEnabled controls whether public ingress is active.
	// Default: false. Requires Enabled=true.
	IngressEnabled bool `yaml:"ingress_enabled"`

	// MaxIngressRules is the maximum number of concurrent ingress rules.
	// Default: 20
	MaxIngressRules int `yaml:"max_ingress_rules"`

	// IngressDialTimeout is the timeout for dialing target mesh peers.
	// Default: 10s. Minimum: 1s.
	IngressDialTimeout time.Duration `yaml:"ingress_dial_timeout"`

	// SiteToSiteEnabled controls whether site-to-site VPN connectivity is active.
	// Default: false. Requires Enabled=true.
	SiteToSiteEnabled bool `yaml:"site_to_site_enabled"`

	// SiteToSiteInterfacePrefix is the prefix for WireGuard interfaces used by site-to-site tunnels.
	// Each tunnel gets an interface named {prefix}{index}.
	// Default: "wg-s2s-"
	SiteToSiteInterfacePrefix string `yaml:"site_to_site_interface_prefix"`

	// SiteToSiteListenPort is the base UDP port for site-to-site WireGuard interfaces.
	// Each tunnel uses this port + tunnel index offset.
	// Default: 51823
	SiteToSiteListenPort int `yaml:"site_to_site_listen_port"`

	// MaxSiteToSiteTunnels is the maximum number of concurrent site-to-site tunnels.
	// Default: 10
	MaxSiteToSiteTunnels int `yaml:"max_site_to_site_tunnels"`

	// TunnelProviders lists the tunnel provider types to enable for site-to-site connectivity.
	// Supported values: "ipsec", "openvpn". Empty means WireGuard-only.
	TunnelProviders []string `yaml:"tunnel_providers"`

	// ACMEEnabled controls whether ACME certificate management is active for ingress.
	// Default: false. Requires IngressEnabled=true.
	ACMEEnabled bool `yaml:"acme_enabled"`

	// ACMECacheDir is the directory for caching ACME certificates.
	ACMECacheDir string `yaml:"acme_cache_dir"`

	// ACMEAllowedHosts is the whitelist of hostnames for ACME certificate issuance.
	ACMEAllowedHosts []string `yaml:"acme_allowed_hosts"`

	// ACMEEmail is the contact email for the ACME account.
	ACMEEmail string `yaml:"acme_email"`

	// ACMEDirectoryURL overrides the default ACME directory URL.
	// Empty means the default (Let's Encrypt production).
	ACMEDirectoryURL string `yaml:"acme_directory_url"`
}

type IPsecProvider struct {
	// contains filtered or unexported fields
}

type IngressController interface {
	// Listen creates a TCP listener on the given address.
	// If tlsCfg is non-nil, the listener will accept TLS connections.
	// Returns the listener and any error.
	Listen(addr string, tlsCfg *tls.Config) (net.Listener, error)

	// Close closes the given listener.
	// Idempotent: closing an already-closed listener returns nil.
	Close(listener net.Listener) error
}

type IngressManager struct {
	// contains filtered or unexported fields
}

type Manager struct {
	// contains filtered or unexported fields
}

type NetbirdProvider struct {
	// contains filtered or unexported fields
}

type NetlinkAccessController struct {
	// contains filtered or unexported fields
}

type NetlinkRouteController struct {
	// contains filtered or unexported fields
}

type NetlinkVPNController struct {
	// contains filtered or unexported fields
}

type OpenVPNProvider struct {
	// contains filtered or unexported fields
}

type ProviderStatus struct {
	// Running indicates whether the provider process is active.
	Running bool `json:"running"`

	// InterfaceName is the network interface created by the provider.
	InterfaceName string `json:"interface_name,omitempty"`

	// IP is the IP address assigned by the provider.
	IP string `json:"ip,omitempty"`

	// Error holds the last error message, if any.
	Error string `json:"error,omitempty"`
}

type ReconcileTrigger interface {
	TriggerReconcile()
}

type Relay struct {
	// contains filtered or unexported fields
}

type RelaySession struct {
	SessionID string
	PeerAAddr *net.UDPAddr
	PeerBAddr *net.UDPAddr
	// contains filtered or unexported fields
}

type RouteController interface {
	// EnableForwarding enables IP forwarding between the mesh and access interfaces.
	EnableForwarding(meshIface, accessIface string) error

	// DisableForwarding reverses the forwarding setup.
	DisableForwarding(meshIface, accessIface string) error

	// AddRoute adds a route for the given CIDR subnet via the given interface.
	// Idempotent: adding an existing route returns nil.
	AddRoute(subnet, iface string) error

	// RemoveRoute removes the route for the given CIDR subnet via the given interface.
	// Idempotent: removing a non-existent route returns nil.
	RemoveRoute(subnet, iface string) error

	// AddNATMasquerade configures NAT masquerading on the given interface.
	AddNATMasquerade(iface string) error

	// RemoveNATMasquerade removes NAT masquerading from the given interface.
	// Idempotent: removing non-existent masquerade returns nil.
	RemoveNATMasquerade(iface string) error
}

type SNIRoute struct {
	Hostname    string // SNI hostname to match (exact match, lowercase)
	BackendAddr string // TCP address to forward to (host:port)
}

type SNIRouter struct {
	// contains filtered or unexported fields
}

type SiteToSiteManager struct {
	// contains filtered or unexported fields
}

type StdCommandExecutor struct{}

type StdIngressController struct {
	// contains filtered or unexported fields
}

type TailscaleProvider struct {
	// contains filtered or unexported fields
}

type TunnelConfig struct {
	// TunnelID is the unique identifier for this tunnel.
	TunnelID string `json:"tunnel_id"`

	// LocalSubnets are the local CIDR subnets to expose through the tunnel.
	LocalSubnets []string `json:"local_subnets"`

	// RemoteSubnets are the remote CIDR subnets reachable through the tunnel.
	RemoteSubnets []string `json:"remote_subnets"`

	// RemoteEndpoint is the remote tunnel peer address (host:port or IP).
	RemoteEndpoint string `json:"remote_endpoint"`

	// PSK is the pre-shared key for tunnel authentication.
	PSK string `json:"psk"`

	// Extra holds provider-specific configuration parameters.
	Extra map[string]string `json:"extra,omitempty"`
}

type TunnelProvider interface {
	// Name returns the provider identifier (e.g. "ipsec", "openvpn").
	Name() string

	// CreateTunnel establishes a tunnel with the given configuration.
	// The context controls the tunnel lifetime.
	// Returns an error if the tunnel cannot be created or already exists.
	CreateTunnel(ctx context.Context, cfg TunnelConfig) error

	// RemoveTunnel tears down the tunnel with the given ID.
	// Idempotent: removing a non-existent tunnel returns nil.
	RemoveTunnel(tunnelID string) error

	// TunnelStatus returns the status of the tunnel with the given ID.
	// Returns a zero-value TunnelStatus with Running=false if the tunnel
	// does not exist.
	TunnelStatus(tunnelID string) TunnelStatus

	// ActiveTunnels returns the IDs of all active tunnels.
	ActiveTunnels() []string

	// Stop gracefully shuts down all tunnels managed by this provider.
	// Idempotent: calling Stop when no tunnels are active returns nil.
	Stop() error
}

type TunnelStatus struct {
	// TunnelID is the unique identifier for this tunnel.
	TunnelID string `json:"tunnel_id"`

	// Running indicates whether the tunnel is active.
	Running bool `json:"running"`

	// InterfaceName is the network interface used by the tunnel.
	InterfaceName string `json:"interface_name,omitempty"`

	// Error holds the last error message, if any.
	Error string `json:"error,omitempty"`
}

type UserAccessManager struct {
	// contains filtered or unexported fields
}

type UserAccessProvider interface {
	// Name returns the provider identifier (e.g. "tailscale", "netbird").
	Name() string

	// Start launches the provider daemon/process. The auth credential
	// (auth key, setup key) is read from the environment by the implementation.
	// The context controls the provider lifetime — cancelling it should trigger
	// a graceful stop.
	Start(ctx context.Context) error

	// Stop gracefully shuts down the provider and removes its network interface.
	// Idempotent: calling Stop when not running returns nil.
	Stop() error

	// Status returns the current provider status.
	Status() ProviderStatus
}

type VPNController interface {
	// CreateTunnelInterface creates a WireGuard interface for a site-to-site tunnel.
	// name is the interface name, listenPort is the UDP port.
	// Idempotent: creating an already-existing interface with the same config returns nil.
	CreateTunnelInterface(name string, listenPort int) error

	// RemoveTunnelInterface removes the WireGuard interface with the given name.
	// Idempotent: removing a non-existent interface returns nil.
	RemoveTunnelInterface(name string) error

	// ConfigureTunnelPeer configures the remote peer on the given tunnel interface.
	// publicKey is base64-encoded, allowedIPs are the remote subnets, endpoint is host:port.
	// psk may be empty if not used.
	// Idempotent: re-applying the same config returns nil.
	ConfigureTunnelPeer(iface string, publicKey string, allowedIPs []string, endpoint string, psk string) error

	// RemoveTunnelPeer removes the remote peer from the given tunnel interface.
	// Idempotent: removing a non-existent peer returns nil.
	RemoveTunnelPeer(iface string, publicKey string) error
}