server

type Config struct {
	// DatabaseURL is PODIUM_DATABASE_URL. Required.
	DatabaseURL string
	// Transport is PODIUM_TRANSPORT: dev (default), tailnet or host.
	Transport string
	// LocalListen is PODIUM_LOCAL_LISTEN, default 127.0.0.1:8080. It must be loopback.
	LocalListen string
	// LocalToken is PODIUM_LOCAL_TOKEN, the shared bearer token of the local transport.
	LocalToken string
	// LocalAllowUnsafeListen is PODIUM_LOCAL_ALLOW_UNSAFE_LISTEN: let LocalListen bind an address
	// that is not loopback. A container deployment needs it — loopback inside a container is
	// the container's own, so nothing could reach the server — and the published port is the
	// boundary there. On a host it publishes the whole API to anything that can route to the
	// address, guarded by one static token, so the server warns loudly when it is on.
	LocalAllowUnsafeListen bool

	// MasterKeyFile is PODIUM_MASTER_KEY_FILE: the file holding the 32-byte AES-256 key
	// every stored secret is encrypted under. The file must not be readable by other
	// accounts on the machine or the server refuses to start. Empty disables secrets.
	MasterKeyFile string
	// MasterKey is PODIUM_MASTER_KEY, the same key inline. It is a development
	// convenience — an environment variable is visible in /proc and in `docker inspect` —
	// and the server warns loudly when it is used. MasterKeyFile wins if both are set.
	// SENSITIVE: never log it.
	MasterKey string

	// TSHostname is PODIUM_TS_HOSTNAME: the Tailscale device name, and therefore the first
	// label of the MagicDNS name the server is reached at.
	TSHostname string
	// TSStateDir is PODIUM_TS_STATE_DIR: where tsnet keeps the device's node key. It must
	// persist across restarts or the server registers a new device every time.
	TSStateDir string
	// TSAuthKey is TS_AUTHKEY, read on the first run only. This is the *Tailscale* auth key —
	// reusable, pre-approved, tagged tag:podium-server — not a Podium enrollment token.
	// SENSITIVE: never log it.
	TSAuthKey string
	// TSRequiredNodeTag is PODIUM_TS_REQUIRED_NODE_TAG: the ACL tag a device must carry to be
	// treated as a worker.
	TSRequiredNodeTag string
	// TSAllowUntaggedNodes is PODIUM_TS_ALLOW_UNTAGGED_NODES: let an untagged tailnet device
	// enroll as a node. It removes the network-level proof that a caller is an authorised
	// worker and exists only for a tailnet that has no ACL tags yet.
	TSAllowUntaggedNodes bool

	// AgentURL is PODIUM_AGENT_URL: where podium-agent, the conductor, listens. Setting it
	// makes the server reverse-proxy /podium.agent.v1.AgentService/ to that address behind
	// its own identity middleware, which is the only way a browser reaches the conductor.
	// Empty means this control plane has no conductor and nothing is mounted.
	AgentURL string
	// AgentToken is PODIUM_AGENT_TOKEN: the bearer the proxy presents to the conductor. It
	// is also the conductor's proof that a proxied request came through this server, which
	// is what makes the X-Podium-Login header trustworthy at the other end.
	// SENSITIVE: never log it.
	AgentToken string

	// S3 is the PODIUM_S3_* object store: where artifacts and rolled-up logs live. An
	// empty endpoint disables artifacts entirely, which is a supported configuration —
	// a task does not need artifacts to run.
	S3 artifacts.Config
	// Rollup is the log roll-up schedule.
	Rollup logs.RollupConfig
}

type Server struct {
	// contains filtered or unexported fields
}