config

type ACME struct {
	Directory string `yaml:"directory"`
	Email     string `yaml:"email"`
}

type Auth struct {
	APIKeys          string `yaml:"api_keys"`
	Provider         string `yaml:"provider"`
	Token            string `yaml:"token"`
	AllowRemoteAdmin bool   `yaml:"allow_remote_admin"`
}

type Client struct {
	Timeout time.Duration `yaml:"timeout"`
	Retries int           `yaml:"retries"`
}

type Config struct {
	Server    Server    `yaml:"server"`
	DataDir   string    `yaml:"data_dir"`
	Client    Client    `yaml:"client"`
	Docker    Docker    `yaml:"docker"`
	Namespace string    `yaml:"namespace"`
	Auth      Auth      `yaml:"auth"`
	Resources Resources `yaml:"resources"`
	Log       Log       `yaml:"log"`
	Secret    struct {
		Encryption SecretEncryption `yaml:"encryption"`
		Limits     store.Limits     `yaml:"limits"`
	} `yaml:"secret"`
	ConfigResource struct {
		Limits store.Limits `yaml:"limits"`
	} `yaml:"config"`
	Plugins    Plugins    `yaml:"plugins"`
	Networking Networking `yaml:"networking"`
	Telemetry  Telemetry  `yaml:"telemetry"`
	Node       Node       `yaml:"node"`
	Ingress    Ingress    `yaml:"ingress"`
	ACME       ACME       `yaml:"acme"`
	Storage    Storage    `yaml:"storage"`
}

type Docker struct {
	APIVersion                string                 `yaml:"api_version"`
	FallbackAPIVersion        string                 `yaml:"fallback_api_version"`
	NegotiationTimeoutSeconds int                    `yaml:"negotiation_timeout_seconds"`
	Registries                []DockerRegistryConfig `yaml:"registries"`
}

type DockerRegistryAuth struct {
	Type       string            `yaml:"type"` // basic | token | ecr
	Username   string            `yaml:"username"`
	Password   string            `yaml:"password"`
	Token      string            `yaml:"token"`
	Region     string            `yaml:"region"`
	FromSecret any               `yaml:"fromSecret"` // string or {name,namespace}
	Bootstrap  bool              `yaml:"bootstrap"`
	Manage     string            `yaml:"manage"` // create|update|ignore
	Immutable  bool              `yaml:"immutable"`
	Data       map[string]string `yaml:"data"` // inline source (env-expanded)
}

type DockerRegistryConfig struct {
	Name     string             `yaml:"name"`
	Registry string             `yaml:"registry"`
	Auth     DockerRegistryAuth `yaml:"auth"`
}

type Ingress struct {
	HTTPAddr  string `yaml:"http_addr"`
	HTTPSAddr string `yaml:"https_addr"`
}

type KEKConfig struct {
	Source     string `yaml:"source"`
	File       string `yaml:"file"`
	Passphrase struct {
		Enabled bool   `yaml:"enabled"`
		Env     string `yaml:"env"`
	} `yaml:"passphrase"`
}

type Log struct {
	Level  string `yaml:"level"`
	Format string `yaml:"format"`
}

type Networking struct {
	ClusterCIDR string `yaml:"cluster_cidr"`
	DevMode     bool   `yaml:"dev_mode"`
}

type Node struct {
	Role string `yaml:"role"`
}

type Plugins struct {
	Dir     string   `yaml:"dir"`
	Enabled []string `yaml:"enabled"`
}

type Resources struct {
	CPU struct {
		DefaultRequest string `yaml:"default_request"`
		DefaultLimit   string `yaml:"default_limit"`
	} `yaml:"cpu"`
	Memory struct {
		DefaultRequest string `yaml:"default_request"`
		DefaultLimit   string `yaml:"default_limit"`
	} `yaml:"memory"`
}

type SecretEncryption struct {
	Enabled bool      `yaml:"enabled"`
	KEK     KEKConfig `yaml:"kek"`
}

type Server struct {
	GRPCAddr string `yaml:"grpc_address"`
	HTTPAddr string `yaml:"http_address"`
	TLS      TLS    `yaml:"tls"`
}

type Storage struct {
	// DefaultStorageClass selects which StorageClass is marked
	// Default:true at orchestrator boot. *string so the empty-string
	// case ("no cluster default — error on missing storageClassName")
	// is distinguishable from "unset → keep built-in default".
	DefaultStorageClass *string `yaml:"defaultStorageClass,omitempty"`

	// PreserveOnDelete, when true, converts ReclaimPolicy:delete to
	// retain for volumes provisioned by the in-tree "local" driver.
	// Useful for single-node dev clusters where accidental rm -rf is
	// unrecoverable.
	PreserveOnDelete bool `yaml:"preserveOnDelete,omitempty"`

	// AllowCreateMissing, when true, lets drivers auto-create missing
	// host paths instead of failing validation. Plumbed through to the
	// driver layer; per-driver enforcement is a separate slice.
	AllowCreateMissing bool `yaml:"allowCreateMissing,omitempty"`

	Drivers map[string]map[string]any `yaml:"drivers,omitempty"`
}

type TLS struct {
	Enabled  bool   `yaml:"enabled"`
	CertFile string `yaml:"cert_file"`
	KeyFile  string `yaml:"key_file"`
}

type Telemetry struct {
	MetricsAddr string `yaml:"metrics_addr"`
}