monitor

type MonitorTemplateData struct {
	// Ports — single value drives both sides of the host:container
	// publish mapping AND the container's own listener config (Prometheus
	// --web.listen-address, OpenSearch http.port, Dashboards SERVER_PORT,
	// otel-collector receiver endpoints in otel-config.yaml.tmpl). User
	// changes one knob in Settings.Monitoring and host + internal move
	// together.
	OtelCollectorPort        int
	OtelGRPCPort             int // independent of HTTP port
	OtelInfraPort            int // mTLS-gated host-loopback receiver for trusted infra push (clawker-cp + firewall Envoy + CoreDNS)
	PrometheusPort           int
	PrometheusMetricsPort    int
	OpenSearchPort           int
	OpenSearchDashboardsPort int

	// OpenSearch JVM heap (MB) for both -Xms and -Xmx.
	OpenSearchHeapMB int

	// Service hostnames on clawker-net (compose service keys + cross-service
	// references). Mirror consts.MonitoringService*.
	OtelCollectorService        string
	PrometheusService           string
	OpenSearchNodeService       string
	OpenSearchDashboardsService string

	// Host-side paths for CLI-issued mTLS material that gates the
	// trusted otlp/infra receiver. Populated unconditionally by
	// `monitor init` from internal/consts after EnsureAuthMaterial
	// succeeds. The otel-config.yaml template renders the otlp/infra
	// receiver and trusted pipelines unconditionally — it has no
	// `{{ if }}` gate. Degradation is sender-side only: when an infra
	// sender (CP / Envoy / CoreDNS) lacks a valid client cert it stays
	// off this lane (see internal/monitor/CLAUDE.md "Trusted block
	// conditionality"). compose.yaml.tmpl gates the bind mounts + port
	// publish on OtelInfraPort, so a zero port suppresses the host-side
	// wiring even though the receiver block is still emitted into
	// otel-config.
	OtelServerCertHostPath string
	OtelServerKeyHostPath  string
	OtelCAHostPath         string

	// Host paths consumed by the otel-collector's hostmetrics +
	// docker_stats receivers. HostFilesystem is hardcoded to "/" — Linux
	// host root or Docker Desktop VM root; mounted RO at /hostfs.
	// DockerSocketPath comes from Settings.Docker.Socket (defaults to
	// /var/run/docker.sock); mounted RO at /var/run/docker.sock.
	HostFilesystem   string
	DockerSocketPath string

	// Container images — version + SHA256 pinned.
	OtelCollectorImage        string
	PrometheusImage           string
	OpenSearchImage           string
	OpenSearchDashboardsImage string
	CurlImage                 string

	// OpenSearchBootstrapDirName is the subdir of the rendered monitor
	// workdir that holds bootstrap.sh + index-templates/ + ism-policies/
	// + saved-objects/. Bind-mounted into the bootstrap container at
	// /opensearch-bootstrap. Lifted to a template field so the compose
	// volume mount and the on-disk layout stay in sync from one constant.
	OpenSearchBootstrapDirName string
}