config

type Config struct {
	// ListenAddr is the address the terminal WebSocket proxy listens on.
	// Flag: --listen-addr  Env: WSPROXY_LISTEN_ADDR  Default: :9003
	ListenAddr string

	// InternalAddr is the address the internal management API listens on.
	// Only used when SyncToken is non-empty.
	// Flag: --internal-addr  Env: WSPROXY_INTERNAL_ADDR  Default: :9004
	InternalAddr string

	// ClustersFilePath is the path to clusters.yaml consumed by cluster.Store.
	// Flag: --clusters-config  Env: CLUSTERS_CONFIG_PATH
	ClustersFilePath string

	// Secret is the single shared secret used for:
	//   - dialling Worker /v1/ws/sync endpoints (AGENTBOX-SYNC-TOKEN header);
	//   - gating the legacy /internal/* routes (static token check);
	//   - verifying Bearer JWTs issued by the BFF (HS256).
	// When empty the sync manager is disabled and JWT auth is off.
	// Flag: --secret  Env: AGENTBOX_SECRET
	Secret string

	// AdminKey is the shared admin API key used by the internal API auth
	// middleware to recognise admin callers via AGENTBOX-API-KEY header.
	// When empty the internal API runs in dev mode (anonymous admin).
	// Flag: --admin-key  Env: AGENTBOX_ADMIN_KEY
	AdminKey string

	// MaxKeysPerUser is the per-(namespace, user) API key count limit.
	// 0 means unlimited.
	// Flag: --max-keys-per-user  Env: AGENTBOX_MAX_KEYS_PER_USER
	MaxKeysPerUser int

	// APIKeyNamespace is the Kubernetes namespace where API key Secrets are stored.
	// Flag: --apikey-namespace  Env: AGENTBOX_APIKEY_NAMESPACE  Default: agentbox-system
	APIKeyNamespace string

	// ImagesCatalogConfigMap is the name of the ConfigMap that holds the images
	// catalog. It is stored in APIKeyNamespace.
	// Flag: --images-catalog-configmap  Env: AGENTBOX_IMAGES_CATALOG_CONFIGMAP
	// Default: agentbox-images-catalog
	ImagesCatalogConfigMap string

	// ManagedAgentEnabled starts the ManagedAgent controller alongside the
	// proxy. It lives here rather than in the worker binary because a
	// ManagedAgent is a control-plane object: the worker chart installs on
	// every cluster, so reconciling it there would run one controller per
	// cluster for a single set of resources.
	// Flag: --managed-agent  Env: AGENTBOX_MANAGED_AGENT_ENABLED  Default: false
	ManagedAgentEnabled bool

	// ManagedAgentGatewayAddr is the listener that serves published agents to
	// callers outside the cluster. It is separate from the internal API because
	// that one trusts a manager token: an ingress may only be pointed at a port
	// where every request carries its own credential. Empty disables publishing.
	ManagedAgentGatewayAddr string

	// ManagedAgentPublicBaseURL is the shared route published agents answer on,
	// e.g. "https://console.example.com/agentbox/api/managed-agents". It is
	// configuration rather than something the controller can derive: only the
	// chart knows the hostname and base path the ingress was created with.
	ManagedAgentPublicBaseURL string

	// ManagedAgentProxyService is this process as in-cluster callers address it,
	// "<service>.<namespace>:<port>". Reported as status.endpoint so nothing
	// hands out the Brain's own unauthenticated address.
	ManagedAgentProxyService string

	// ManagedAgentNamespace restricts the controller's cache and watches to one
	// namespace. Empty watches all namespaces, which needs cluster-wide RBAC.
	// Flag: --managed-agent-namespace  Env: AGENTBOX_MANAGED_AGENT_NAMESPACE
	ManagedAgentNamespace string
}