server

type Config struct {
	// Domain enables email + autocert, e.g. "agents.example.com".
	Domain string
	// DataDir holds the SQLite database and blob directory.
	DataDir string
	// HTTPAddr is the HTTP(S) listen address. Defaults to ":443" when Domain
	// is set (autocert) and ":8080" otherwise.
	HTTPAddr string
	// SMTPAddr is the inbound SMTP listen address (":25" when Domain is set;
	// empty disables).
	SMTPAddr string
	// Outbound is the relay: "resend:<key>", "smtp://user:pass@host:587" or
	// "smtps://...". Empty disables outbound email.
	Outbound string
	// AdminToken gates signup and admin endpoints. Generated and printed on
	// first boot if unset.
	AdminToken string
	// OpenSignup allows unauthenticated signup (rate-limited per IP, owner
	// email verification required before outbound send).
	OpenSignup bool
	// PublicURL overrides the advertised base URL (useful behind a proxy).
	PublicURL string
	// ACMEEmail is the optional Let's Encrypt account email.
	ACMEEmail string
	// BehindProxy disables autocert and trusts X-Forwarded-For.
	BehindProxy bool

	// Connect (client side): URL of a connect host to borrow a public
	// subdomain and email service from, e.g. "https://agenttransfer.dev".
	// The instance registers anonymously, keeps one outbound tunnel open,
	// and needs no domain, DNS, open ports, or relay of its own.
	Connect string
	// ConnectDomain (host side): serve the connect service for
	// "*.<ConnectDomain>" subdomains. Requires Domain mode (TLS + SMTP);
	// usually set equal to Domain.
	ConnectDomain string
	// ConnectSendRate caps relayed outbound emails per connected instance
	// per day (spam blast radius).
	ConnectSendRate int64
	// ConnectBytesPerDay caps proxied bytes per connected instance per day
	// (egress cost + abuse blast radius).
	ConnectBytesPerDay int64

	MaxFileSize  int64
	DefaultTTL   time.Duration
	MaxTTL       time.Duration
	SendRate     int64 // outbound emails per agent per day
	UploadRate   int64 // uploads per agent per day
	StorageQuota int64 // live folder bytes per agent
	// StorageQuotaUnverified is the folder cap for agents whose owner has not
	// verified yet — anonymous signups get a small drive until a human vouches.
	StorageQuotaUnverified int64
	// HumanRecipientsMax caps the unique remote (non-local) addresses an agent
	// may ever email — the "circle": a compromised agent can spam at most this
	// many strangers. The verified owner is always exempt; <0 disables the cap.
	HumanRecipientsMax int64
	Metrics            string // off | localhost | admin

	// DiskReserve is the global backstop against disk fill: uploads are
	// refused (507) while the volume holding DataDir has less free space than
	// this. "10%" of the volume, an absolute size like "50GB", or "off".
	// Applied only when set — FromEnv defaults it to "10%"; hand-built configs
	// (tests, demo) leave it off unless they opt in.
	DiskReserve string
	// MaxAgentsPerOwner caps how many agents one owner_email can register via
	// open signup — identities must not be free in bulk. <0 disables.
	MaxAgentsPerOwner int64
	// IPRate is the per-IP hourly request budget on the public unauthenticated
	// pages (/f/, /u/, index). IPv4 keys per address, IPv6 per /64. <=0
	// disables — FromEnv defaults it to 600.
	IPRate int64
	// UploadBodyTimeout bounds how long one upload request may spend sending
	// its body (slow-body parking defense). It is a read deadline only —
	// downloads deliberately have no write timeout. <=0 disables — FromEnv
	// defaults it to 1h.
	UploadBodyTimeout time.Duration
	// UnverifiedFileTTL makes files owned by agents WITHOUT a verified owner
	// expire — the storage mirror of the quota tier: anonymous signups get a
	// scratchpad, verified owners get the drive. Verifying lifts the expiry
	// on the agent's existing files. <=0 disables — FromEnv defaults it
	// to 24h.
	UnverifiedFileTTL time.Duration
}

type Server struct {
	// contains filtered or unexported fields
}