deployment

type Conf struct {
	Conf string `json:"conf,omitempty"`
}

type DeployConfig struct {
	Prod *DeployEnvConfig `json:"prod,omitempty"`
	Test *DeployEnvConfig `json:"test,omitempty"`
}

type DeployEnvConfig struct {
	// Embed the existing services-config fields (URLs, PKs, servers).
	EnvServices `json:",inline"`

	// Per-service operational config.
	Services struct {
		DmsgDiscovery      *ServiceConfig `json:"dmsg_discovery,omitempty"`
		TransportDiscovery *ServiceConfig `json:"transport_discovery,omitempty"`
		AddressResolver    *ServiceConfig `json:"address_resolver,omitempty"`
		RouteFinder        *ServiceConfig `json:"route_finder,omitempty"`
		ServiceDiscovery   *ServiceConfig `json:"service_discovery,omitempty"`
		SetupNode          *ServiceConfig `json:"setup_node,omitempty"`
		NetworkMonitor     *ServiceConfig `json:"network_monitor,omitempty"`
		ConfService        *ServiceConfig `json:"conf_service,omitempty"`
		GeoIP              *ServiceConfig `json:"geoip,omitempty"`
		Stun               *ServiceConfig `json:"stun,omitempty"`
		TransportSetup     *ServiceConfig `json:"transport_setup,omitempty"`
	} `json:"services,omitempty"`

	// DmsgServers lists dmsg server instances for this environment.
	DmsgServerInstances []DmsgServerConfig `json:"dmsg_server_instances,omitempty"`

	// Infrastructure.
	Redis struct {
		URL      string `json:"url,omitempty"`
		Password string `json:"password,omitempty"`
	} `json:"redis,omitempty"`
}

type DmsgServerConfig struct {
	// Name is the container/instance name (e.g., "dmsg-server-1").
	Name string `json:"name"`

	// ConfigFile is the path to the dmsg server's JSON config.
	ConfigFile string `json:"config_file"`

	// PublicPort is the host port mapped to the server's listen port.
	PublicPort int `json:"public_port"`

	// PprofAddr is the pprof listen address.
	PprofAddr string `json:"pprof,omitempty"`
}

type DmsgServerEntry struct {
	Static string `json:"static"`
	Server struct {
		Address string `json:"address"`
		// AddressWS is the optional full ws:// or wss:// WebSocket URL (including
		// the /dmsg path, e.g. "wss://dmsg1.example.net/dmsg") a browser client
		// seeds from. It is SEPARATE from Address (IP:port, TCP): native visors
		// dial Address and never look at AddressWS, so advertising a wss:// domain
		// here adds no DNS/TLS dependency for them. Required for a wasm-visor
		// served over HTTPS, whose browser blocks plain ws:// (mixed content); a
		// wss domain's CA cert is stable, so it lives safely in the embedded config.
		AddressWS string `json:"address_ws,omitempty"`
	} `json:"server"`
}

type EnvServices struct {
	Test json.RawMessage `json:"test"`
	Prod json.RawMessage `json:"prod"`
}

type KeyPair struct {
	PK cipher.PubKey `json:"pk"`
	SK cipher.SecKey `json:"sk"`
}

type Keyring struct {
	// Services
	DmsgDiscovery      *KeyPair `json:"dmsg_discovery,omitempty"`
	TransportDiscovery *KeyPair `json:"transport_discovery,omitempty"`
	AddressResolver    *KeyPair `json:"address_resolver,omitempty"`
	RouteFinder        *KeyPair `json:"route_finder,omitempty"`
	ServiceDiscovery   *KeyPair `json:"service_discovery,omitempty"`
	SetupNode          *KeyPair `json:"setup_node,omitempty"`
	ConfService        *KeyPair `json:"conf_service,omitempty"`
	NetworkMonitor     *KeyPair `json:"network_monitor,omitempty"`

	// DMSG servers (multiple)
	DmsgServers []NamedKeyPair `json:"dmsg_servers,omitempty"`

	// Route setup nodes (multiple — includes embedded RSN keys)
	RouteSetupNodes []NamedKeyPair `json:"route_setup_nodes,omitempty"`

	// Transport setup nodes (multiple — includes embedded TPS keys)
	TransportSetupNodes []NamedKeyPair `json:"transport_setup_nodes,omitempty"`

	// Survey whitelist
	SurveyWhitelist []NamedKeyPair `json:"survey_whitelist,omitempty"`

	// Network monitor keys (multiple — for deregistration authorization)
	NetworkMonitorKeys []NamedKeyPair `json:"network_monitor_keys,omitempty"`

	// Reward system
	RewardSystem *KeyPair `json:"reward_system,omitempty"`

	// Visor (the deployment's own visor, if any)
	Visor *KeyPair `json:"visor,omitempty"`
}

type NamedKeyPair struct {
	Name string        `json:"name"`
	PK   cipher.PubKey `json:"pk"`
	SK   cipher.SecKey `json:"sk"`
}

type ServiceConfig struct {
	// Addr is the HTTP listen address (e.g., ":9094").
	Addr string `json:"addr,omitempty"`

	// Keyfile is the path to a file containing the service's secret key.
	// Preferred over inline SK for security.
	Keyfile string `json:"keyfile,omitempty"`

	// Redis is the Redis connection URL (e.g., "redis://redis:6379").
	Redis string `json:"redis,omitempty"`

	// RedisPoolSize is the Redis connection pool size.
	RedisPoolSize int `json:"redis_pool_size,omitempty"`

	// DmsgDisc is the DMSG discovery URL used by this service.
	DmsgDisc string `json:"dmsg_disc,omitempty"`

	// PprofAddr is the pprof HTTP listen address (e.g., ":6094").
	PprofAddr string `json:"pprof,omitempty"`

	// EntryTimeout is the TTL for entries managed by this service.
	EntryTimeout string `json:"entry_timeout,omitempty"`

	// WhitelistKeys are network monitor PKs authorized to deregister entries.
	WhitelistKeys []string `json:"whitelist_keys,omitempty"`

	// Mode is the listener mode: "http", "dmsg", or "dual".
	Mode string `json:"mode,omitempty"`

	// ConfigFile is a path to an additional service-specific config file
	// (e.g., dmsg-server config.json, setup-node config.json).
	ConfigFile string `json:"config_file,omitempty"`

	// GodebugEnv is the GODEBUG environment variable value.
	GodebugEnv string `json:"godebug,omitempty"`
}

type Services struct {
	// HTTP endpoints
	DmsgDiscovery      string          `json:"dmsg_discovery,omitempty"`
	TransportDiscovery string          `json:"transport_discovery,omitempty"`
	AddressResolver    string          `json:"address_resolver,omitempty"`
	RouteFinder        string          `json:"route_finder,omitempty"`
	RouteSetupNodes    []cipher.PubKey `json:"route_setup_nodes,omitempty"`
	TransportSetupPKs  []cipher.PubKey `json:"transport_setup,omitempty"`
	ServiceDiscovery   string          `json:"service_discovery,omitempty"`
	StunServers        []string        `json:"stun_servers,omitempty"`
	DNSServer          string          `json:"dns_server,omitempty"`
	GeoIP              string          `json:"geoip,omitempty"` // HTTP only (dmsg doesn't preserve client IP)
	SurveyWhitelist    []cipher.PubKey `json:"survey_whitelist,omitempty"`
	// DMSG endpoints (dmsg:// URLs for the same services)
	ConfDmsg    string            `json:"conf_dmsg,omitempty"`
	DmsgServers []DmsgServerEntry `json:"dmsg_servers,omitempty"`
	// WSSDomainSuffix is the deployment-wide DNS suffix the official dmsg servers
	// self-derive their wss:// AddressWS from — "wss://<DNSLabel(PK)>.<suffix>/dmsg"
	// — so an HTTPS-served browser wasm-visor reaches them without mixed content.
	// One string for the whole fleet (each server self-labels from its own PK), so
	// the domain lives in exactly one place (this file) instead of every dmsg
	// server's local config. A dmsg server applies it only when its own PK is a
	// known fleet server (IsKnownDmsgServer) — a third party running this binary
	// never mis-advertises this domain for a PK with no DNS record.
	WSSDomainSuffix string `json:"wss_domain_suffix,omitempty"`
	// WSSDomainAliases are earlier suffixes a known server still answers on
	// and gets certificates for, without advertising them, so browser modules
	// built with an old name keep reaching it while the fleet moves.
	WSSDomainAliases []string `json:"wss_domain_aliases,omitempty"`
	// BrowseOriginSuffix is the deployment-wide domain the "real-origin" browse
	// path (pkg/visor/meshproxy.go, the wasm SW browse origin, and the hosted
	// Caddy front) serves untrusted mesh content under — e.g. ".theskywirenetwork.net"
	// (a SEPARATE eTLD+1 from the visor app on WSSDomainSuffix, so untrusted
	// browsed content is cookie/origin-isolated from the visor identity). Lives
	// here so the domain is defined in exactly one place instead of being
	// hardcoded across the serve flags / config-gen / docs; consumers read it via
	// deployment.Prod.BrowseOriginSuffix. Empty (the local default) means the
	// browse origin uses ".mesh.localhost" (loopback, secure-context, no cert).
	BrowseOriginSuffix string `json:"browse_origin_suffix,omitempty"`
	// WasmModuleSource is the visor that serves the current js/wasm module over
	// dmsg. Visors refresh their copy from it when the desk is opened.
	WasmModuleSource       string `json:"wasm_module_source,omitempty"`
	DmsgDiscoveryDmsg      string `json:"dmsg_discovery_dmsg,omitempty"`
	TransportDiscoveryDmsg string `json:"transport_discovery_dmsg,omitempty"`
	AddressResolverDmsg    string `json:"address_resolver_dmsg,omitempty"`
	RouteFinderDmsg        string `json:"route_finder_dmsg,omitempty"`
	ServiceDiscoveryDmsg   string `json:"service_discovery_dmsg,omitempty"`
	// Reward system
	RewardSystem     string `json:"reward_system,omitempty"`
	RewardSystemDmsg string `json:"reward_system_dmsg,omitempty"`
}