dmsgserver

type Config struct {
	Path string `json:"-"`

	PubKey cipher.PubKey `json:"public_key"`
	SecKey cipher.SecKey `json:"secret_key"`

	// Dmsg holds the discovery / servers configuration. Polymorphic
	// JSON: a single object describes a single deployment, an array
	// describes multiple. Folded from the legacy Discovery /
	// DiscoveryDmsg / PublicAddress fields by NormalizedDeployments
	// when this field is unset.
	Dmsg DmsgConfig `json:"dmsg,omitempty"`

	// Discovery, DiscoveryDmsg, and PublicAddress are the legacy
	// single-discovery fields kept so existing config files continue
	// to work without restructuring. NormalizedDeployments folds them
	// into a one-element list when Dmsg.Deployments is empty. When
	// DiscoveryDmsg is set (URL form `dmsg://<PK>:<port>`), the PK is
	// extracted automatically and used to upgrade registration from
	// plain HTTP to dmsgfirst.
	Discovery     string `json:"discovery,omitempty"`
	DiscoveryDmsg string `json:"discovery_dmsg,omitempty"`
	PublicAddress string `json:"public_address,omitempty"`
	// PublicAddressV6 is the optional IPv6 advertised endpoint. When
	// non-empty, the server registers AddressV6 alongside Address in
	// its disc.Entry so dual-stack peers can dial it over IPv6 (the
	// dialer's Happy Eyeballs in Phase 3 picks v6 first when both are
	// present). The local TCP listener is unchanged — wildcard binds
	// already accept both families; this field is purely a discovery
	// advertisement.
	PublicAddressV6 string `json:"public_address_v6,omitempty"`
	// WSAddress is the local "host:port" the server binds a plaintext
	// WebSocket listener on (dmsg-over-WebSocket). Empty disables WS — the
	// default, so no extra port opens unless the operator opts in. TLS for
	// wss:// is expected to be terminated by a front proxy.
	WSAddress string `json:"ws_address,omitempty"`
	// PublicAddressWS is the full ws:// or wss:// URL (including the /dmsg
	// path) that this WS endpoint is reachable at and advertises in discovery
	// (Server.AddressWS), e.g. "wss://dmsg1.skywire.skycoin.com/dmsg". Required
	// when WSAddress is set, otherwise clients learn no URL to dial.
	PublicAddressWS string `json:"public_address_ws,omitempty"`
	// WSSDomainSuffix, when set, makes the server SELF-DERIVE its advertised
	// wss:// WS URL from its own PK: "wss://<base32(PK)>.<suffix>/dmsg" (the
	// base32 PK is the 53-char cipher.PubKey.DNSLabel — a DNS-safe identity
	// label). It overrides the bare ws://IP advertised on the unified main port,
	// so an HTTPS-served browser wasm-visor can reach the server with no mixed
	// content. The WS listener stays plain on the main port; a front proxy
	// (Caddy) terminates TLS for <label>.<suffix> and reverse-proxies to it (the
	// server logs the exact Caddy line on startup). One uniform suffix across all
	// servers is enough — each self-labels — so no per-server URL to hand-match.
	WSSDomainSuffix string `json:"wss_domain_suffix,omitempty"`
	// WSTLSAddress, when set (e.g. ":443"), makes the server SELF-TERMINATE its
	// wss:// endpoint via Let's Encrypt (golang.org/x/crypto/acme/autocert) for
	// its own <DNSLabel(PK)>.<suffix> host — so a dmsg host needs NO external
	// reverse proxy (Caddy). It only ADDS a TLS listener; the plain-ws main port
	// and the wss advert are unchanged, and if the address can't be bound (Caddy
	// or another dmsg server already owns it) the server logs and skips, leaving
	// the external-front path intact. Requires :443 (autocert's TLS-ALPN-01
	// challenge runs on the same port it serves); a host running >1 dmsg server,
	// or one that already serves :443, keeps using Caddy. Needs a wss_domain_suffix
	// (own or deployment-wide) so a cert host can be derived. Empty = disabled.
	WSTLSAddress string `json:"ws_tls_address,omitempty"`
	// WSTLSCacheDir is the on-disk autocert certificate cache, so issued certs
	// survive restarts (Let's Encrypt rate-limits re-issuance). Defaults to
	// "dmsg-autocert" next to the config file.
	WSTLSCacheDir string `json:"ws_tls_cache_dir,omitempty"`
	// WTAddress is the local "host:port" the server binds a UDP socket on for
	// the WebTransport (HTTP/3-over-QUIC) listener (dmsg-over-WebTransport).
	// Empty disables WT — the default, so no extra port opens unless the
	// operator opts in. Unlike WS, no front proxy / CA cert is needed: the
	// server presents a short-lived self-signed ECDSA cert and advertises its
	// SHA-256 (CertHashWT) for a browser to pin.
	WTAddress string `json:"wt_address,omitempty"`
	// PublicAddressWT is the full https:// URL (including the /dmsg path) that
	// this WebTransport endpoint is reachable at and advertises in discovery
	// (Server.AddressWT), e.g. "https://1.2.3.4:8443/dmsg". Required when
	// WTAddress is set, otherwise clients learn no URL to dial. It should use a
	// bare IP (the browser pins the cert hash, not a hostname).
	PublicAddressWT string `json:"public_address_wt,omitempty"`
	// DisableWT opts OUT of the default-on dmsg-over-WebTransport that otherwise
	// rides the main UDP socket (shared with dmsg-over-QUIC, ALPN-demuxed) and is
	// advertised automatically from the public address. Set it on a server whose
	// UDP endpoint genuinely can't serve WT (e.g. a proxy that can't pass HTTP/3).
	DisableWT        bool          `json:"disable_wt,omitempty"`
	LocalAddress     string        `json:"local_address"`
	HTTPAddress      string        `json:"health_endpoint_address"`
	LogLevel         string        `json:"log_level"`
	LogHookLevel     string        `json:"log_hook_level,omitempty"` // most verbose level kept for /debug/log, info when empty
	UpdateInterval   time.Duration `json:"update_interval"`
	MaxSessions      int           `json:"max_sessions"`
	Peers            []PeerConfig  `json:"peers,omitempty"`
	EnableRouteSetup bool          `json:"enable_route_setup,omitempty"`

	// Peer relaying is always on: every server announces itself as a
	// forwardable peer over the links it dials and honors inbound
	// announcements. AcceptedPeerPKs, when non-empty, restricts which
	// announcers are honored (allowlist); empty accepts any. MaxPeerLinks
	// and MaxRelayedStreams bound the relay surface (0 = built-in
	// defaults). There is no toggle to disable relaying.
	AcceptedPeerPKs   []cipher.PubKey `json:"accepted_peer_pks,omitempty"`
	MaxPeerLinks      int             `json:"max_peer_links,omitempty"`
	MaxRelayedStreams int             `json:"max_relayed_streams,omitempty"`
	// RejectRelayedRequests turns off the default acceptance of stream
	// requests that a visor forwards on another key's behalf over its own
	// client session (dmsg over skynet through a host). They are signed by
	// their source key and charged to max_relayed_streams; set this only to
	// make the server relay for peers alone.
	RejectRelayedRequests bool `json:"reject_relayed_requests,omitempty"`
}

type Deployment struct {
	Discovery           string        `json:"discovery,omitempty"`
	DiscoveryDmsg       string        `json:"discovery_dmsg,omitempty"`
	SessionsCount       int           `json:"sessions_count,omitempty"`
	Servers             []*disc.Entry `json:"servers,omitempty"`
	AdvertisedAddress   string        `json:"advertised_address,omitempty"`
	AdvertisedAddressV6 string        `json:"advertised_address_v6,omitempty"`
}

type DmsgConfig struct {
	Deployments []Deployment `json:"-"`
}

type PeerConfig struct {
	PubKey  cipher.PubKey `json:"public_key"`
	Address string        `json:"address"`
}

type ServerAPI struct {
	// contains filtered or unexported fields
}