serverconf

type ServerConfig struct {
	// Mode controls TLS and tenant resolution behaviour.
	// "dev" = no TLS, permissive CORS, Vite HMR proxy
	// "standalone" = ACME TLS, configurable CORS
	// "managed" = HMAC tenant header verification, Valkey config cache
	Mode string `envconfig:"SUPATYPE_MODE" default:"dev"`

	// SupatypeURL is the public base URL of this deployment (injected into the Deno edge subprocess as SUPATYPE_URL).
	// When empty, serve passes API_EXTERNAL_URL from GoTrue config as a fallback for the Deno child only.
	SupatypeURL string `envconfig:"SUPATYPE_URL"`

	// AnonKey is the publishable anon JWT (SUPATYPE_ANON_KEY for edge functions).
	AnonKey string `envconfig:"SUPATYPE_ANON_KEY"`

	// CorsAllowOrigins is a comma-separated allowlist of browser Origins for CORS
	// (standalone: applied to all requests; managed: union with manifest cors_allowed_origins,
	// applied outside tenant HMAC so OPTIONS preflight is not blocked).
	CorsAllowOrigins string `envconfig:"SUPATYPE_CORS_ALLOW_ORIGINS"`

	// AppMode controls how the root path "/" is handled.
	// "none" = 404
	// "static" = serve files from AppStaticDir
	// "proxy" = reverse proxy to AppUpstream
	AppMode string `envconfig:"SUPATYPE_APP_MODE" default:"none"`

	// AppStaticDir is the directory to serve static files from (AppMode=static).
	AppStaticDir string `envconfig:"SUPATYPE_APP_STATIC_DIR"`

	// StaticCacheHTML overrides Cache-Control for HTML and SPA fallback (manifest may override).
	StaticCacheHTML string `envconfig:"SUPATYPE_STATIC_CACHE_HTML"`

	// StaticCacheHashedAssets overrides Cache-Control for hashed asset URL prefixes (manifest may override).
	StaticCacheHashedAssets string `envconfig:"SUPATYPE_STATIC_CACHE_HASHED_ASSETS"`

	// StaticCachePrefixesJSON is optional JSON object mapping URL path prefix → Cache-Control.
	// Example: {"\/blog\/":"public, max-age=300"}. Manifest static_cache_prefixes merges over these keys.
	StaticCachePrefixesJSON string `envconfig:"SUPATYPE_STATIC_CACHE_PREFIXES_JSON"`

	// AppSPAFallback enables serving index.html for unmatched paths (AppMode=static).
	AppSPAFallback bool `envconfig:"SUPATYPE_APP_SPA_FALLBACK" default:"true"`

	// AppUpstream is the URL to reverse proxy to (AppMode=proxy).
	AppUpstream string `envconfig:"SUPATYPE_APP_UPSTREAM"`

	// ViteDevURL is the Vite dev server base URL for HMR when SUPATYPE_MODE=dev (e.g. http://127.0.0.1:5173).
	// When empty, dev mode falls back to SUPATYPE_APP_UPSTREAM only if app mode is not "proxy".
	ViteDevURL string `envconfig:"SUPATYPE_VITE_DEV_URL"`

	// TLSDomain is the domain to provision a Let's Encrypt certificate for (Mode=standalone).
	TLSDomain string `envconfig:"SUPATYPE_TLS_DOMAIN"`

	// TLSACMECacheDir is the directory to cache ACME certificates in.
	TLSACMECacheDir string `envconfig:"SUPATYPE_TLS_ACME_CACHE_DIR" default:"~/.supatype/acme"`

	// ACMEHTTPAddr is the listen address for the HTTP-01 challenge handler (standalone + TLS domain).
	// Default ":80". Use e.g. ":8080" when binding port 80 is not possible (you must forward port 80 externally).
	ACMEHTTPAddr string `envconfig:"SUPATYPE_ACME_HTTP_ADDR" default:":80"`

	// ManifestPath is the path to the .supatype/manifest.json route manifest file.
	ManifestPath string `envconfig:"SUPATYPE_MANIFEST_PATH" default:".supatype/manifest.json"`

	// AdminConfigPath is the path to the .supatype/admin-config.json file generated by the engine.
	// Served at POST /studio-config for the Studio UI.
	AdminConfigPath string `envconfig:"SUPATYPE_ADMIN_CONFIG_PATH" default:".supatype/admin-config.json"`

	// ApiConfigPath is the path to the .supatype/api-config.json file managed by the admin API.
	ApiConfigPath string `envconfig:"SUPATYPE_API_CONFIG_PATH" default:".supatype/api-config.json"`

	// TenantHMACSecret is the shared HMAC secret for verifying X-Supatype-Tenant-Sig (Mode=managed).
	TenantHMACSecret string `envconfig:"SUPATYPE_TENANT_HMAC_SECRET"`

	// ValkeyAddr is the Valkey/Redis address for tenant config cache (Mode=managed).
	ValkeyAddr string `envconfig:"SUPATYPE_VALKEY_ADDR"`

	// ManagedProjectRef is the cloud project ref (slug) for a single-tenant managed pod.
	// When set with Mode=managed and ValkeyAddr, the route manifest is merged from
	// Valkey keys tenant:{ref}:config and tenant:{ref}:manifest.
	// When empty (with managed + Valkey), manifests are resolved per request from
	// X-Supatype-Tenant (after HMAC verification) with a short TTL cache.
	ManagedProjectRef string `envconfig:"SUPATYPE_MANAGED_PROJECT_REF"`

	// DenoPath is the path to the deno binary.
	DenoPath string `envconfig:"SUPATYPE_DENO_PATH" default:"deno"`

	// DenoFunctionsDir is the directory containing edge functions.
	DenoFunctionsDir string `envconfig:"SUPATYPE_DENO_FUNCTIONS_DIR" default:"functions"`

	// DenoServeScript is the router entry .ts passed to `deno run` (generated by CLI `supatype dev`).
	// When set, Deno invokes this script; otherwise the server falls back to DenoFunctionsDir (legacy).
	DenoServeScript string `envconfig:"SUPATYPE_DENO_SERVE_SCRIPT"`

	// DenoPort is the port deno will listen on (proxied by supatype-server).
	DenoPort string `envconfig:"SUPATYPE_DENO_PORT" default:"8001"`

	// FunctionsWorkerURL is the base URL of an external functions worker (Deno runtime).
	// When set, supatype-server proxies /functions/v1 here and does not start an in-process Deno subprocess.
	FunctionsWorkerURL string `envconfig:"SUPATYPE_FUNCTIONS_WORKER_URL"`

	// RealtimeURL is the base URL of the external realtime service (WebSocket + /health).
	// When set, supatype-server proxies /realtime/v1 here instead of using an in-process hub.
	RealtimeURL string `envconfig:"SUPATYPE_REALTIME_URL"`

	// PostgRESTURL is the upstream PostgREST URL.
	PostgRESTURL string `envconfig:"SUPATYPE_POSTGREST_URL" default:"http://localhost:3000"`

	// GraphQLURL is the upstream pg_graphql URL (typically same host as PostgREST).
	GraphQLURL string `envconfig:"SUPATYPE_GRAPHQL_URL" default:"http://localhost:3000"`

	// StorageURL is the upstream storage service URL (used when StorageProvider != "local").
	StorageURL string `envconfig:"SUPATYPE_STORAGE_URL" default:"http://localhost:5000"`

	// StorageProvider controls which storage backend is used.
	// "local" — built-in filesystem handler (no external service required, dev default).
	// ""      — proxy to StorageURL (production / S3 mode).
	StorageProvider string `envconfig:"STORAGE_PROVIDER"`

	// StoragePath is the root directory for local filesystem storage.
	// Required when StorageProvider == "local".
	StoragePath string `envconfig:"STORAGE_PATH"`

	// JWTSecret is the HS256 secret used to validate Bearer tokens issued by GoTrue.
	// Read from GOTRUE_JWT_SECRET which is always set by the CLI.
	JWTSecret string `envconfig:"GOTRUE_JWT_SECRET"`

	// ServiceRoleKey is used to enrich pg_graphql proxy requests with auth headers.
	ServiceRoleKey string `envconfig:"SUPATYPE_SERVICE_ROLE_KEY"`

	// DBCredentialsKEK is the base64-encoded 32-byte key used to encrypt managed DB credentials in Valkey.
	DBCredentialsKEK string `envconfig:"SUPATYPE_DB_CREDENTIALS_KEK"`

	// AllowSecretReadback controls whether non-managed modes can return DB passwords via admin endpoints.
	AllowSecretReadback bool `envconfig:"SUPATYPE_ALLOW_SECRET_READBACK" default:"false"`

	// OuterLogLevel is the logrus level for supatype-server outer mux JSON access logs only (trace|debug|info|warn|error|fatal|panic).
	// At debug, /health and /health/ready lines are included; at info they are omitted to reduce noise.
	OuterLogLevel string `envconfig:"SUPATYPE_OUTER_LOG_LEVEL" default:"info"`

	// HealthSelfBaseURL overrides the outer base URL used to probe GET /realtime/v1/health from /health/ready
	// (e.g. https://public.example.com when the process cannot infer a correct URL).
	HealthSelfBaseURL string `envconfig:"SUPATYPE_HEALTH_SELF_BASE_URL"`
}