config

type AWSAccount struct {
	Account string   `yaml:"account"`
	Name    string   `yaml:"name"`
	Issuer  string   `yaml:"issuer"`
	JWKSURI string   `yaml:"jwksUri,omitempty"`
	OrgID   string   `yaml:"orgId,omitempty"`
	Algs    []string `yaml:"algs,omitempty"`
}

type AWSFederation struct {
	// Audience the role must request from sts:GetWebIdentityToken.
	// Required whenever an account is listed: it is the trust boundary.
	Audience string `yaml:"audience,omitempty"`
	// MaxAge refuses a token whose `iat` is older. Default 5m, at most 1h.
	MaxAge *Duration `yaml:"maxAge,omitempty"`
	// Accounts are the trusted accounts.
	Accounts []AWSAccount `yaml:"accounts,omitempty"`
}

type AdapterChoice struct {
	Adapter  string         `json:"adapter"`
	Settings map[string]any `json:"settings,omitempty"`
}

type Address struct {
	Address string `json:"address"`
}

type AgentLifetimes struct {
	Refresh  *Duration `json:"refresh,omitempty"`
	Absolute *Duration `json:"absolute,omitempty"`
	Access   *Duration `json:"access,omitempty"`
}

type AppsGitHub struct {
	// Apps is every GitHub App the installation declares, of every purpose:
	// the link App, the catalogue Apps an operator creates and installs from
	// the console, and the runner tiers an operator may create an App for.
	Apps []GitHubApp `yaml:"apps,omitempty"`
	// RunnerTiers is DEPRECATED, read for one release: each tier is a
	// runner entry of Apps.
	RunnerTiers []string `yaml:"runnerTiers,omitempty"`
	// Catalogue is DEPRECATED, read for one release: each App is a catalogue
	// entry of Apps.
	Catalogue []catalogue.App `yaml:"catalogue,omitempty"`
	// contains filtered or unexported fields
}

type AppsSlack struct {
	// Catalogue is every catalogue Slack App.
	Catalogue []slackcatalogue.App `yaml:"catalogue,omitempty"`
}

type Audit struct {
	Writer                  string `json:"writer,omitempty"`
	TokenFile               string `json:"tokenFile,omitempty"`
	QueryURL                string `json:"queryURL,omitempty"`
	Audience                string `json:"audience,omitempty"`
	ForwardedForTrustedHops int    `json:"forwardedForTrustedHops,omitempty"`
}

type Backup struct {
	// Role is [BackupRoleBackup] (the default) or [BackupRoleRestore].
	Role string `json:"role,omitempty"`
	// Recipients are the age X25519 public keys (age1...) every backup is
	// encrypted to. The backup role requires at least one.
	Recipients []string `json:"recipients,omitempty"`
	// Identity names the restore role's secret that holds the age identity
	// (AGE-SECRET-KEY-1...): internal/backup/<identity> in the secret store,
	// [BackupDefaultIdentity] when unset.
	Identity string `json:"identity,omitempty"`
	// Key and Region were the KMS archive key of format 1. Deprecated: they
	// are accepted for one release and ignored.
	Key    *keys.Entry `json:"key,omitempty"`
	Region string      `json:"region,omitempty"`
	// Target is the bucket the archive is written to.
	Target BackupTarget `json:"target"`
	// Retention is how many backups are kept and for how long.
	Retention *BackupRetention `json:"retention,omitempty"`
}

type BackupRetention struct {
	// Keep is how many of the newest completed backups are always kept.
	Keep *int `json:"keep,omitempty"`
	// MaxAge is how old a backup beyond Keep may be before it is deleted.
	MaxAge *Duration `json:"maxAge,omitempty"`
}

type BackupTarget struct {
	Bucket string `json:"bucket"`
	// Prefix is put before `backup/<installation>/` in the bucket.
	Prefix string `json:"prefix,omitempty"`
	Region string `json:"region,omitempty"`
	// KMSKey is the SSE-KMS key of every write; unset leaves the bucket's own
	// default encryption.
	KMSKey    string `json:"kmsKey,omitempty"`
	Endpoint  string `json:"endpoint,omitempty"`
	PathStyle bool   `json:"pathStyle,omitempty"`
	// Checksum is the integrity header of every upload: sha256 (the default),
	// md5 (Content-MD5) or none, for a store that refuses SHA-256.
	Checksum string `json:"checksum,omitempty"`
}

type Cloudflare struct {
	// Accounts are the Cloudflare accounts sluis mints in, by the name presets
	// use.
	Accounts map[string]CloudflareAccount `json:"accounts,omitempty"`
	// Presets are what may be minted, by name.
	Presets map[string]CloudflarePreset `json:"presets,omitempty"`
	// ForbiddenPermissionGroups ADD to the built-in list of permission groups
	// a prototype may never grant (token admin, billing, account settings,
	// memberships, Access identity providers), by the name Cloudflare lists
	// them under. They cannot remove from it: nothing in a document shortens
	// the built-in list.
	ForbiddenPermissionGroups []string `json:"forbiddenPermissionGroups,omitempty"`
	// Tick is how often the rotation looks at the presets: the schedule's
	// interval on Lambda (the library fills it from CloudflareRotation when it
	// is unset), a minute for the Kubernetes loop. A credential rotates up to
	// one Tick after its preset's `rotation`, so the console calls one overdue
	// only past `rotation + tick`. Zero means a minute.
	Tick Duration `json:"tick,omitempty"`
	// Remote is where the minter is when it is not this process: the on-demand
	// exchange then calls the Cloudflare module there, and this process holds no
	// account and no preset.
	Remote *CloudflareRemote `json:"remote,omitempty"`
	// Serve makes the Cloudflare module answer other modules' calls: on
	// Kubernetes a listener that verifies the caller's projected token, on
	// Lambda the function's `rpc` events (docs/decisions/0071).
	Serve *CloudflareServe `json:"serve,omitempty"`
}

type CloudflareAccount struct {
	// ID is the account id.
	ID string `json:"id"`
	// Minter is the internal address of the minter credential, a
	// cloudflare-minter/v1 document: an account token that holds Account API
	// Tokens Read and Edit and nothing else.
	Minter string `json:"minter"`
}

type CloudflareGrant struct {
	// Group is an internal group of the policy (a person group, or a declared CI
	// job group); every holder may ask.
	Group string `yaml:"group,omitempty" json:"group,omitempty"`
	// Presets are the presets the row opens.
	Presets []string `yaml:"presets" json:"presets"`
}

type CloudflarePreset struct {
	// Account is a key of Accounts.
	Account string `json:"account"`
	// Prototype is the id of the DISABLED account token whose policies and
	// condition every minted token copies.
	Prototype string `json:"prototype"`
	// Description says what the preset is for; the console and sluisctl show it.
	Description string `json:"description"`
	// Lifetime is how long a minted token lives (its expires_on).
	Lifetime Duration `json:"lifetime"`
	// Rotation is how often the stored token is replaced. Shorter than Lifetime.
	Rotation Duration `json:"rotation"`
	// Endpoint, when set, makes this an R2 preset: the S3 endpoint of the
	// account (and jurisdiction) the credentials are for.
	Endpoint string `json:"endpoint,omitempty"`
}

type CloudflareRemote struct {
	// Function is the module's Lambda function, name or ARN; it is invoked
	// through its `live-issuer` alias.
	Function string `json:"function,omitempty"`
	// URL is the module's Service, called with the pod's projected token.
	URL string `json:"url,omitempty"`
	// Audience is the audience of that token; the module's name when unset.
	Audience string `json:"audience,omitempty"`
	// TokenFile is where the projected token is mounted.
	TokenFile string `json:"tokenFile,omitempty"`
}

type CloudflareServe struct {
	// Address is the listener on Kubernetes: host:port. Lambda ignores it.
	Address string `json:"address,omitempty"`
	// Audience is the audience a caller's projected token must have been
	// minted for; the module's name when unset.
	Audience string `json:"audience,omitempty"`
	// Issuers are the subjects of the issuer's ServiceAccount
	// (`system:serviceaccount:<namespace>:<name>`) that may call the listener
	// on Kubernetes; each is both the issuer class (the mint) and the console
	// class. Required by the listener; Lambda ignores it.
	Issuers []string `json:"issuers,omitempty"`
}

type Config[S Service] struct {
	Service *S
	// Policy is nil when the service document names none and no fallback was
	// given.
	Policy *PolicyDocument
}

type Console struct {
	Origin string `json:"origin,omitempty"`
	Client string `json:"client,omitempty"`
	// AWSAudience is the audience an AWS role's web identity token must be
	// minted for to be a bearer at the console: its OWN, distinct from
	// `exchange`'s, so a token for one door is no proof at the other.
	AWSAudience string `json:"awsAudience,omitempty"`
	// Backup connects the console's Backups page to the backup module and
	// the restore function (docs/decisions/0071). Unset has no page.
	Backup *ConsoleBackup `json:"backup,omitempty"`
}

type ConsoleBackup struct {
	// Function and URL name the backup module: exactly one of the two.
	Function string `json:"function,omitempty"`
	URL      string `json:"url,omitempty"`
	// RestoreFunction and RestoreURL name the restore function: at most one
	// of the two. Without either the page says there is none.
	RestoreFunction string `json:"restoreFunction,omitempty"`
	RestoreURL      string `json:"restoreURL,omitempty"`
	// Audience is the audience of the projected token a Service call
	// carries; each module's name when unset.
	Audience string `json:"audience,omitempty"`
	// TokenFile is where that token is mounted.
	TokenFile string `json:"tokenFile,omitempty"`
}

type ControllerCommon struct {
	// ConsoleURL is the console's API. Unset is the document's `publicURL`.
	ConsoleURL string `json:"consoleURL,omitempty"`
	TokenFile  string `json:"tokenFile,omitempty"`
	// Console says how the controller proves itself to the console when the
	// pod's token file is not the way (AWS Lambda).
	Console    *RosterConsole `json:"console,omitempty"`
	RecordsDir string         `json:"recordsDir,omitempty"`
	Interval   *Duration      `json:"interval,omitempty"`
}

type ControllerGitHub struct {
	Roster
	AppsDir string `json:"appsDir,omitempty"`
}

type ControllerSlack struct {
	Roster
	CredentialsDir string `json:"credentialsDir,omitempty"`
}

type Controllers struct {
	GitHub *GitHubController `json:"github,omitempty"`
	Slack  *SlackController  `json:"slack,omitempty"`
}

type ControllersGitHub struct {
	// EnabledOrgs are the organisations it changes. Each must be bound
	// by the policy's github table.
	EnabledOrgs []string `yaml:"enabledOrgs,omitempty"`
	// AppRefs names, by organisation, the catalogue App whose key the
	// organisation's record refers to (`app_ref`). Optional: a record that
	// already names an App keeps it, and an entry overrides it or declares
	// an organisation anew.
	AppRefs map[string]string `yaml:"appRefs,omitempty"`
	// AppNames names, by organisation, the App this service creates for
	// it when an operator connects it (the organisation App's name on
	// GitHub). Optional: an organisation with no entry is created as
	// <org>-access-roster. GitHub's limit is 34 characters.
	AppNames map[string]string `yaml:"appNames,omitempty"`
}

type ControllersSlack struct {
	// EnabledWorkspaces are the workspaces it changes, by the policy's
	// key. Each must be declared by the policy's slack table.
	EnabledWorkspaces []string `yaml:"enabledWorkspaces,omitempty"`
}

type DeclaredSecret struct {
	// Kind is one of the Secret* constants.
	Kind string
	// Subject is what the secret belongs to: a Google provider, a client id, a
	// workspace id, a Cloudflare account; empty when there is one of the kind.
	Subject string
	// Name is where layout v4 keeps it. For a Ref it is the internal address
	// (`internal/<module>/<name>`) the document gives, the same in every
	// layout; otherwise it is the secret's name below `internal/config/`.
	Name string
	// Ref says Name is an address and not a name.
	Ref bool
}

type Directory struct {
	Workspaces []DirectoryWorkspace `json:"workspaces,omitempty"`
}

type DirectoryWorkspace struct {
	ID         string   `json:"id,omitempty"`
	Backend    string   `json:"backend"`
	Admin      string   `json:"admin"`
	KeySecret  string   `json:"keySecret"`
	Serve      []string `json:"serve,omitempty"`
	SyncGroups []string `json:"syncGroups,omitempty"`
}

type Document interface {
	Sluis | Serve | ControllerGitHub | ControllerSlack | PolicyDocument
}

type Duration = duration.Duration

type DynamoDB struct {
	Table string `json:"table,omitempty"`
	// Tables is layout v5: the table of each module, by module name
	// (`secrets.layout: v5`). Exclusive with Table.
	Tables   map[string]string `json:"tables,omitempty"`
	Region   string            `json:"region,omitempty"`
	Endpoint string            `json:"endpoint,omitempty"`
	Create   bool              `json:"create,omitempty"`
}

type Exchange struct {
	Audience string `json:"audience,omitempty"`
}

type ExchangeGitHub struct {
	// Owners are the organisations whose repositories' CI tokens are
	// verified. None verifies none: an empty list would admit every
	// repository there is.
	Owners []string `yaml:"owners,omitempty"`
}

type FederatedCluster struct {
	// Name is the estate's own word for the cluster; it becomes the
	// cluster in a `service_account` matcher and in a minted token's
	// subject.
	Name string `yaml:"name"`
	// Issuer is the `iss` its ServiceAccount tokens carry.
	Issuer string `yaml:"issuer"`
	// JWKSURI is where its keys are. Empty discovers it from the issuer.
	JWKSURI string `yaml:"jwksUri,omitempty"`
}

type Forwarded struct {
	Issuer      string `json:"issuer,omitempty"`
	Audience    string `json:"audience,omitempty"`
	EmailHeader string `json:"emailHeader,omitempty"`
}

type Freshness struct {
	RefreshInterval *Duration `json:"refreshInterval,omitempty"`
	FreshnessWindow *Duration `json:"freshnessWindow,omitempty"`
	ProbeInterval   *Duration `json:"probeInterval,omitempty"`
}

type GitHubApp struct {
	// ID is the App's key in storage: `link`, a catalogue App's own id, or
	// `runner-<tier>` (`runner-<tier>-<org>` with an `org`), which a runner entry
	// may leave out.
	ID      string            `yaml:"id,omitempty"`
	Purpose appid.Purpose     `yaml:"purpose"`
	Labels  map[string]string `yaml:"labels,omitempty"`
	// Export places the installed App's key at external/github/<id>. A runner
	// App is always exported.
	Export bool `yaml:"export,omitempty"`
	// Org is the organisation a catalogue App is created under, or a runner
	// entry's only organisation.
	Org  string `yaml:"org,omitempty"`
	Tier string `yaml:"tier,omitempty"`

	// Name is the App's name on GitHub, at most 34 characters: a catalogue
	// App's (default <org>-<id>) or the link App's (default
	// <org>-access-roster-link).
	Name string `yaml:"name,omitempty"`

	// The rest is a catalogue App's alone.
	Description  string             `yaml:"description,omitempty"`
	Public       bool               `yaml:"public,omitempty"`
	Permissions  map[string]string  `yaml:"permissions,omitempty"`
	Events       []string           `yaml:"events,omitempty"`
	Webhook      *catalogue.Webhook `yaml:"webhook,omitempty"`
	Installation string             `yaml:"installation,omitempty"`
	Grants       []catalogue.Grant  `yaml:"grants,omitempty"`
}

type GitHubController struct {
	ControllerCommon
	AppsDir string `json:"appsDir,omitempty"`
}

type Google struct {
	// Workspaces are the workspaces the deployment declares.
	Workspaces []DirectoryWorkspace `json:"workspaces,omitempty"`
	// OAuthClient is the client that reopens a workspace connected by consent,
	// and the one the console's consent and the issuer's sign-in use.
	OAuthClient *GoogleOAuthClient `json:"oauthClient,omitempty"`
	// PublicURL is where a browser reaches the issuer, including its mount:
	// the consent and sign-in redirect URIs are built from it. The same value
	// as the issuer's `publicURL`.
	PublicURL string `json:"publicURL,omitempty"`
	// RefreshInterval, FreshnessWindow and ProbeInterval are the hub's knobs.
	RefreshInterval *Duration `json:"refreshInterval,omitempty"`
	FreshnessWindow *Duration `json:"freshnessWindow,omitempty"`
	ProbeInterval   *Duration `json:"probeInterval,omitempty"`
}

type GoogleOAuthClient struct {
	ID       string `json:"id,omitempty"`
	Provider string `json:"provider,omitempty"`
}

type Lifetimes struct {
	Token    *Duration `json:"token,omitempty"`
	Refresh  *Duration `json:"refresh,omitempty"`
	Absolute *Duration `json:"absolute,omitempty"`
	Hold     *Duration `json:"hold,omitempty"`
	Session  *Duration `json:"session,omitempty"`
	// Agent is `lifetimes.agent`: how long the refresh chains of clients
	// the policy marks `session: agent` live.
	Agent *AgentLifetimes `json:"agent,omitempty"`
}

type Log struct {
	Level string `json:"level,omitempty"`
}

type Login struct {
	Directory  *bool      `json:"directory,omitempty"`
	SignOutURL string     `json:"signOutURL,omitempty"`
	Forwarded  *Forwarded `json:"forwarded,omitempty"`
}

type ModuleRemote struct {
	// Function is the module's Lambda function, name or ARN; it is invoked
	// through the `live-<class>` alias of the caller's class.
	Function string `json:"function,omitempty"`
	// URL is the module's Service, called with the pod's projected token.
	URL string `json:"url,omitempty"`
	// Audience is the audience of that token; the module's name when unset.
	Audience string `json:"audience,omitempty"`
	// TokenFile is where the projected token is mounted;
	// /var/run/secrets/sluis/<module>/token when unset.
	TokenFile string `json:"tokenFile,omitempty"`
}

type ModuleRoute struct {
	// Remote is where the module is when it is not this process. Unset keeps
	// the module in this process.
	Remote *ModuleRemote `json:"remote,omitempty"`
	// Serve makes the module answer other modules' calls on Kubernetes: a
	// listener that verifies the caller's projected ServiceAccount token. Only
	// the module's own document sets it (`github.serve` for the GitHub
	// module, `slack.serve` for the Slack one).
	Serve *ModuleServe `json:"serve,omitempty"`
}

type ModuleServe struct {
	// Address is the listener: host:port. :8081 when unset.
	Address string `json:"address,omitempty"`
	// Audience is the audience a caller's projected token must have been minted
	// for; the module's name when unset.
	Audience string `json:"audience,omitempty"`
	// Issuers are the subjects of the issuer's ServiceAccount
	// (`system:serviceaccount:<namespace>:<name>`). Each is both the issuer
	// class (`mint_installation`) and the console class (`*.console.*`); a
	// token of any other subject is a 401. At least one is required.
	Issuers []string `json:"issuers,omitempty"`
}

type OAuthClient struct {
	ID string `json:"id,omitempty"`
	// Provider names the client's two secrets,
	// providers/google/<provider>/client-id and .../client-secret. The
	// id may instead be ID, which is not a secret.
	Provider   string `json:"provider,omitempty"`
	SecretName string `json:"secretName,omitempty"`
	IDKey      string `json:"idKey,omitempty"`
	SecretKey  string `json:"secretKey,omitempty"`
}

type OpenBaoAuth struct {
	Method    string `json:"method,omitempty"`
	Mount     string `json:"mount,omitempty"`
	Role      string `json:"role,omitempty"`
	TokenFile string `json:"tokenFile,omitempty"`
}

type Platform struct {
	AWS        bool   `json:"aws,omitempty"`
	Kubernetes bool   `json:"kubernetes,omitempty"`
	OpenBao    bool   `json:"openbao,omitempty"`
	Runtime    string `json:"runtime,omitempty"`
	Replicas   int    `json:"replicas,omitempty"`
}

type PolicyApps struct {
	GitHub *AppsGitHub `yaml:"github,omitempty"`
	Slack  *AppsSlack  `yaml:"slack,omitempty"`
}

type PolicyCloudflare struct {
	// Grants say which presets the holders of a group may have a token for. A
	// CI job is a group like any other: the policy declares it as a group with
	// `github` matchers (repository, ref, event, job_workflow_ref), and the
	// verified token is evaluated against them by the same group evaluation
	// as everything else.
	Grants []CloudflareGrant `yaml:"grants,omitempty" json:"grants,omitempty"`
}

type PolicyControllers struct {
	GitHub *ControllersGitHub `yaml:"github,omitempty"`
	Slack  *ControllersSlack  `yaml:"slack,omitempty"`
}

type PolicyDocument struct {
	// APIVersion is sluis.truvity.github.io/policy/v2. A v1 policy file (`version:
	// 1`, or an access document) is converted as it is loaded.
	APIVersion string
	// Policy is the access model's tables. Its Version is always 1: the
	// document's own version is APIVersion.
	Policy policy.Policy
	// Exchange is whom the token exchange trusts.
	Exchange *PolicyExchange `yaml:"exchange,omitempty"`
	// Apps is what an operator may make on the console.
	Apps *PolicyApps `yaml:"apps,omitempty"`
	// Controllers is what each controller may change.
	Controllers *PolicyControllers `yaml:"controllers,omitempty"`
	// CloudflareGrants is who may ask for which Cloudflare preset
	// (`cloudflare.grants`); the presets are the service document's.
	CloudflareGrants *PolicyCloudflare `yaml:"cloudflare,omitempty"`
}

type PolicyExchange struct {
	// Clusters are the clusters whose ServiceAccount tokens are verified,
	// each against the key set it publishes for itself.
	Clusters []FederatedCluster `yaml:"clusters,omitempty"`
	// AWS is the AWS accounts whose roles' outbound identity tokens are
	// verified.
	AWS *AWSFederation `yaml:"aws,omitempty"`
	// GitHub is whose CI tokens are verified.
	GitHub *ExchangeGitHub `yaml:"github,omitempty"`
}

type PolicyRef struct {
	File string `json:"file,omitempty"`
}

type Ports struct {
	Adapter string     `json:"adapter,omitempty"`
	Blob    *PortsBlob `json:"blob,omitempty"`
	// DynamoDB is the table of the `dynamodb` adapter.
	DynamoDB *DynamoDB `json:"dynamodb,omitempty"`
}

type PortsBlob struct {
	Adapter string       `json:"adapter,omitempty"`
	S3      *PortsBlobS3 `json:"s3,omitempty"`
}

type PortsBlobCredentials struct {
	// Preset is a key of `cloudflare.presets` with an `endpoint` (an R2
	// preset).
	Preset string `json:"preset"`
}

type PortsBlobS3 struct {
	Bucket    string `json:"bucket,omitempty"`
	Prefix    string `json:"prefix,omitempty"`
	Region    string `json:"region,omitempty"`
	KMSKey    string `json:"kmsKey,omitempty"`
	Endpoint  string `json:"endpoint,omitempty"`
	PathStyle bool   `json:"pathStyle,omitempty"`
	// Checksum is the integrity header of every upload: sha256 (the
	// default, x-amz-checksum-sha256), md5 (Content-MD5) or none, for a
	// store that refuses SHA-256.
	Checksum string `json:"checksum,omitempty"`
	// CredentialsRef is the internal address (`internal/<kind>/<id>`) of
	// the s3-credentials/v1 document the installation's secrets store
	// holds for Endpoint. It needs Endpoint and the ssm secrets source.
	CredentialsRef string `json:"credentialsRef,omitempty"`
	// Credentials makes sluis mint its own R2 credentials from a
	// `cloudflare.presets` entry instead of reading a static document. It
	// is exclusive with CredentialsRef, which stays the simple default
	// and needs no `cloudflare` section.
	Credentials *PortsBlobCredentials `json:"credentials,omitempty"`
}

type Recovery struct {
	Enabled        *bool  `json:"enabled,omitempty"`
	ServiceAccount string `json:"serviceAccount,omitempty"`
	Audience       string `json:"audience,omitempty"`
	// LoginSecret (`passwordSecret`) names the recovery password, for a hub that is not
	// in a cluster: `recovery/password` in the layout.
	LoginSecret string `json:"passwordSecret,omitempty"`
}

type Roster struct {
	// APIVersion is the document's version: v2. A document without one is v1,
	// which [Load] converts.
	APIVersion string `json:"apiVersion"`
	Release    string `json:"release,omitempty"`
	// Policy names the policy document: the bindings are its github or slack
	// table, and its `controllers` section is what the controller may change.
	Policy     *PolicyRef `json:"policy"`
	ConsoleURL string     `json:"consoleURL"`
	TokenFile  string     `json:"tokenFile,omitempty"`
	// Console says how the controller proves itself to the console when the
	// pod's token file is not the way (AWS Lambda).
	Console    *RosterConsole `json:"console,omitempty"`
	RecordsDir string         `json:"recordsDir,omitempty"`
	Interval   *Duration      `json:"interval,omitempty"`
	Log        *Log           `json:"log,omitempty"`
	Ports      *Ports         `json:"ports,omitempty"`
	// Platform, Preset and Adapters choose the adapters by name, per concern, as
	// they do in the serve configuration; the Lambda controllers need them for
	// the audit sink (`sqs`) and the state they share with the service.
	Platform *Platform                `json:"platform,omitempty"`
	Preset   string                   `json:"preset,omitempty"`
	Adapters map[string]AdapterChoice `json:"adapters,omitempty"`
	Audit    *RosterAudit             `json:"audit,omitempty"`
	// GitHub, Slack and Google say where those modules are when they are not
	// in the controller's process.
	GitHub *ModuleRoute `json:"github,omitempty"`
	Slack  *ModuleRoute `json:"slack,omitempty"`
	Google *ModuleRoute `json:"google,omitempty"`
	// Secrets says how the secrets the module reads are delivered, for a
	// module that runs as a function of its own (the one service document's
	// `secrets` is what a controller inside it uses).
	Secrets *Secrets `json:"secrets,omitempty"`
	// Probes is where /healthz and /readyz answer.
	Probes *Address `json:"probes,omitempty"`
	// contains filtered or unexported fields
}

type RosterAudit struct {
	Writer    string `json:"writer,omitempty"`
	TokenFile string `json:"tokenFile,omitempty"`
}

type RosterConsole struct {
	Auth *RosterConsoleAuth `json:"auth,omitempty"`
}

type RosterConsoleAWS struct {
	// Audience is the one the issuer's AWS federation file names.
	Audience string `json:"audience"`
}

type RosterConsoleAuth struct {
	AWS *RosterConsoleAWS `json:"aws,omitempty"`
}

type SecretLocation struct {
	Env  string
	File string
}

type Secrets struct {
	Source   string    `json:"source"`
	Root     string    `json:"root,omitempty"`
	Region   string    `json:"region,omitempty"`
	Endpoint string    `json:"endpoint,omitempty"`
	Refresh  *Duration `json:"refresh,omitempty"`
	// KMSKeyID is `ssm`'s customer-managed key for the parameters the
	// service writes (credentials, exports). Unset is the AWS-managed key.
	KMSKeyID string `json:"kmsKeyId,omitempty"`
	// Layout is the storage layout of an `ssm` installation: `v4` (ADR
	// 0041), the default, or `v5` (ADR 0072), module first.
	Layout string `json:"layout,omitempty"`
	// Grace is how long a rotated client secret's previous value is still
	// accepted (default 24h). It is the overlap of a
	// rotation: the previous revision of the document, while the current
	// one is younger than this.
	Grace *Duration `json:"grace,omitempty"`
	// ReadCache is how long one process keeps a decrypted document it read
	// from the `ssm` store (default 5m; 0s turns the cache off). A write
	// through the process drops the copy at once; a document that carries
	// its own expiry is not kept past it. SLUIS_SECRETS_READ_CACHE_TTL
	// overrides it.
	ReadCache *Duration `json:"readCache,omitempty"`
}

type Serve struct {
	// APIVersion is the document's version: v2. A document without one is v1,
	// which [Load] converts.
	APIVersion    string `json:"apiVersion"`
	IssuerURL     string `json:"issuerURL"`
	Release       string `json:"release,omitempty"`
	Cluster       string `json:"cluster,omitempty"`
	AllowInsecure bool   `json:"allowInsecure,omitempty"`
	Demo          bool   `json:"demo,omitempty"`
	InCluster     bool   `json:"inCluster,omitempty"`
	// Instance names this installation in the default encryption context of
	// `keys` ({instance, purpose}). Unset is `release`.
	Instance string `json:"instance,omitempty"`
	// Keys says which key serves which purpose (`keys.sign` wraps the signing
	// key ring). Unset leaves every purpose to its older setting.
	Keys *keys.Config `json:"keys,omitempty"`

	Listen *Address `json:"listen,omitempty"`
	Probes *Address `json:"probes,omitempty"`
	Log    *Log     `json:"log,omitempty"`

	Store string `json:"store,omitempty"`
	Ports *Ports `json:"ports,omitempty"`
	// Platform, Preset and Adapters choose the adapters by name, per concern.
	// Absent, the `ports` keys decide, exactly as before they existed.
	Platform *Platform `json:"platform,omitempty"`
	Preset   string    `json:"preset,omitempty"`
	// Adapters maps a concern (state, secrets, blobs, signing, trigger,
	// schedule, audit) to the adapter that replaces the preset's.
	Adapters map[string]AdapterChoice `json:"adapters,omitempty"`
	// Policy names the policy document. Unset is the built-in two groups, or
	// the demonstration policy under `demo`.
	Policy        *PolicyRef `json:"policy,omitempty"`
	PublicURL     string     `json:"publicURL,omitempty"`
	PublicRootURL string     `json:"publicRootURL,omitempty"`
	SecureCookies *bool      `json:"secureCookies,omitempty"`
	GroupsScoping string     `json:"groupsScoping,omitempty"`

	// Secrets says how the secrets this document names are delivered.
	Secrets *Secrets `json:"secrets,omitempty"`

	Lifetimes   *Lifetimes   `json:"lifetimes,omitempty"`
	Freshness   *Freshness   `json:"freshness,omitempty"`
	Directory   *Directory   `json:"directory,omitempty"`
	Exchange    *Exchange    `json:"exchange,omitempty"`
	Recovery    *Recovery    `json:"recovery,omitempty"`
	Login       *Login       `json:"login,omitempty"`
	Console     *Console     `json:"console,omitempty"`
	OAuthClient *OAuthClient `json:"oauthClient,omitempty"`
	SigningKey  *SigningKey  `json:"signingKey,omitempty"`
	Valkey      *Valkey      `json:"valkey,omitempty"`
	Audit       *Audit       `json:"audit,omitempty"`
	// Cloudflare is sluis as the STS for Cloudflare API tokens and R2
	// credentials: the accounts it mints in and the presets it mints.
	Cloudflare *Cloudflare `json:"cloudflare,omitempty"`
	// contains filtered or unexported fields
}

type Service interface {
	Sluis | Serve | ControllerGitHub | ControllerSlack
}

type SigningKey struct {
	File            string    `json:"file,omitempty"`
	AdditionalFiles []string  `json:"additionalFiles,omitempty"`
	PollInterval    *Duration `json:"pollInterval,omitempty"`
	ActivationDelay *Duration `json:"activationDelay,omitempty"`
	Overlap         *Duration `json:"overlap,omitempty"`
	// KMS signs with AWS KMS keys instead of a file. Exclusive with File.
	KMS *SigningKeyKMS `json:"kms,omitempty"`
	// KMSWrapped signs with key pairs KMS generates and wraps under one
	// symmetric key, rotated automatically. Exclusive with File and KMS.
	KMSWrapped *SigningKeyKMSWrapped `json:"kmsWrapped,omitempty"`
	// VerifyOnly are public keys published in the JWKS and never signed
	// with, for a bounded overlap (a cutover from file keys to KMS ones).
	VerifyOnly []SigningKeyVerifyOnly `json:"verifyOnly,omitempty"`
}

type SigningKeyKMS struct {
	Keys        []string `json:"keys,omitempty"`
	Region      string   `json:"region,omitempty"`
	StateSecret string   `json:"stateSecret,omitempty"`
	// Additional is every OTHER algorithm signed at once, each on its own
	// ordered key list, beside Keys (ES384).
	Additional []SigningKeyKMSAlg `json:"additional,omitempty"`
}

type SigningKeyKMSAlg struct {
	Alg  string   `json:"alg"`
	Keys []string `json:"keys"`
}

type SigningKeyKMSWrapped struct {
	// KeyID is DEPRECATED: the symmetric application key. `keys.sign`
	// replaces it; an alias given here is mapped onto `keys.sign` with a
	// warning for one release.
	KeyID  string `json:"keyId,omitempty"`
	Region string `json:"region,omitempty"`
	// StateSecret names the sign-in state's secret, as for `kms`.
	StateSecret string `json:"stateSecret,omitempty"`
	// Algorithms are ES384 and/or RS256, the first the default. Unset is
	// ES384 and RS256.
	Algorithms []string `json:"algorithms,omitempty"`
	// RotateEvery is how often a new key pair is generated. Default 24h.
	RotateEvery *Duration `json:"rotateEvery,omitempty"`
	// Prepublish is how long a new key is published before it signs.
	// Default `signingKey.activationDelay` (15m).
	Prepublish *Duration `json:"prepublish,omitempty"`
	// Retain is how long a superseded key stays published. Default
	// `signingKey.overlap`, which is `lifetimes.token` plus a skew margin.
	Retain *Duration `json:"retain,omitempty"`
}

type SigningKeyVerifyOnly struct {
	// File is a PEM public key (or a certificate's) or a JWK. A private key
	// is refused at start.
	File string `json:"file"`
	// KeyID is the `kid` the old tokens carry. Unset is the RFC 7638
	// thumbprint, which is what a file signer derived for the key.
	KeyID string `json:"kid,omitempty"`
	// Alg is the key's algorithm. Unset follows the key.
	Alg string `json:"alg,omitempty"`
	// Until is an RFC 3339 instant after which the key is not published.
	Until string `json:"until,omitempty"`
}

type SlackController struct {
	ControllerCommon
	CredentialsDir string `json:"credentialsDir,omitempty"`
}

type Sluis struct {
	Serve
	// GitHub, Slack and Google say where those modules are when they are not in
	// this process: `<module>.remote`, shaped as `cloudflare.remote`.
	GitHub      *ModuleRoute `json:"github,omitempty"`
	Slack       *ModuleRoute `json:"slack,omitempty"`
	Google      *ModuleRoute `json:"google,omitempty"`
	Controllers *Controllers `json:"controllers,omitempty"`
}

type SluisBackup struct {
	APIVersion string `json:"apiVersion"`
	// Instance names the installation: the path of its backups in the archive
	// bucket and the default encryption context of the archive key.
	Instance string `json:"instance,omitempty"`
	Log      *Log   `json:"log,omitempty"`
	// Keys is the key service block every product shares. Since format 2 the
	// backup module uses none of it: `keys.archive` is accepted for one release
	// and ignored (deprecated).
	Keys     *keys.Config             `json:"keys,omitempty"`
	Secrets  *Secrets                 `json:"secrets,omitempty"`
	Ports    *Ports                   `json:"ports,omitempty"`
	Platform *Platform                `json:"platform,omitempty"`
	Preset   string                   `json:"preset,omitempty"`
	Adapters map[string]AdapterChoice `json:"adapters,omitempty"`
	Audit    *Audit                   `json:"audit,omitempty"`
	Backup   Backup                   `json:"backup"`
}

type SluisGoogle struct {
	APIVersion string `json:"apiVersion"`
	// Instance names the installation, as in every module's document.
	Instance string   `json:"instance,omitempty"`
	Log      *Log     `json:"log,omitempty"`
	Probes   *Address `json:"probes,omitempty"`

	Secrets *Secrets `json:"secrets,omitempty"`
	// Audit is the audit installation the module records to: the connections
	// it makes and the changes it makes to them, as its own workload. Unset
	// only logs what it did.
	Audit    *RosterAudit             `json:"audit,omitempty"`
	Ports    *Ports                   `json:"ports,omitempty"`
	Platform *Platform                `json:"platform,omitempty"`
	Preset   string                   `json:"preset,omitempty"`
	Adapters map[string]AdapterChoice `json:"adapters,omitempty"`
	Google   Google                   `json:"google"`
}

type Valkey struct {
	Address     string `json:"address,omitempty"`
	LoginSecret string `json:"passwordSecret,omitempty"`
	TLS         bool   `json:"tls,omitempty"`
	Cluster     *bool  `json:"cluster,omitempty"`
}