ctrl

type AcmeConfig struct {
	// Enabled determines whether ACME certificate management is active.
	// When true, certificates are automatically obtained and renewed.
	Enabled bool

	// EmailDomain is the domain used for ACME account emails.
	// Used for Let's Encrypt account registration and recovery.
	// Example: "unkey.com" creates "admin@unkey.com" for ACME account.
	EmailDomain string

	// Cloudflare configures DNS-01 challenges through Cloudflare API.
	// Enables wildcard certificates for domains hosted on Cloudflare.
	Cloudflare CloudflareConfig

	// Route53 configures DNS-01 challenges through AWS Route53 API.
	// Enables wildcard certificates for domains hosted on Route53.
	Route53 Route53Config
}

type BuildBackend string

type BuildPlatform struct {
	// Platform is the original build platform string.
	// Example: "linux/amd64".
	Platform string

	// Architecture is the CPU architecture component.
	// Example: "amd64", "arm64".
	Architecture string
}

type CloudflareConfig struct {
	// Enabled determines whether Cloudflare DNS-01 challenges are used.
	// When true, wildcard certificates can be automatically obtained.
	Enabled bool

	// ApiToken is the Cloudflare API token for DNS management.
	// Requires Zone:Read and DNS:Edit permissions for the target zones.
	ApiToken string
}

type Config struct {
	// InstanceID is the unique identifier for this control plane instance.
	// Used for logging, tracing, and cluster coordination.
	InstanceID string

	// Platform identifies the cloud platform where the node is running.
	// Affects integration with cloud-specific services and monitoring.
	// Examples: "aws", "gcp", "hetzner".
	Platform string

	// Image specifies the container image identifier including repository and tag.
	// Used for control plane deployment and sentinel image configuration.
	Image string

	// HttpPort defines the HTTP port for the control plane server.
	// Default: 8080. Cannot be 0.
	HttpPort int

	// Region identifies the geographic region where this node is deployed.
	// Used for observability, compliance, and service routing.
	Region string

	// RegistryURL is the container registry URL for pulling images.
	// Example: "registry.depot.dev" or "https://registry.example.com".
	RegistryURL string

	// RegistryUsername is the username for container registry authentication.
	// Common values: "x-token" for token-based auth or actual username.
	RegistryUsername string

	// RegistryPassword is the password/token for container registry authentication.
	// Should be stored securely (environment variable or secret management).
	RegistryPassword string

	// DatabasePrimary is the primary database connection string.
	// Used for both read and write operations to persistent storage.
	DatabasePrimary string

	// OtelEnabled enables sending telemetry data to collector endpoint.
	// When true, enables metrics, traces, and structured logs.
	OtelEnabled bool

	// OtelTraceSamplingRate controls the percentage of traces sampled.
	// Range: 0.0 (no traces) to 1.0 (all traces). Recommended: 0.1.
	OtelTraceSamplingRate float64

	// TLSConfig contains TLS configuration for HTTPS server.
	// When nil, server runs in HTTP mode for development.
	TLSConfig *tls.Config

	// AuthToken is the authentication token for control plane API access.
	// Used by clients and services to authenticate with this control plane.
	AuthToken string

	// SPIFFESocketPath is the path to the SPIFFE agent socket.
	// Enables mTLS authentication with SPIFFE-based identity system.
	SPIFFESocketPath string

	// Clock provides time operations for testing and scheduling.
	// Use clock.RealClock{} for production deployments.
	Clock clock.Clock

	// VaultMasterKeys are encryption keys for the general vault service.
	// Used for encrypting/decrypting environment variables, API keys, etc.
	VaultMasterKeys []string

	// VaultS3 configures S3 storage for the general vault.
	// Stores encrypted secrets data with the provided master keys.
	VaultS3 S3Config

	// AcmeVaultMasterKeys are encryption keys for the ACME vault service.
	// Separate vault for TLS certificate storage and ACME account data.
	AcmeVaultMasterKeys []string

	// AcmeVaultS3 configures S3 storage for the ACME vault.
	// Stores encrypted TLS certificates and ACME challenge data.
	AcmeVaultS3 S3Config

	// Acme configures automatic TLS certificate management.
	// Enables Let's Encrypt integration for domain certificates.
	Acme AcmeConfig

	// DefaultDomain is the fallback domain for system operations.
	// Used for sentinel deployment and automatic certificate bootstrapping.
	DefaultDomain string

	// Restate configures workflow engine integration.
	// Enables asynchronous deployment and certificate renewal workflows.
	Restate RestateConfig

	// BuildBackend selects the container build system.
	// Options: BuildBackendDepot or BuildBackendDocker.
	BuildBackend BuildBackend

	// BuildS3 configures storage for build artifacts and outputs.
	// Used by both Depot and Docker build backends.
	BuildS3 S3Config

	// BuildPlatform defines the target architecture for container builds.
	// Format: "linux/amd64", "linux/arm64". Only "linux" OS supported.
	BuildPlatform string

	// Depot configures Depot.dev build service integration.
	// Required when using BuildBackendDepot.
	Depot DepotConfig

	// ClickhouseURL is the ClickHouse database connection string.
	// Used for analytics and operational metrics storage.
	ClickhouseURL string

	// SentinelImage is the container image used for new sentinel deployments.
	// Overrides default sentinel image with custom build or registry.
	SentinelImage string

	// AvailableRegions is a list of available regions for deployments.
	// typically in the format "provider:region", ie "aws:us-east-1", "dev:local"
	AvailableRegions []string
}

type DepotConfig struct {
	// APIUrl is the Depot API endpoint URL for build operations.
	// Example: "https://api.depot.dev".
	APIUrl string

	// ProjectRegion is the geographic region for build storage.
	// Affects build performance and data residency.
	// Options: "us-east-1", "eu-central-1". Default: "us-east-1".
	ProjectRegion string
}

type RegistryConfig struct {
	// URL is the container registry endpoint URL.
	// Example: "registry.depot.dev" or "https://registry.example.com".
	URL string

	// Username is the registry authentication username.
	// Common values: "x-token" for token-based auth, or actual username.
	Username string

	// Password is the registry password or authentication token.
	// Should be stored securely and rotated regularly.
	Password string
}

type RestateConfig struct {
	// FrontlineURL is the Restate frontline endpoint URL for workflow invocation.
	// Used by clients to start and interact with workflow executions.
	// Example: "http://restate:8080".
	FrontlineURL string

	// AdminURL is the Restate admin endpoint URL for service registration.
	// Used by the control plane to register its workflow services.
	// Example: "http://restate:9070".
	AdminURL string

	// HttpPort is the port where the control plane listens for Restate requests.
	// This is the internal Restate server port, not the main API port.
	HttpPort int

	// RegisterAs is the service URL used for self-registration with Restate.
	// Allows other Restate services to discover and invoke this control plane.
	// Example: "http://ctrl:9080".
	RegisterAs string
}

type Route53Config struct {
	// Enabled determines whether Route53 DNS-01 challenges are used.
	// When true, wildcard certificates can be automatically obtained.
	Enabled bool

	// AccessKeyID is the AWS access key ID for Route53 API access.
	AccessKeyID string

	// SecretAccessKey is the AWS secret access key for Route53 API access.
	SecretAccessKey string

	// Region is the AWS region where Route53 hosted zones are located.
	// Example: "us-east-1", "us-west-2".
	Region string

	// HostedZoneID overrides automatic zone discovery.
	// Required when domains have complex CNAME setups that confuse
	// automatic zone lookup (e.g., wildcard CNAMEs to load balancers).
	HostedZoneID string
}

type S3Config struct {
	// URL is the S3 endpoint URL including protocol and region.
	// Examples: "https://s3.amazonaws.com" or "https://s3.us-west-2.amazonaws.com".
	URL string

	// Bucket is the S3 bucket name for storing objects.
	// Must exist and be accessible with the provided credentials.
	Bucket string

	// AccessKeyID is the AWS access key ID for S3 authentication.
	// Must have appropriate permissions for bucket operations.
	AccessKeyID string

	// AccessKeySecret is the AWS secret access key for S3 authentication.
	// Should be stored securely and rotated regularly.
	AccessKeySecret string

	// ExternalURL is the public-facing URL for accessing S3 objects.
	// Used when objects need to be accessed from outside the AWS network.
	// Optional - can be empty for internal-only access.
	ExternalURL string
}