worker

type AcmeConfig struct {
	// Enabled determines whether ACME certificate management is active.
	// When true, certificates are automatically obtained and renewed.
	Enabled bool `toml:"enabled"`

	// EmailDomain is the domain used for ACME account emails.
	// Used for Let's Encrypt account registration and recovery.
	// Example: "unkey.com" creates "admin@unkey.com" for ACME account.
	EmailDomain string `toml:"email_domain" config:"default=unkey.com"`

	// Route53 configures DNS-01 challenges through AWS Route53 API.
	// Enables wildcard certificates for domains hosted on Route53.
	Route53 Route53Config `toml:"route53"`
}

type BuildPlatform struct {
	// Platform is the original build platform string.
	// Example: "linux/amd64".
	Platform string

	// Architecture is the CPU architecture component.
	// Example: "amd64", "arm64".
	Architecture string
}

type ClickHouseConfig struct {
	// URL is the ClickHouse database connection string.
	// Used for analytics and operational metrics storage.
	URL string `toml:"url"`

	// AdminURL is the connection string for the ClickHouse admin user.
	// Used by ClickhouseUserService to create/configure workspace users.
	// Optional - if not set, ClickhouseUserService will not be enabled.
	AdminURL string `toml:"admin_url"`
}

type Config struct {
	// InstanceID is the unique identifier for this worker instance.
	// Used for logging, tracing, and cluster coordination.
	InstanceID string `toml:"instance_id"`

	// Region is the geographic region where this worker instance is running.
	// Used for logging and tracing context.
	Region string `toml:"region"`

	// Observability configures tracing, logging, and metrics. See [config.Observability].
	Observability config.Observability `toml:"observability"`

	// DefaultDomain is the fallback domain for system operations.
	// Used for sentinel deployment and automatic certificate bootstrapping.
	DefaultDomain string `toml:"default_domain" config:"default=unkey.app"`

	// DashboardURL is the base URL of the dashboard, used for constructing links
	// in GitHub PR comments and deployment status log URLs.
	DashboardURL string `toml:"dashboard_url" config:"default=https://app.unkey.com"`

	// BuildPlatformStr defines the target architecture for container builds.
	// Format: "linux/amd64", "linux/arm64". Only "linux" OS supported.
	BuildPlatformStr string `toml:"build_platform" config:"default=linux/amd64"`

	// SentinelImage is the container image used for new sentinel deployments.
	// Overrides default sentinel image with custom build or registry.
	SentinelImage string `toml:"sentinel_image" config:"default=ghcr.io/unkeyed/unkey:local"`

	// CnameDomain is the base domain for custom domain CNAME targets.
	// Each custom domain gets a unique subdomain like "{random}.{CnameDomain}".
	CnameDomain string `toml:"cname_domain" config:"required,nonempty"`

	// Database configures MySQL connections. See [config.DatabaseConfig].
	Database config.DatabaseConfig `toml:"database"`

	// Vault configures the encryption/decryption service. See [config.VaultConfig].
	Vault config.VaultConfig `toml:"vault"`

	// Acme configures automatic TLS certificate management.
	// Enables Let's Encrypt integration for domain certificates.
	Acme AcmeConfig `toml:"acme"`

	// Restate configures workflow engine integration.
	// Enables asynchronous deployment and certificate renewal workflows.
	Restate RestateConfig `toml:"restate"`

	// Depot configures Depot.dev build service integration.
	Depot DepotConfig `toml:"depot"`

	// Registry configures container registry authentication.
	Registry RegistryConfig `toml:"registry"`

	// ClickHouse configures ClickHouse connections.
	ClickHouse ClickHouseConfig `toml:"clickhouse"`

	// GitHub configures GitHub App integration for webhook-triggered deployments.
	GitHub *GitHubConfig `toml:"github"`

	// Heartbeat configures Checkly heartbeat URLs for health monitoring.
	Heartbeat HeartbeatConfig `toml:"heartbeat"`

	// Slack configures Slack webhook URLs for notifications.
	Slack SlackConfig `toml:"slack"`

	// Clock provides time operations for testing and scheduling.
	// Use clock.New() for production deployments.
	Clock clock.Clock `toml:"-"`
}

type DepotConfig struct {
	// APIUrl is the Depot API endpoint URL for build operations.
	// Example: "https://api.depot.dev".
	APIUrl string `toml:"api_url"`

	// ProjectRegion is the geographic region for build storage.
	// Affects build performance and data residency.
	// Options: "us-east-1", "eu-central-1". Default: "us-east-1".
	ProjectRegion string `toml:"project_region" config:"default=us-east-1"`
}

type GitHubConfig struct {
	// AppID is the GitHub App ID for authentication.
	AppID int64 `toml:"app_id"`

	// PrivateKeyPEM is the GitHub App private key in PEM format.
	PrivateKeyPEM string `toml:"private_key_pem"`

	// AllowUnauthenticatedDeployments controls whether deployments can skip
	// GitHub authentication. Set to true only for local development.
	// Production should keep this false to require GitHub App authentication.
	AllowUnauthenticatedDeployments bool `toml:"allow_unauthenticated_deployments"`
}

type HeartbeatConfig struct {
	// CertRenewalURL is the Checkly heartbeat URL for certificate renewal.
	// When set, a heartbeat is sent after successful certificate renewal runs.
	// Optional - if empty, no heartbeat is sent.
	CertRenewalURL string `toml:"cert_renewal_url"`

	// QuotaCheckURL is the Checkly heartbeat URL for quota checks.
	// When set, a heartbeat is sent after successful quota check runs.
	// Optional - if empty, no heartbeat is sent.
	QuotaCheckURL string `toml:"quota_check_url"`

	// KeyRefillURL is the Checkly heartbeat URL for key refill runs.
	// When set, a heartbeat is sent after successful key refill runs.
	// Optional - if empty, no heartbeat is sent.
	KeyRefillURL string `toml:"key_refill_url"`

	// KeyLastUsedSyncURL is the Checkly heartbeat URL for key last-used sync runs.
	// When set, a heartbeat is sent after successful sync runs.
	// Optional - if empty, no heartbeat is sent.
	KeyLastUsedSyncURL string `toml:"key_last_used_sync_url"`
}

type RegistryConfig struct {
	// URL is the container registry endpoint URL.
	// Example: "registry.depot.dev" or "https://registry.example.com".
	URL string `toml:"url"`

	// Username is the registry authentication username.
	// Common values: "x-token" for token-based auth, or actual username.
	Username string `toml:"username"`

	// Password is the registry password or authentication token.
	// Should be stored securely and rotated regularly.
	Password string `toml:"password"`
}

type RestateConfig struct {
	// AdminURL is the Restate admin endpoint URL for service registration.
	// Used by the worker to register its workflow services.
	// Example: "http://restate:9070".
	AdminURL string `toml:"admin_url" config:"default=http://restate:9070"`

	// APIKey is the optional authentication key for Restate admin API requests.
	// If set, this key will be sent with all requests to the Restate admin API.
	APIKey string `toml:"api_key"`

	// HttpPort is the port where the worker listens for Restate requests.
	// This is the internal Restate server port, not the health check port.
	HttpPort int `toml:"http_port" config:"default=9080,min=1,max=65535"`

	// RegisterAs is the service URL used for self-registration with Restate.
	// Allows Restate to discover and invoke this worker's services.
	// Example: "http://worker:9080".
	RegisterAs string `toml:"register_as"`
}

type Route53Config struct {
	// Enabled determines whether Route53 DNS-01 challenges are used.
	// When true, wildcard certificates can be automatically obtained.
	Enabled bool `toml:"enabled"`

	// AccessKeyID is the AWS access key ID for Route53 API access.
	AccessKeyID string `toml:"access_key_id"`

	// SecretAccessKey is the AWS secret access key for Route53 API access.
	SecretAccessKey string `toml:"secret_access_key"`

	// Region is the AWS region where Route53 hosted zones are located.
	// Example: "us-east-1", "us-west-2".
	Region string `toml:"region" config:"default=us-east-1"`

	// HostedZoneID overrides automatic zone discovery.
	// Required when domains have complex CNAME setups that confuse
	// automatic zone lookup (e.g., wildcard CNAMEs to load balancers).
	HostedZoneID string `toml:"hosted_zone_id"`
}

type SlackConfig struct {
	// QuotaCheckWebhookURL is the Slack webhook URL for quota exceeded notifications.
	// When set, Slack notifications are sent when workspaces exceed their quota.
	// Optional - if empty, no Slack notifications are sent.
	QuotaCheckWebhookURL string `toml:"quota_check_webhook_url"`
}