embedgw

type Config struct {
	// RootUserAccess is the access key ID for the root account. The root
	// account is granted full authorization to all API requests after
	// authentication. Required.
	RootUserAccess string
	// RootUserSecret is the secret access key for the root account. Required.
	RootUserSecret string
	// Region is the AWS region name reported to S3 clients (e.g. "us-east-1").
	// Defaults to "us-east-1" when empty.
	Region string

	// Ports is the list of S3 API listening addresses. Each entry can be
	// "host:port" to bind a specific interface, or ":port" to bind all
	// interfaces. Hostnames are resolved to all matching IPs. UNIX domain
	// sockets are supported as absolute or relative paths, or Linux abstract
	// namespace sockets prefixed with "@" (e.g. "@versitygw-s3"). Multiple
	// entries are supported (e.g. [":7070", "localhost:9090"]). Required.
	Ports []string

	// AdminPorts is the list of admin API listening addresses. Accepts the
	// same formats as Ports. When empty, the admin API is served on the same
	// endpoints as the S3 API. Setting this allows finer-grained firewall
	// control over the admin endpoint with optionally separate TLS certs.
	AdminPorts []string

	// AdminPathPrefix mounts the admin API under a URL path prefix (e.g.
	// "/admin"), on AdminPorts or, when those are empty, on the S3 endpoints.
	// Must be "/" followed by a single segment of unreserved characters
	// (letters, digits, '-', '.', '_', '~'), other than "." or "..". Leave
	// empty to serve from the root path.
	AdminPathPrefix string

	// AdminOptions carries extra standalone-admin-server options from
	// the embedding binary (e.g. additional admin routes). Only used
	// when AdminPorts is non-empty.
	AdminOptions []s3api.AdminOpt

	// MaxConnections is the maximum number of concurrent TCP connections
	// accepted by the S3 API server.
	MaxConnections int
	// MaxRequests is the maximum number of concurrent in-flight S3 requests.
	// Should not exceed MaxConnections; if it does, a warning is logged.
	MaxRequests int

	// AdminMaxConnections is the maximum concurrent TCP connections for the
	// separate admin server. Only used when AdminPorts is non-empty.
	AdminMaxConnections int
	// AdminMaxRequests is the maximum concurrent in-flight requests for the
	// admin server. Should not exceed AdminMaxConnections.
	AdminMaxRequests int

	// MultipartMaxParts is the maximum number of parts allowed in a single
	// multipart upload. The S3 specification allows up to 10,000 parts;
	// the default value of 10000 matches the AWS S3 maximum. Clients that
	// attempt to upload more parts than this limit receive an error.
	MultipartMaxParts int

	// CertFile is the path to the TLS certificate file for the S3 API server.
	// Both CertFile and KeyFile must be provided together to enable TLS.
	CertFile string
	// KeyFile is the path to the TLS private key file for the S3 API server.
	KeyFile string

	// AdminCertFile is the path to the TLS certificate for the admin server.
	// Both AdminCertFile and AdminKeyFile must be provided together. When
	// empty and AdminPorts is set, the admin server runs without TLS.
	AdminCertFile string
	// AdminKeyFile is the path to the TLS private key for the admin server.
	AdminKeyFile string

	// CORSAllowOrigin sets the default Access-Control-Allow-Origin response
	// header value applied when no bucket-level CORS configuration exists and
	// for all admin API responses. When WebuiPorts is set and this is empty,
	// it defaults to "*". For production, set this to a specific origin
	// (e.g. "https://webui.example.com") to restrict cross-origin access.
	CORSAllowOrigin string

	// LogLevel controls the debug logger: LevelSilent (default) prints
	// nothing, LevelDebug prints full request/response details with
	// secrets and tokens masked, and LevelUnsafe prints them unmasked.
	// Never use LevelUnsafe in production.
	LogLevel debuglogger.Level
	// IAMDebug enables verbose IAM subsystem debug logging. Has no effect
	// when LogLevel is LevelSilent.
	IAMDebug bool
	// Quiet suppresses per-request summary logging to stdout.
	Quiet bool
	// Readonly restricts the gateway to read-only S3 operations; all write
	// requests are rejected.
	Readonly bool
	// KeepAlive enables HTTP keep-alive on S3 API connections.
	KeepAlive bool
	// DisableACLs disables ACL enforcement at the gateway level. All ACL
	// headers on requests are ignored and no access control is enforced via
	// bucket ACLs. PutBucketAcl returns AccessControlListNotSupported.
	// Prefer bucket policies over ACLs when this is enabled.
	DisableACLs bool
	// DisableSSECTLS disables the HTTPS requirement for SSE-C requests.
	DisableSSECTLS bool
	// DisableStrictBucketNames allows legacy or non-DNS-compliant bucket
	// names by skipping strict validation. By default, bucket name validation
	// follows the rules described in the AWS S3 documentation.
	DisableStrictBucketNames bool

	// VirtualDomain enables virtual-hosted-style bucket addressing. Set to
	// the base domain name (e.g. "s3.example.com") so that bucket access uses
	// the form "https://<bucket>.s3.example.com/". Path-style addressing
	// remains enabled alongside it. Each bucket typically requires a DNS
	// entry pointing to the gateway.
	VirtualDomain string

	// HealthPath is the URL path for unauthenticated health-check requests
	// (e.g. "/healthz"). The endpoint returns HTTP 200 for GET requests and
	// is commonly used by load balancers. Any bucket whose name matches the
	// path segment is masked while this is set.
	HealthPath string

	// SocketPerm is the octal file-mode string for UNIX domain socket
	// permissions (e.g. "0660" for owner+group read/write). Has no effect on
	// TCP/IP addresses or Linux abstract "@" namespace sockets. When empty,
	// permissions are determined by the process umask.
	SocketPerm string

	// IAMService, when non-nil, is used directly as the gateway's IAM
	// backend, bypassing all other IAM Backend fields below.
	IAMService auth.IAMService

	// IAMDir enables the local file-based IAM backend. Set to the directory
	// path where account files are stored. Account data is plain text
	// protected only by filesystem permissions; suitable for development but
	// not recommended for production deployments.
	IAMDir string

	// LDAPServerURL is the URL of the LDAP server (e.g. "ldap://ldap.example.com:389").
	LDAPServerURL string
	// LDAPBindDN is the distinguished name used to bind to the LDAP server.
	LDAPBindDN string
	// LDAPPassword is the password for LDAPBindDN.
	LDAPPassword string
	// LDAPQueryBase is the base DN for user search queries.
	LDAPQueryBase string
	// LDAPObjClasses is the LDAP object class filter for user entries.
	LDAPObjClasses string
	// LDAPAccessAttr is the LDAP attribute that holds the S3 access key ID.
	LDAPAccessAttr string
	// LDAPSecretAttr is the LDAP attribute that holds the S3 secret key.
	LDAPSecretAttr string
	// LDAPRoleAttr is the LDAP attribute that holds the user role.
	LDAPRoleAttr string
	// LDAPUserIDAttr is the LDAP attribute that holds the POSIX user ID.
	LDAPUserIDAttr string
	// LDAPGroupIDAttr is the LDAP attribute that holds the POSIX group ID.
	LDAPGroupIDAttr string
	// LDAPProjectIDAttr is the LDAP attribute that holds the project ID.
	LDAPProjectIDAttr string
	// LDAPTLSSkipVerify disables TLS certificate verification for the LDAP
	// connection. Use only in development or trusted internal environments.
	LDAPTLSSkipVerify bool

	// VaultEndpointURL is the HashiCorp Vault server URL
	// (e.g. "https://vault.example.com:8200").
	VaultEndpointURL string
	// VaultNamespace is the Vault namespace to use (Vault Enterprise only).
	VaultNamespace string
	// VaultSecretStoragePath is the KV secrets engine path where account
	// data is stored.
	VaultSecretStoragePath string
	// VaultSecretStorageNamespace is the Vault namespace for the secrets
	// storage path (Vault Enterprise only).
	VaultSecretStorageNamespace string
	// VaultAuthMethod is the Vault authentication method to use
	// (e.g. "token", "approle").
	VaultAuthMethod string
	// VaultAuthNamespace is the Vault namespace used for authentication
	// (Vault Enterprise only).
	VaultAuthNamespace string
	// VaultMountPath is the mount path of the auth method in Vault.
	VaultMountPath string
	// VaultRootToken is the Vault token used when VaultAuthMethod is "token".
	VaultRootToken string
	// VaultRoleID is the AppRole role ID used when VaultAuthMethod is "approle".
	VaultRoleID string
	// VaultRoleSecret is the AppRole secret ID.
	VaultRoleSecret string
	// VaultServerCert is the path to the CA certificate used to verify the
	// Vault server's TLS certificate.
	VaultServerCert string
	// VaultClientCert is the path to the client TLS certificate for mutual
	// TLS authentication with Vault.
	VaultClientCert string
	// VaultClientCertKey is the path to the private key for VaultClientCert.
	VaultClientCertKey string

	// S3IAMAccess is the access key ID for the S3-backed IAM backend.
	S3IAMAccess string
	// S3IAMSecret is the secret key for the S3-backed IAM backend.
	S3IAMSecret string
	// S3IAMRegion is the AWS region of the S3-backed IAM bucket.
	S3IAMRegion string
	// S3IAMBucket is the bucket name that stores IAM account data.
	S3IAMBucket string
	// S3IAMEndpoint is the endpoint URL for the S3-backed IAM service.
	// Useful when using a non-AWS S3-compatible store.
	S3IAMEndpoint string
	// S3IAMDisableSSLVerify disables TLS certificate verification for the
	// S3-backed IAM connection. Use only in development or trusted internal
	// environments.
	S3IAMDisableSSLVerify bool

	// IpaHost is the hostname or URL of the FreeIPA server.
	IpaHost string
	// IpaVaultName is the name of the FreeIPA vault used to store credentials.
	IpaVaultName string
	// IpaUser is the FreeIPA username for authentication.
	IpaUser string
	// IpaPassword is the FreeIPA password for authentication.
	IpaPassword string
	// IpaInsecure disables TLS certificate verification for the FreeIPA
	// connection.
	IpaInsecure bool

	// StandaloneIAMEndpoint is either a "host:port" TCP address (mTLS
	// required — see StandaloneClientCert/ClientCertKey/ServerCA) or a
	// unix socket path for the standalone IAM service's private endpoints.
	StandaloneIAMEndpoint string
	// StandaloneIAMAccess/StandaloneIAMSecret are this gateway's own
	// signing identity for its calls to the private endpoints — not a
	// fetched account. Both must be set together, or both left empty to
	// default to RootUserAccess/RootUserSecret.
	StandaloneIAMAccess string
	StandaloneIAMSecret string
	// StandaloneClientCert/ClientCertKey are this gateway's client
	// certificate/key for outbound mTLS to the private endpoints. Required
	// (together with StandaloneServerCA) unless StandaloneIAMEndpoint is a
	// unix socket.
	StandaloneClientCert    string
	StandaloneClientCertKey string
	// StandaloneServerCA verifies the standalone IAM service's server
	// certificate.
	StandaloneServerCA string
	// StandaloneDefaultUserID/GroupID/ProjectID are the POSIX uid/gid/
	// project-id assigned to every account resolved through this backend.
	// The standalone IAM service's user model has no per-user POSIX
	// identity concept, so every standalone-backed account shares these
	// one configured values for backend file-ownership purposes.
	StandaloneDefaultUserID    int
	StandaloneDefaultGroupID   int
	StandaloneDefaultProjectID int

	// IAMCacheDisable disables the in-memory IAM account cache. By default,
	// accounts are cached to reduce backend lookup frequency.
	IAMCacheDisable bool
	// IAMCacheTTL is the time-to-live in seconds for cached IAM entries.
	IAMCacheTTL int
	// IAMCachePrune is the interval in seconds between cache prune runs that
	// remove expired entries.
	IAMCachePrune int

	// AccessLog is the file path or stream name (stdout, stderr, or - for
	// stdout) for S3 request access logs in the AWS S3
	// access log format. Use absolute paths; relative paths may break if the
	// server changes its working directory. Empty disables file logging.
	AccessLog string
	// LogWebhookURL is an HTTP(S) URL that receives S3 access log entries as
	// JSON-encoded POST requests. Can be set alongside AccessLog.
	LogWebhookURL string
	// AdminLogFile is the file path or stream name (stdout, stderr, or - for
	// stdout) for admin API request logs.
	AdminLogFile string
	// ClientIPHeader records the client address from this proxy header in the
	// request log and the S3 and admin access logs. Accepted values are
	// "X-Forwarded-For" and "X-Real-Ip". Empty (the default) keeps the socket
	// peer address. The header is only honoured from a peer in
	// TrustedProxies, which is required when this is set. IAM aws:SourceIp
	// conditions are unaffected and keep evaluating the socket address.
	ClientIPHeader string
	// TrustedProxies lists the comma-separated IP addresses and CIDR prefixes
	// of the proxies in front of the gateway. The entry "unix" trusts a peer
	// connected over a unix domain socket, whose address fasthttp reports as
	// 0.0.0.0. Required when ClientIPHeader is set: the header is ignored
	// from any other peer, and startup fails when the header is set with no
	// trusted proxies.
	TrustedProxies string

	// MetricsService is the service name label attached to all emitted metrics.
	// Defaults to the system hostname when empty.
	MetricsService string
	// StatsdServers is a comma-separated list of StatsD server addresses
	// (e.g. "localhost:8125").
	StatsdServers string
	// DogstatsServers is a comma-separated list of DogStatsD server addresses.
	DogstatsServers string

	// KafkaURL is the broker URL for Kafka event notifications
	// (e.g. "kafka://broker:9092").
	KafkaURL string
	// KafkaTopic is the Kafka topic name for bucket event messages.
	KafkaTopic string
	// KafkaKey is the optional Kafka message key.
	KafkaKey string
	// NatsURL is the NATS server URL for event notifications
	// (e.g. "nats://localhost:4222").
	NatsURL string
	// NatsTopic is the NATS subject for bucket event messages.
	NatsTopic string
	// RabbitmqURL is the RabbitMQ connection URL
	// (e.g. "amqp://user:pass@rabbitmq:5672/").
	RabbitmqURL string
	// RabbitmqExchange is the RabbitMQ exchange to publish events to.
	// Leave empty to use the default exchange.
	RabbitmqExchange string
	// RabbitmqRoutingKey is the routing key for RabbitMQ event messages.
	// Leave empty to use no routing key.
	RabbitmqRoutingKey string
	// EventWebhookURL is an HTTP(S) URL that receives bucket event
	// notifications as POST requests.
	EventWebhookURL string
	// EventConfigFilePath is the path to a JSON event filter configuration
	// file that controls which events are forwarded to the active event sink.
	// When empty, all events are forwarded. Generate a default config with:
	// versitygw utils gen-event-filter-config --path <dir>
	EventConfigFilePath string

	// WebuiPorts is the list of listening addresses for the standalone WebUI
	// server. Accepts the same formats as Ports. When empty, the WebUI server
	// is disabled.
	WebuiPorts []string
	// WebuiCertFile is the path to the TLS certificate for the WebUI server.
	// When empty and gateway TLS (CertFile/KeyFile) is configured, the WebUI
	// inherits those certs. Both WebuiCertFile and WebuiKeyFile must be
	// provided together.
	WebuiCertFile string
	// WebuiKeyFile is the path to the TLS private key for the WebUI server.
	WebuiKeyFile string
	// WebuiNoTLS forces the WebUI to use plain HTTP even when TLS certificates
	// are available. Useful when TLS is terminated by a reverse proxy in front
	// of the WebUI.
	WebuiNoTLS bool
	// WebuiGateways overrides the S3 gateway URLs provided to the WebUI. By
	// default the gateway auto-detects URLs from Ports. Set this when running
	// behind a reverse proxy or load balancer where the auto-detected URLs are
	// incorrect (e.g. ["https://s3.example.com", "http://192.168.1.1:7070"]).
	WebuiGateways []string
	// WebuiAdminGateways overrides the admin gateway URLs provided to the
	// WebUI. By default the gateway auto-detects URLs from AdminPorts, or
	// reuses WebuiGateways when AdminPorts is empty, appending
	// AdminPathPrefix in both cases.
	WebuiAdminGateways []string
	// WebuiIAMGateways are the standalone IAM service (versitygw iam) URLs
	// offered to the WebUI's optional IAM endpoint field. There is no
	// auto-detected fallback, since the IAM service is a separate process;
	// empty hides the IAM navigation unless the operator types an endpoint on
	// the login page. Once an IAM endpoint is in play the WebUI ignores the
	// admin API entirely.
	WebuiIAMGateways []string
	// WebuiPathPrefix is the URL path prefix under which the WebUI and its
	// API endpoints are served (e.g. "/ui"). Must start with "/" and be a
	// single path segment with no trailing slash. Leave empty to serve from
	// the root path.
	WebuiPathPrefix string

	// WebuiS3Prefix mounts the WebUI directly on the S3 API endpoint at the
	// given path prefix (e.g. "/ui"). Requests matching the prefix are routed
	// to the WebUI instead of S3. Any bucket whose name equals the prefix
	// segment is masked. Leave empty to disable WebUI hosting on the S3
	// endpoint.
	WebuiS3Prefix string

	// Static website hosting endpoint
	//
	// WebsitePorts is the list of listening addresses for the static website
	// hosting endpoint. Accepts the same formats as Ports. When empty, the
	// website endpoint is disabled.
	WebsitePorts []string
	// WebsiteDomain is the base domain for website virtual-host routing. For
	// example, host "blog.example.com" serves bucket "blog" when this is
	// "example.com". When empty, the full request hostname is used as the
	// bucket name.
	WebsiteDomain string
	// WebsiteCertFile is the path to the TLS certificate for the website
	// endpoint. When empty and gateway TLS (CertFile/KeyFile) is configured,
	// the website endpoint inherits those certs. Both WebsiteCertFile and
	// WebsiteKeyFile must be provided together.
	WebsiteCertFile string
	// WebsiteKeyFile is the path to the TLS private key for the website
	// endpoint.
	WebsiteKeyFile string
	// WebsiteNoTLS forces the website endpoint to use plain HTTP even when TLS
	// certificates are available.
	WebsiteNoTLS bool

	// SigHup is an optional channel that signals the gateway to reload TLS
	// certificates, including the IAM backend's own client certificates and
	// CA bundle when it implements auth.CertReloader, and rotate log files
	// (equivalent to SIGHUP). When nil, this feature is disabled.
	SigHup <-chan struct{}

	// S3Options are appended to the internally built s3api options before the
	// S3 server is created. This allows callers to inject custom behavior such
	// as request middleware.
	S3Options []s3api.Option

	// OnServicesReady runs after the operational services (access
	// logger, metrics manager, event sender) are created and before
	// the S3 server is built, so embedders can wire them into
	// components constructed earlier (such as the RDMA control
	// routes). A nil callback is skipped.
	OnServicesReady func(OpsServices)

	// Version, Build, and BuildTime are displayed in the startup banner.
	// All three are optional; omit or leave empty to suppress the field.
	Version   string
	Build     string
	BuildTime string
}

type IAMConfig struct {
	// RootUserAccess is the access key ID used to authenticate IAM API
	// requests. Required.
	RootUserAccess string
	// RootUserSecret is the secret access key used to authenticate IAM API
	// requests. Required.
	RootUserSecret string

	// Ports is the list of IAM API listening addresses. Each entry accepts
	// the same formats as Config.Ports: "host:port", ":port", file-backed
	// UNIX socket paths, or Linux abstract namespace sockets prefixed with
	// "@". Required.
	Ports []string

	// MaxConnections is the maximum number of concurrent TCP connections
	// accepted by the IAM API server.
	MaxConnections int
	// MaxRequests is the maximum number of concurrent in-flight IAM API
	// requests. Should not exceed MaxConnections.
	MaxRequests int

	// CertFile is the path to the TLS certificate file for the IAM API server.
	// Both CertFile and KeyFile must be provided together to enable TLS.
	CertFile string
	// KeyFile is the path to the TLS private key file for the IAM API server.
	KeyFile string

	// LogLevel controls the debug logger: LevelSilent (default) prints
	// nothing, LevelDebug prints full request/response details with
	// secrets and tokens masked, and LevelUnsafe prints them unmasked.
	// Never use LevelUnsafe in production.
	LogLevel debuglogger.Level
	// Quiet suppresses per-request summary logging and startup output.
	Quiet bool
	// KeepAlive enables HTTP keep-alive on IAM API connections.
	KeepAlive bool

	// HealthPath is the URL path for unauthenticated health-check requests
	// (e.g. "/healthz"). The endpoint returns HTTP 200 for GET requests.
	HealthPath string

	// SocketPerm is the octal file-mode string for file-backed UNIX domain
	// socket permissions. It has no effect on TCP/IP addresses or Linux
	// abstract namespace sockets.
	SocketPerm string

	// ClientIPHeader records the client address from this proxy header in the
	// IAM API and WebUI request logs. Accepted values are "X-Forwarded-For"
	// and "X-Real-Ip". Empty (the default) keeps the socket peer address. The
	// header is only honoured from a peer in TrustedProxies, which is
	// required when this is set.
	ClientIPHeader string
	// TrustedProxies lists the comma-separated IP addresses and CIDR prefixes
	// of the proxies in front of the IAM API. The entry "unix" trusts a peer
	// connected over a unix domain socket, whose address fasthttp reports as
	// 0.0.0.0. Required when ClientIPHeader is set: the header is ignored
	// from any other peer, and startup fails when the header is set with no
	// trusted proxies.
	TrustedProxies string

	// PrivatePorts is the list of listening addresses for the standalone
	// IAM service's private endpoints (derive-signing-key, evaluate-policy, resolve-identity)
	// — see private.PrivateAPI. Each address must be a unix socket, or a TCP
	// address with PrivateCertFile/PrivateKeyFile/PrivateClientCAFile all
	// set (mTLS with mandatory client-certificate verification); anything
	// else fails startup rather than serving these endpoints in the clear.
	// Empty disables the private endpoints entirely.
	PrivatePorts []string
	// PrivateCertFile/PrivateKeyFile are the private listener's own TLS
	// server certificate, distinct from CertFile/KeyFile (the public
	// control-plane listener's certificate) since the two listeners have
	// different security requirements.
	PrivateCertFile string
	PrivateKeyFile  string
	// PrivateClientCAFile verifies the S3 gateway's client certificate on
	// the private listener. Required, together with PrivateCertFile/
	// PrivateKeyFile, for any non-unix-socket PrivatePorts address.
	PrivateClientCAFile string
	// PrivateSocketPerm is the octal file-mode string for a file-backed
	// unix-socket PrivatePorts address.
	PrivateSocketPerm string

	// IAMDir enables local file-backed IAM API storage. Set to the directory
	// path where the IAM API user database is stored.
	IAMDir string

	// VaultEndpointURL enables Vault-backed IAM API storage.
	VaultEndpointURL string
	// VaultNamespace is the fallback Vault namespace used when the specific
	// auth or secret-storage namespace is not set.
	VaultNamespace string
	// VaultSecretStoragePath is the KV v2 path prefix under which IAM users
	// are stored (defaults to "iam").
	VaultSecretStoragePath string
	// VaultSecretStorageNamespace overrides VaultNamespace for KV operations.
	VaultSecretStorageNamespace string
	// VaultAuthMethod is the AppRole mount path (defaults to "approle").
	VaultAuthMethod string
	// VaultAuthNamespace overrides VaultNamespace for AppRole login.
	VaultAuthNamespace string
	// VaultMountPath is the KV v2 engine mount path (defaults to "kv-v2").
	VaultMountPath string
	// VaultRootToken authenticates with a root token instead of AppRole.
	VaultRootToken string
	// VaultRoleID is the AppRole role ID.
	VaultRoleID string
	// VaultRoleSecret is the AppRole secret ID.
	VaultRoleSecret string
	// VaultServerCert is the PEM-encoded Vault server TLS certificate for
	// verification.
	VaultServerCert string
	// VaultClientCert is the PEM-encoded client TLS certificate presented to
	// Vault.
	VaultClientCert string
	// VaultClientCertKey is the PEM-encoded private key for VaultClientCert.
	VaultClientCertKey string

	// CORSAllowOrigin is the Access-Control-Allow-Origin value the IAM API
	// returns to browsers, and the switch that enables preflight handling.
	// No browser can reach this API without it, so leaving it empty while
	// WebuiPorts is set logs a warning and falls back to "*".
	CORSAllowOrigin string

	// The Webui* fields host the WebUI from the IAM service process, for
	// deployments with no S3 gateway behind it. They mirror Config's Webui*
	// fields, except that here the IAM gateway URLs are the auto-detected
	// ones (from Ports) and the S3/admin URLs can only come from a flag.
	//
	// WebuiPorts is the list of listening addresses for the WebUI server.
	// Empty disables the WebUI entirely.
	WebuiPorts []string
	// WebuiCertFile/WebuiKeyFile are the WebUI server's TLS certificate. When
	// both are empty and WebuiNoTLS is not set, the WebUI inherits
	// CertFile/KeyFile.
	WebuiCertFile string
	WebuiKeyFile  string
	// WebuiNoTLS forces the WebUI to plain HTTP even when TLS is configured
	// for the IAM API.
	WebuiNoTLS bool
	// WebuiPathPrefix mounts the WebUI under a single-segment path prefix
	// (e.g. "/ui").
	WebuiPathPrefix string
	// WebuiIAMGateways overrides the IAM service URLs auto-detected from
	// Ports, for when the browser reaches the IAM API through a name this
	// process cannot see, such as an ingress hostname.
	WebuiIAMGateways []string
	// WebuiGateways and WebuiAdminGateways are the S3 and admin gateway URLs
	// offered on the login page. Neither is auto-detected here, so leaving
	// both empty produces an IAM-only dashboard.
	WebuiGateways      []string
	WebuiAdminGateways []string
	// Region seeds the WebUI's default region selector. IAM's own signing
	// region is fixed, so this only matters when WebuiGateways points the
	// dashboard at an S3 gateway as well.
	Region string

	// SigHup is an optional channel that signals the IAM API to reload its
	// TLS certificates and the private listener's client CA bundle. When
	// nil, this feature is disabled.
	SigHup <-chan struct{}

	// Version, Build, and BuildTime are displayed in the startup banner.
	// All three are optional.
	Version   string
	Build     string
	BuildTime string

	// DisableOIDCThumbprintAutoFetch disables CreateOpenIDConnectProvider's
	// TLS auto-fetch fallback for when ThumbprintList is omitted. When set,
	// an omitted ThumbprintList is rejected instead of the IAM API making an
	// outbound TLS connection to the caller-supplied URL — for restricted
	// or air-gapped deployments.
	DisableOIDCThumbprintAutoFetch bool

	// OIDCAllowPrivateEndpoints permits OIDC provider URLs that resolve to
	// loopback/private/link-local addresses and that carry an explicit port,
	// both refused by default. Required to use an IdP that exists only on an
	// internal network, such as a SPIFFE/SPIRE OIDC discovery provider on a
	// cluster-internal Service. Transport stays https and fully verified.
	OIDCAllowPrivateEndpoints bool

	// OIDCAllowInsecureTransport permits plaintext http OIDC provider URLs
	// and drops TLS certificate verification (ThumbprintList pinning
	// included) for https ones, leaving the network path as the only thing
	// authenticating the IdP. For an IdP reachable only over a path that is
	// itself trusted, such as a discovery provider bound to loopback as a
	// sidecar in this process's own pod.
	OIDCAllowInsecureTransport bool

	// OIDCDiscoveryURLs redirects individual providers' discovery-document
	// fetches, as "<provider url>=<discovery url>" pairs. The discovery URL
	// is fetched exactly as given, path included. Only the fetch moves: the
	// provider Url stays what a token's iss claim and the fetched document's
	// own issuer field must match, so an IdP can hand out tokens naming its
	// public issuer while this process reads its keys over a private,
	// in-cluster path.
	OIDCDiscoveryURLs []string
}

type OpsServices struct {
	Logger  s3log.AuditLogger
	Metrics metrics.Manager
	Events  s3event.S3EventSender
}