embedgw

type Config struct {
	// RootUserAccess is the access key ID for the root account. The root
	// account is granted full authorization to all API requests after
	// authentication. Required.
	RootUserAccess string
	// RootUserSecret is the secret access key for the root account. Required.
	RootUserSecret string
	// Region is the AWS region name reported to S3 clients (e.g. "us-east-1").
	// Defaults to "us-east-1" when empty.
	Region string

	// Ports is the list of S3 API listening addresses. Each entry can be
	// "host:port" to bind a specific interface, or ":port" to bind all
	// interfaces. Hostnames are resolved to all matching IPs. UNIX domain
	// sockets are supported as absolute or relative paths, or Linux abstract
	// namespace sockets prefixed with "@" (e.g. "@versitygw-s3"). Multiple
	// entries are supported (e.g. [":7070", "localhost:9090"]). Required.
	Ports []string

	// AdminPorts is the list of admin API listening addresses. Accepts the
	// same formats as Ports. When empty, the admin API is served on the same
	// endpoints as the S3 API. Setting this allows finer-grained firewall
	// control over the admin endpoint with optionally separate TLS certs.
	AdminPorts []string

	// MaxConnections is the maximum number of concurrent TCP connections
	// accepted by the S3 API server.
	MaxConnections int
	// MaxRequests is the maximum number of concurrent in-flight S3 requests.
	// Should not exceed MaxConnections; if it does, a warning is logged.
	MaxRequests int

	// AdminMaxConnections is the maximum concurrent TCP connections for the
	// separate admin server. Only used when AdminPorts is non-empty.
	AdminMaxConnections int
	// AdminMaxRequests is the maximum concurrent in-flight requests for the
	// admin server. Should not exceed AdminMaxConnections.
	AdminMaxRequests int

	// MultipartMaxParts is the maximum number of parts allowed in a single
	// multipart upload. The S3 specification allows up to 10,000 parts;
	// the default value of 10000 matches the AWS S3 maximum. Clients that
	// attempt to upload more parts than this limit receive an error.
	MultipartMaxParts int

	// CertFile is the path to the TLS certificate file for the S3 API server.
	// Both CertFile and KeyFile must be provided together to enable TLS.
	CertFile string
	// KeyFile is the path to the TLS private key file for the S3 API server.
	KeyFile string

	// AdminCertFile is the path to the TLS certificate for the admin server.
	// Both AdminCertFile and AdminKeyFile must be provided together. When
	// empty and AdminPorts is set, the admin server runs without TLS.
	AdminCertFile string
	// AdminKeyFile is the path to the TLS private key for the admin server.
	AdminKeyFile string

	// CORSAllowOrigin sets the default Access-Control-Allow-Origin response
	// header value applied when no bucket-level CORS configuration exists and
	// for all admin API responses. When WebuiPorts is set and this is empty,
	// it defaults to "*". For production, set this to a specific origin
	// (e.g. "https://webui.example.com") to restrict cross-origin access.
	CORSAllowOrigin string

	// Debug enables verbose debug logging to stdout, including details for
	// signature verification steps. Not intended for production use.
	Debug bool
	// IAMDebug enables verbose IAM subsystem debug logging.
	IAMDebug bool
	// Quiet suppresses per-request summary logging to stdout.
	Quiet bool
	// Readonly restricts the gateway to read-only S3 operations; all write
	// requests are rejected.
	Readonly bool
	// KeepAlive enables HTTP keep-alive on S3 API connections.
	KeepAlive bool
	// DisableACLs disables ACL enforcement at the gateway level. All ACL
	// headers on requests are ignored and no access control is enforced via
	// bucket ACLs. PutBucketAcl returns AccessControlListNotSupported.
	// Prefer bucket policies over ACLs when this is enabled.
	DisableACLs bool
	// DisableStrictBucketNames allows legacy or non-DNS-compliant bucket
	// names by skipping strict validation. By default, bucket name validation
	// follows the rules described in the AWS S3 documentation.
	DisableStrictBucketNames bool

	// VirtualDomain enables virtual-hosted-style bucket addressing. Set to
	// the base domain name (e.g. "s3.example.com") so that bucket access uses
	// the form "https://<bucket>.s3.example.com/". Path-style addressing
	// remains enabled alongside it. Each bucket typically requires a DNS
	// entry pointing to the gateway.
	VirtualDomain string

	// HealthPath is the URL path for unauthenticated health-check requests
	// (e.g. "/healthz"). The endpoint returns HTTP 200 for GET requests and
	// is commonly used by load balancers. Any bucket whose name matches the
	// path segment is masked while this is set.
	HealthPath string

	// SocketPerm is the octal file-mode string for UNIX domain socket
	// permissions (e.g. "0660" for owner+group read/write). Has no effect on
	// TCP/IP addresses or Linux abstract "@" namespace sockets. When empty,
	// permissions are determined by the process umask.
	SocketPerm string

	// IAMDir enables the local file-based IAM backend. Set to the directory
	// path where account files are stored. Account data is plain text
	// protected only by filesystem permissions; suitable for development but
	// not recommended for production deployments.
	IAMDir string

	// LDAPServerURL is the URL of the LDAP server (e.g. "ldap://ldap.example.com:389").
	LDAPServerURL string
	// LDAPBindDN is the distinguished name used to bind to the LDAP server.
	LDAPBindDN string
	// LDAPPassword is the password for LDAPBindDN.
	LDAPPassword string
	// LDAPQueryBase is the base DN for user search queries.
	LDAPQueryBase string
	// LDAPObjClasses is the LDAP object class filter for user entries.
	LDAPObjClasses string
	// LDAPAccessAttr is the LDAP attribute that holds the S3 access key ID.
	LDAPAccessAttr string
	// LDAPSecretAttr is the LDAP attribute that holds the S3 secret key.
	LDAPSecretAttr string
	// LDAPRoleAttr is the LDAP attribute that holds the user role.
	LDAPRoleAttr string
	// LDAPUserIDAttr is the LDAP attribute that holds the POSIX user ID.
	LDAPUserIDAttr string
	// LDAPGroupIDAttr is the LDAP attribute that holds the POSIX group ID.
	LDAPGroupIDAttr string
	// LDAPProjectIDAttr is the LDAP attribute that holds the project ID.
	LDAPProjectIDAttr string
	// LDAPTLSSkipVerify disables TLS certificate verification for the LDAP
	// connection. Use only in development or trusted internal environments.
	LDAPTLSSkipVerify bool

	// VaultEndpointURL is the HashiCorp Vault server URL
	// (e.g. "https://vault.example.com:8200").
	VaultEndpointURL string
	// VaultNamespace is the Vault namespace to use (Vault Enterprise only).
	VaultNamespace string
	// VaultSecretStoragePath is the KV secrets engine path where account
	// data is stored.
	VaultSecretStoragePath string
	// VaultSecretStorageNamespace is the Vault namespace for the secrets
	// storage path (Vault Enterprise only).
	VaultSecretStorageNamespace string
	// VaultAuthMethod is the Vault authentication method to use
	// (e.g. "token", "approle").
	VaultAuthMethod string
	// VaultAuthNamespace is the Vault namespace used for authentication
	// (Vault Enterprise only).
	VaultAuthNamespace string
	// VaultMountPath is the mount path of the auth method in Vault.
	VaultMountPath string
	// VaultRootToken is the Vault token used when VaultAuthMethod is "token".
	VaultRootToken string
	// VaultRoleID is the AppRole role ID used when VaultAuthMethod is "approle".
	VaultRoleID string
	// VaultRoleSecret is the AppRole secret ID.
	VaultRoleSecret string
	// VaultServerCert is the path to the CA certificate used to verify the
	// Vault server's TLS certificate.
	VaultServerCert string
	// VaultClientCert is the path to the client TLS certificate for mutual
	// TLS authentication with Vault.
	VaultClientCert string
	// VaultClientCertKey is the path to the private key for VaultClientCert.
	VaultClientCertKey string

	// S3IAMAccess is the access key ID for the S3-backed IAM backend.
	S3IAMAccess string
	// S3IAMSecret is the secret key for the S3-backed IAM backend.
	S3IAMSecret string
	// S3IAMRegion is the AWS region of the S3-backed IAM bucket.
	S3IAMRegion string
	// S3IAMBucket is the bucket name that stores IAM account data.
	S3IAMBucket string
	// S3IAMEndpoint is the endpoint URL for the S3-backed IAM service.
	// Useful when using a non-AWS S3-compatible store.
	S3IAMEndpoint string
	// S3IAMDisableSSLVerify disables TLS certificate verification for the
	// S3-backed IAM connection. Use only in development or trusted internal
	// environments.
	S3IAMDisableSSLVerify bool

	// IpaHost is the hostname or URL of the FreeIPA server.
	IpaHost string
	// IpaVaultName is the name of the FreeIPA vault used to store credentials.
	IpaVaultName string
	// IpaUser is the FreeIPA username for authentication.
	IpaUser string
	// IpaPassword is the FreeIPA password for authentication.
	IpaPassword string
	// IpaInsecure disables TLS certificate verification for the FreeIPA
	// connection.
	IpaInsecure bool

	// IAMCacheDisable disables the in-memory IAM account cache. By default,
	// accounts are cached to reduce backend lookup frequency.
	IAMCacheDisable bool
	// IAMCacheTTL is the time-to-live in seconds for cached IAM entries.
	IAMCacheTTL int
	// IAMCachePrune is the interval in seconds between cache prune runs that
	// remove expired entries.
	IAMCachePrune int

	// AccessLog is the file path for S3 request access logs in the AWS S3
	// access log format. Use absolute paths; relative paths may break if the
	// server changes its working directory. Empty disables file logging.
	AccessLog string
	// LogWebhookURL is an HTTP(S) URL that receives S3 access log entries as
	// JSON-encoded POST requests. Can be set alongside AccessLog.
	LogWebhookURL string
	// AdminLogFile is the file path for admin API request logs.
	AdminLogFile string

	// MetricsService is the service name label attached to all emitted metrics.
	// Defaults to the system hostname when empty.
	MetricsService string
	// StatsdServers is a comma-separated list of StatsD server addresses
	// (e.g. "localhost:8125").
	StatsdServers string
	// DogstatsServers is a comma-separated list of DogStatsD server addresses.
	DogstatsServers string

	// KafkaURL is the broker URL for Kafka event notifications
	// (e.g. "kafka://broker:9092").
	KafkaURL string
	// KafkaTopic is the Kafka topic name for bucket event messages.
	KafkaTopic string
	// KafkaKey is the optional Kafka message key.
	KafkaKey string
	// NatsURL is the NATS server URL for event notifications
	// (e.g. "nats://localhost:4222").
	NatsURL string
	// NatsTopic is the NATS subject for bucket event messages.
	NatsTopic string
	// RabbitmqURL is the RabbitMQ connection URL
	// (e.g. "amqp://user:pass@rabbitmq:5672/").
	RabbitmqURL string
	// RabbitmqExchange is the RabbitMQ exchange to publish events to.
	// Leave empty to use the default exchange.
	RabbitmqExchange string
	// RabbitmqRoutingKey is the routing key for RabbitMQ event messages.
	// Leave empty to use no routing key.
	RabbitmqRoutingKey string
	// EventWebhookURL is an HTTP(S) URL that receives bucket event
	// notifications as POST requests.
	EventWebhookURL string
	// EventConfigFilePath is the path to a JSON event filter configuration
	// file that controls which events are forwarded to the active event sink.
	// When empty, all events are forwarded. Generate a default config with:
	// versitygw utils gen-event-filter-config --path <dir>
	EventConfigFilePath string

	// WebuiPorts is the list of listening addresses for the standalone WebUI
	// server. Accepts the same formats as Ports. When empty, the WebUI server
	// is disabled.
	WebuiPorts []string
	// WebuiCertFile is the path to the TLS certificate for the WebUI server.
	// When empty and gateway TLS (CertFile/KeyFile) is configured, the WebUI
	// inherits those certs. Both WebuiCertFile and WebuiKeyFile must be
	// provided together.
	WebuiCertFile string
	// WebuiKeyFile is the path to the TLS private key for the WebUI server.
	WebuiKeyFile string
	// WebuiNoTLS forces the WebUI to use plain HTTP even when TLS certificates
	// are available. Useful when TLS is terminated by a reverse proxy in front
	// of the WebUI.
	WebuiNoTLS bool
	// WebuiGateways overrides the S3 gateway URLs provided to the WebUI. By
	// default the gateway auto-detects URLs from Ports. Set this when running
	// behind a reverse proxy or load balancer where the auto-detected URLs are
	// incorrect (e.g. ["https://s3.example.com", "http://192.168.1.1:7070"]).
	WebuiGateways []string
	// WebuiAdminGateways overrides the admin gateway URLs provided to the
	// WebUI. By default the gateway auto-detects URLs from AdminPorts, or
	// reuses WebuiGateways when AdminPorts is empty.
	WebuiAdminGateways []string
	// WebuiPathPrefix is the URL path prefix under which the WebUI and its
	// API endpoints are served (e.g. "/ui"). Must start with "/" and be a
	// single path segment with no trailing slash. Leave empty to serve from
	// the root path.
	WebuiPathPrefix string

	// WebuiS3Prefix mounts the WebUI directly on the S3 API endpoint at the
	// given path prefix (e.g. "/ui"). Requests matching the prefix are routed
	// to the WebUI instead of S3. Any bucket whose name equals the prefix
	// segment is masked. Leave empty to disable WebUI hosting on the S3
	// endpoint.
	WebuiS3Prefix string

	// Static website hosting endpoint
	//
	// WebsitePorts is the list of listening addresses for the static website
	// hosting endpoint. Accepts the same formats as Ports. When empty, the
	// website endpoint is disabled.
	WebsitePorts []string
	// WebsiteDomain is the base domain for website virtual-host routing. For
	// example, host "blog.example.com" serves bucket "blog" when this is
	// "example.com". When empty, the full request hostname is used as the
	// bucket name.
	WebsiteDomain string
	// WebsiteCertFile is the path to the TLS certificate for the website
	// endpoint. When empty and gateway TLS (CertFile/KeyFile) is configured,
	// the website endpoint inherits those certs. Both WebsiteCertFile and
	// WebsiteKeyFile must be provided together.
	WebsiteCertFile string
	// WebsiteKeyFile is the path to the TLS private key for the website
	// endpoint.
	WebsiteKeyFile string
	// WebsiteNoTLS forces the website endpoint to use plain HTTP even when TLS
	// certificates are available.
	WebsiteNoTLS bool

	// SigHup is an optional channel that signals the gateway to reload TLS
	// certificates and rotate log files (equivalent to SIGHUP). When nil,
	// this feature is disabled.
	SigHup <-chan struct{}

	// S3Options are appended to the internally built s3api options before the
	// S3 server is created. This allows callers to inject custom behavior such
	// as request middleware.
	S3Options []s3api.Option

	// Version, Build, and BuildTime are displayed in the startup banner.
	// All three are optional; omit or leave empty to suppress the field.
	Version   string
	Build     string
	BuildTime string
}