config

type AQLConfig struct {
	// MaxResults caps the rows of every query, its own limit included; zero
	// means no cap.
	MaxResults int `yaml:"max_results"`
	// NonAdminScanFactor multiplies a non-admin query's limit to read
	// enough rows that the limit is still met once unreadable rows are
	// filtered out. A request's scan-factor header overrides it.
	NonAdminScanFactor int `yaml:"non_admin_scan_factor"`
}

type AQLTimeoutConfig struct {
	// Query is Artifactory's artifactory.aql.query.timeout.seconds.
	Query time.Duration `yaml:"query"`
	// Streamed applies to a request with a stream: true header, as
	// Artifactory's artifactory.aql.streamed.query.timeout does.
	Streamed time.Duration `yaml:"streamed"`
}

type BlobAzureCDNConfig struct {
	FrontDoor FrontDoorConfig `yaml:"front_door"`
}

type BlobAzureConfig struct {
	Account   string `yaml:"account"`
	Endpoint  string `yaml:"endpoint"`
	Container string `yaml:"container"`
	Prefix    string `yaml:"prefix"`
	// Credential is shared_key, sas, connection_string, default (the Azure
	// SDK's default chain), managed_identity or workload_identity. Empty
	// picks connection_string, shared_key or sas when that secret is set,
	// otherwise default.
	Credential              string   `yaml:"credential"`
	AccountKey              string   `yaml:"account_key"`
	SASToken                string   `yaml:"sas_token"`
	ConnectionString        string   `yaml:"connection_string"`
	ManagedIdentityClientID string   `yaml:"managed_identity_client_id"`
	PartSize                ByteSize `yaml:"part_size"`
	CopyRangeSize           ByteSize `yaml:"copy_range_size"`
	Concurrency             int      `yaml:"concurrency"`
	// CDN is a CDN in front of the container (decision 0029).
	CDN BlobAzureCDNConfig `yaml:"cdn"`
}

type BlobBackendConfig struct {
	Backend string          `yaml:"backend"`
	FS      BlobFSConfig    `yaml:"fs"`
	S3      BlobS3Config    `yaml:"s3"`
	GCS     BlobGCSConfig   `yaml:"gcs"`
	Azure   BlobAzureConfig `yaml:"azure"`
}

type BlobConfig struct {
	BlobBackendConfig `yaml:",inline"`
	// Stores are named stores, the members a mirror chooses from.
	Stores map[string]BlobStoreConfig `yaml:"stores"`
	Mirror BlobMirrorConfig           `yaml:"mirror"`
}

type BlobFSConfig struct {
	Root string `yaml:"root"`
}

type BlobGCSCDNConfig struct {
	CloudCDN CloudCDNConfig `yaml:"cloud_cdn"`
}

type BlobGCSConfig struct {
	Bucket          string `yaml:"bucket"`
	Prefix          string `yaml:"prefix"`
	Endpoint        string `yaml:"endpoint"`
	CredentialsFile string `yaml:"credentials_file"`
	// GoogleAccessID is the service account that signs download URLs when
	// the credentials alone do not name one.
	GoogleAccessID string   `yaml:"google_access_id"`
	PartSize       ByteSize `yaml:"part_size"`
	// CDN is a CDN in front of the bucket (decision 0029).
	CDN BlobGCSCDNConfig `yaml:"cdn"`
}

type BlobMirrorConfig struct {
	// Members names the stores that hold copies.
	Members []string `yaml:"members"`
	// Redundancy is the number of copies of each blob; zero means every
	// member.
	Redundancy int `yaml:"redundancy"`
	// WriteQuorum is how many copies must be stored before an upload
	// succeeds; zero means Redundancy-1 (at least 1), so one member down
	// does not stop uploads.
	WriteQuorum int `yaml:"write_quorum"`
	// Zone is this instance's zone; members in it are preferred.
	Zone string `yaml:"zone"`
	// MemberTimeout bounds how long a member may finish after the quorum;
	// zero means 30s.
	MemberTimeout time.Duration `yaml:"member_timeout"`
}

type BlobS3CDNConfig struct {
	CloudFront CloudFrontConfig `yaml:"cloudfront"`
}

type BlobS3Config struct {
	Bucket    string `yaml:"bucket"`
	Prefix    string `yaml:"prefix"`
	Endpoint  string `yaml:"endpoint"`
	Region    string `yaml:"region"`
	PathStyle bool   `yaml:"path_style"`
	Profile   string `yaml:"profile"`
	// CDN is a CDN in front of the bucket (decision 0029).
	CDN BlobS3CDNConfig `yaml:"cdn"`
}

type BlobStoreConfig struct {
	BlobBackendConfig `       yaml:",inline"`
	Zone              string `yaml:"zone"`
	// WriteEnabled false drains the store: no new copies, reads continue.
	// Unset means true.
	WriteEnabled *bool `yaml:"write_enabled"`
}

type BootstrapConfig struct {
	AdminPassword string `yaml:"admin_password"`
	Descriptor    string `yaml:"descriptor"`
}

type BuildConfig struct {
	// BlockDuplicateEntries refuses a build-info publish whose module lists
	// one file twice, as Artifactory 7.x's
	// artifactory.build.block.duplicate.entries does by default.
	BlockDuplicateEntries bool `yaml:"block_duplicate_entries"`
}

type ByteSize int64

type CloudCDNConfig struct {
	// Domain is the load balancer host, or an http(s) URL for a test edge.
	Domain string `yaml:"domain"`
	// KeyName names the signing key on the backend bucket.
	KeyName string `yaml:"key_name"`
	// KeyFile holds the 128-bit key, base64url, as gcloud reads it.
	KeyFile string `yaml:"key_file"`
	// PathPrefix is the path inside the bucket the load balancer serves at
	// its root.
	PathPrefix string `yaml:"path_prefix"`
}

type CloudFrontConfig struct {
	// Domain is the distribution host, or an http(s) URL for a test edge.
	Domain string `yaml:"domain"`
	// KeyPairID is the public key's ID in a trusted key group.
	KeyPairID string `yaml:"key_pair_id"`
	// PrivateKeyFile is the PEM key that signs URLs.
	PrivateKeyFile string `yaml:"private_key_file"`
	// Hash is sha1 (the default) or sha256.
	Hash string `yaml:"hash"`
	// PathPrefix is the distribution origin's path inside the bucket.
	PathPrefix string `yaml:"path_prefix"`
}

type CompatConfig struct {
	ArtifactoryVersion string `yaml:"artifactory_version"`
}

type Config struct {
	Listen   string         `yaml:"listen"`
	BaseURL  string         `yaml:"base_url"`
	DataDir  string         `yaml:"data_dir"`
	Compat   CompatConfig   `yaml:"compat"`
	Database DatabaseConfig `yaml:"database"`
	Blob     BlobConfig     `yaml:"blob"`
	// ColdBlob is the archive tier (decision 0024); an empty backend means
	// none is configured.
	ColdBlob  BlobConfig `yaml:"cold_blob"`
	MasterKey string     `yaml:"master_key"`
	// MasterKeyPrevious is the key being rotated away from; it is kept
	// until `artifactweave keys rotate` has re-sealed every value.
	MasterKeyPrevious string             `yaml:"master_key_previous"`
	Bootstrap         BootstrapConfig    `yaml:"bootstrap"`
	Docker            DockerConfig       `yaml:"docker"`
	Log               LogConfig          `yaml:"log"`
	GC                GCConfig           `yaml:"gc"`
	Download          DownloadConfig     `yaml:"download"`
	Search            SearchConfig       `yaml:"search"`
	Work              WorkConfig         `yaml:"work"`
	Build             BuildConfig        `yaml:"build"`
	NPM               NPMConfig          `yaml:"npm"`
	Token             TokenConfig        `yaml:"token"`
	Deploy            DeployConfig       `yaml:"deploy"`
	Environments      EnvironmentsConfig `yaml:"environments"`
	AQLTimeout        AQLTimeoutConfig   `yaml:"aql_timeout"`
	Maven             MavenConfig        `yaml:"maven"`
}

type DatabaseConfig struct {
	Driver string `yaml:"driver"`
	DSN    string `yaml:"dsn"`
}

type DeployConfig struct {
	// EnforceIdenticalChecksumDeploy makes a checksum deploy over a file
	// with the same content need the delete permission, as Artifactory
	// 7.x's enforce.permission.check.on.identical.checksum.deploy does. Off
	// by default, as there, so that a CI re-run of jf rt u by a user who may
	// deploy but not delete succeeds.
	EnforceIdenticalChecksumDeploy bool `yaml:"enforce_permission_check_on_identical_checksum_deploy"`
}

type DockerConfig struct {
	// SubdomainMatch adds the subdomain method to repository-path routing:
	// <repo>.<base_url host>/v2/<image> addresses an image in repo. It needs
	// base_url, whose host the repository subdomains sit under.
	SubdomainMatch bool `yaml:"subdomain_match"`
}

type DownloadConfig struct {
	Redirect RedirectConfig       `yaml:"redirect"`
	Folder   FolderDownloadConfig `yaml:"folder"`
}

type EnvironmentsConfig struct {
	// GlobalLimit caps the global environments, DEV and PROD included, as
	// Access's environments.global-limit does; creating one more answers
	// 400.
	GlobalLimit int `yaml:"global_limit"`
}

type FolderDownloadConfig struct {
	// MaxConcurrentRequests is how many folder downloads may run at once on
	// this node; one more answers 400 until one finishes.
	MaxConcurrentRequests int `yaml:"max_concurrent_requests"`
}

type FrontDoorConfig struct {
	// Endpoint is the endpoint host, or an http(s) URL for a test edge.
	Endpoint string `yaml:"endpoint"`
	// PathPrefix is the route's origin path inside the account, starting
	// with the container.
	PathPrefix string `yaml:"path_prefix"`
}

type GCConfig struct {
	// Interval is the time between scheduled passes.
	Interval time.Duration `yaml:"interval"`
	// GracePeriod is how long unreferenced content is kept before it is
	// deleted. It must outlast the slowest upload: content is written before
	// the reference that keeps it.
	GracePeriod time.Duration `yaml:"grace_period"`
}

type LoadOptions struct {
	// File is the YAML path; empty means no file.
	File string
	// Env looks up an environment variable; nil means no environment.
	Env func(string) (string, bool)
	// Flags maps dotted keys (for example "database.dsn") to values given on
	// the command line. Only keys the caller actually set belong here.
	Flags map[string]string
}

type LogConfig struct {
	Level  string `yaml:"level"`
	Format string `yaml:"format"`
}

type MavenConfig struct {
	// SnapshotCleanupInterval is how often each node runs the
	// maxUniqueSnapshots cleanups that deploys have marked in the work
	// queue (maven.snapshot_cleanup_interval).
	SnapshotCleanupInterval time.Duration `yaml:"snapshot_cleanup_interval"`
}

type NPMConfig struct {
	NPMLoginConfig `yaml:",inline"`
	NPMTagConfig   `yaml:",inline"`
	NPMPathConfig  `yaml:",inline"`
	// MaxPublishSize is the largest npm publish request accepted; a larger
	// one answers 413.
	MaxPublishSize ByteSize `yaml:"max_publish_size"`
}

type NPMLoginConfig struct {
	// LoginTokenExpiry is how long a token from npm login lasts. 7.x sets it
	// only with the global artifactory.artifactory.tokens.expiration.timeSecs.
	LoginTokenExpiry time.Duration `yaml:"login_token_expiry"`
}

type NPMPathConfig struct {
	// EnforcePath refuses the upload of a package tarball whose file name
	// is not the one its package.json gives, in every npm local
	// repository, as 7.x's global artifactory.npm.enforce.path does. Off
	// by default, as there.
	EnforcePath bool `yaml:"enforce_path"`
}

type NPMTagConfig struct {
	// TagLatestByPublish gives latest to the version deployed last rather
	// than the highest, as 7.x's global
	// artifactory.npm.tag.tagLatestByPublish does. Off by default, as
	// there.
	TagLatestByPublish bool `yaml:"tag_latest_by_publish"`
}

type RedirectConfig struct {
	// MinSize is the smallest file that redirects; smaller files stream.
	MinSize ByteSize `yaml:"min_size"`
	// TTL is the least time a signed URL stays valid once handed out.
	TTL time.Duration `yaml:"ttl"`
}

type SearchConfig struct {
	AQL AQLConfig `yaml:"aql"`
	// UserQueryLimit caps the results of a GET search for anonymous
	// callers, and for every non-admin unless LimitAnonymousUsersOnly; zero
	// means no cap. search.aql.max_results caps every caller's.
	UserQueryLimit int `yaml:"user_query_limit"`
	// LimitAnonymousUsersOnly spares signed-in users UserQueryLimit, as
	// Artifactory's artifactory.search.limitAnonymousUsersOnly does by
	// default.
	LimitAnonymousUsersOnly bool `yaml:"limit_anonymous_users_only"`
}

type TokenConfig struct {
	// AllowBasicAuth lets a user name and password sent with HTTP Basic
	// create tokens through POST /access/api/v1/tokens. Off by default, as
	// Artifactory 7.x ships token.allow-basic-auth ("Enable Token Generation
	// via API"): a token outlives a change of the password that minted it,
	// so a leaked password would otherwise leave credentials behind.
	AllowBasicAuth bool `yaml:"allow_basic_auth"`
}

type WorkConfig struct {
	// Workers is how many work items run at once on this node.
	Workers int `yaml:"workers"`
	// Lease is how long a run holds its item before another node may take
	// it over; a running item's lease is renewed every half lease.
	Lease time.Duration `yaml:"lease"`
	// MaxAttempts is how many runs an item gets before it is parked.
	MaxAttempts int `yaml:"max_attempts"`
}