config

type CPUMetricsConfig struct {
	Enabled bool `toml:"enabled"`
}

type DiskMetricsConfig struct {
	Enabled bool `toml:"enabled"`

	// Paths restricts disk stats to specific mount points.
	// All entries must be absolute paths.
	// If empty, all mounted filesystems are reported.
	Paths []string `toml:"paths"`
}

type DockerConfig struct {
	Enabled    bool
	Containers DockerSectionConfig `toml:"containers"`
	Images     DockerSectionConfig `toml:"images"`
	Compose    DockerSectionConfig `toml:"compose"`
	Swarm      DockerSectionConfig `toml:"swarm"`
}

type DockerSectionConfig struct {
	// Enabled gates all operations in this section.
	// If false, all endpoints in the section return 403 regardless of Allow.
	Enabled bool `toml:"enabled"`

	// Allow is the list of permitted operations within this section.
	// Valid values differ per section and are validated at startup.
	// An unknown value causes a fatal config error with the valid set listed.
	Allow []string `toml:"allow"`
}

type FilesConfig struct {
	Enabled bool
	Paths   []PathRule `toml:"path"`
}

type HostMetricsConfig struct {
	Enabled bool `toml:"enabled"`
}

type JournalConfig struct {
	// Enabled gates the per-unit journal endpoint
	// (GET /integrations/systemd/units/{unit}/journal).
	Enabled bool `toml:"enabled"`

	// Priority is the minimum log severity to return.
	// Valid values: emerg, alert, crit, err, warning, notice, info, debug.
	// Defaults to "info" if omitted.
	Priority string `toml:"priority"`

	// Lines is the default number of journal lines returned per request.
	// Must be a positive integer. Defaults to 100 if omitted.
	Lines int `toml:"lines"`

	// SystemJournal permits GET /integrations/systemd/journal (system-wide).
	// Kept as a dedicated bool because it is a distinct endpoint, not an
	// operation variant of the per-unit journal.
	SystemJournal bool `toml:"system_journal"`
}

type MemoryMetricsConfig struct {
	Enabled bool `toml:"enabled"`
}

type MetricsConfig struct {
	Enabled   bool
	Host      HostMetricsConfig    `toml:"host"`
	CPU       CPUMetricsConfig     `toml:"cpu"`
	Memory    MemoryMetricsConfig  `toml:"memory"`
	Disk      DiskMetricsConfig    `toml:"disk"`
	Network   NetworkMetricsConfig `toml:"network"`
	Processes ProcessMetricsConfig `toml:"processes"`
}

type NetworkMetricsConfig struct {
	Enabled bool `toml:"enabled"`

	// Interfaces restricts stats to specific network interfaces by name.
	// If empty, all interfaces are reported.
	Interfaces []string `toml:"interfaces"`
}

type PathRule struct {
	// Dir is the directory this rule applies to.
	// Must be an absolute path ending with "/".
	Dir string `toml:"dir"`

	// Allow is the list of permitted operations for this directory.
	// Valid values: "read", "write".
	Allow []string `toml:"allow"`

	// WriteAsUser is the username to drop to when writing files to this path.
	// Requires the daemon to hold CAP_SETUID (granted by AmbientCapabilities
	// in the systemd unit). If absent, writes succeed as the daemon user.
	// Resolved to WriteAs at load time via os/user.Lookup.
	WriteAsUser string `toml:"write_as"`

	// WriteAs is the resolved identity for WriteAsUser.
	// Zero value (Set=false) means no privilege drop — write as daemon user.
	// Populated by LoadFilesConfig; never set directly by callers.
	WriteAs ResolvedIdentity `toml:"-"`
}

type ProcessMetricsConfig struct {
	Enabled bool `toml:"enabled"`

	// Limit caps the number of processes returned, sorted by CPU usage desc.
	// Must be a positive integer, maximum 100.
	// Uses a pointer so we can distinguish "omitted" (nil → default 20)
	// from "explicitly set to 0" (→ validation error).
	Limit *int `toml:"limit"`
}

type ResolvedIdentity struct {
	UID int
	GID int
	Set bool // true when a write_as user was successfully resolved
}

type SystemdConfig struct {
	Enabled bool
	Units   UnitConfig    `toml:"units"`
	Journal JournalConfig `toml:"journal"`
}

type UnitConfig struct {
	// Enabled gates all unit operations.
	Enabled bool `toml:"enabled"`

	// Allow is the list of permitted unit operations.
	// Valid values: list, inspect, unit_file, logs, start, stop, restart,
	// reload, enable, disable.
	// An unknown value is a fatal config error.
	Allow []string `toml:"allow"`
}

type VarScope struct {
	// Project is the project identifier (e.g. "myapp").
	// Must match ^[a-z0-9_-]+$.
	Project string `toml:"project"`

	// Env is the environment identifier (e.g. "prod", "staging").
	// Must match ^[a-z0-9_-]+$.
	Env string `toml:"env"`

	// Allow is the list of permitted operations for this scope.
	// Valid values: "read", "write".
	// At least one value is required.
	Allow []string `toml:"allow"`
}

type VarsConfig struct {
	Enabled bool
	Scopes  []VarScope `toml:"scope"`
}