config

type ACMEConfig struct {
	Email    string `toml:"email"`
	Disabled bool   `toml:"disabled"`
	// Staging uses the Let's Encrypt staging endpoint (dev/tests).
	Staging bool `toml:"staging"`
}

type APIConfig struct {
	// Listen for the public gRPC+REST API (TLS).
	Listen string `toml:"listen"`
	// AdvertiseAddr is how other nodes/CLI reach this API (host:port).
	AdvertiseAddr string `toml:"advertise_addr"`
}

type Config struct {
	// NodeName defaults to the hostname.
	NodeName string `toml:"node_name"`
	// DataDir holds raft state, registry blobs, logs, TSDB, certs.
	DataDir string `toml:"data_dir"`
	// Roles: control, worker, or both.
	Roles []string `toml:"roles"`
	// Domain is the cluster app domain (apps get <app>-<env>.<domain>).
	Domain string `toml:"domain"`
	// Dev enables single-node developer mode: self-signed TLS, ACME off,
	// mesh off, bootstrap admin token printed at first start.
	Dev bool `toml:"dev"`

	// SealedAtRest keeps the cluster data key off local disk. The node then
	// cannot auto-unseal itself after a restart: it comes up sealed (alerting,
	// env-var writes and backups disabled) until an operator runs
	// `zattera unseal` or it recovers the key from a control peer. Default
	// false, which favours a node coming back working after a reboot; see
	// ADR-0006.
	SealedAtRest bool `toml:"sealed_at_rest"`

	API      APIConfig      `toml:"api"`
	Ingress  IngressConfig  `toml:"ingress"`
	Registry RegistryConfig `toml:"registry"`
	Mesh     MeshConfig     `toml:"mesh"`
	ACME     ACMEConfig     `toml:"acme"`
	Join     JoinConfig     `toml:"join"`
	Raft     RaftConfig     `toml:"raft"`
	Logs     LogsConfig     `toml:"logs"`
	Upgrade  UpgradeConfig  `toml:"upgrade"`
}

type IngressConfig struct {
	HTTPListen  string `toml:"http_listen"`
	HTTPSListen string `toml:"https_listen"`
	// Disabled turns the ingress proxy off on this node.
	Disabled bool `toml:"disabled"`
}

type JoinConfig struct {
	// Addr of any control node's public API ("host:8443").
	Addr string `toml:"addr"`
	// Token is the join token ("K10<ca-hash>::<secret>").
	Token string `toml:"token"`
}

type LogsConfig struct {
	// MaxStreamMB caps retained log bytes per stream.
	MaxStreamMB int `toml:"max_stream_mb"`
	// RetentionDays caps log age.
	RetentionDays int `toml:"retention_days"`
}

type MeshConfig struct {
	// Disabled forces no mesh (implied in single-node dev mode).
	Disabled bool `toml:"disabled"`
	// ListenPort for WireGuard UDP.
	ListenPort uint16 `toml:"listen_port"`
	// Interface name (Linux). Darwin picks utunN automatically.
	Interface string `toml:"interface"`
	// PublicEndpoints this node is reachable at ("ip:port"); autodetected
	// when empty and the node has a public address.
	PublicEndpoints []string `toml:"public_endpoints"`
	// Mode selects the WireGuard datapath (ADR-0003):
	//   "" / "auto"  — kernel WG when available, else userspace; phases A/B
	//                  (hub + direct peering) only.
	//   "meshsock"   — userspace WG with the meshsock bind: UDP hole punching
	//                  (phase C) + TCP relay fallback (phase D). Use on NAT'd
	//                  nodes that need worker↔worker connectivity without a
	//                  routable endpoint.
	Mode string `toml:"mode"`
}

type RaftConfig struct {
	// Listen for raft transport (control nodes; bound to mesh IP or
	// 127.0.0.1 in single-node).
	Listen string `toml:"listen"`
}

type RegistryConfig struct {
	Listen string `toml:"listen"`
	// InsecureHTTP serves the embedded registry over plain HTTP instead of
	// TLS. Intended for integration tests (and never for production); the CA
	// server cert is used otherwise.
	InsecureHTTP bool `toml:"insecure_http"`
}

type UpgradeConfig struct {
	BaseURL string `toml:"base_url"`
}