config

type ACMEConfig struct {
	Email    string `toml:"email"`
	Disabled bool   `toml:"disabled"`
	// Staging uses the Let's Encrypt staging endpoint (dev/tests).
	Staging bool `toml:"staging"`
}

type APIConfig struct {
	// Listen for the public gRPC+REST API (TLS).
	Listen string `toml:"listen"`
	// AdvertiseAddr is how other nodes/CLI reach this API (host:port).
	AdvertiseAddr string `toml:"advertise_addr"`
}

type Config struct {
	// NodeName defaults to the hostname.
	NodeName string `toml:"node_name"`
	// DataDir holds raft state, registry blobs, logs, TSDB, certs.
	DataDir string `toml:"data_dir"`
	// Roles: control, worker, or both.
	Roles []string `toml:"roles"`
	// Domain is the cluster app domain (apps get <app>-<env>.<domain>).
	Domain string `toml:"domain"`
	// Dev enables single-node developer mode: self-signed TLS, ACME off,
	// mesh off, bootstrap admin token printed at first start.
	Dev bool `toml:"dev"`

	API      APIConfig      `toml:"api"`
	Ingress  IngressConfig  `toml:"ingress"`
	Registry RegistryConfig `toml:"registry"`
	Mesh     MeshConfig     `toml:"mesh"`
	ACME     ACMEConfig     `toml:"acme"`
	Join     JoinConfig     `toml:"join"`
	Raft     RaftConfig     `toml:"raft"`
	Logs     LogsConfig     `toml:"logs"`
}

type IngressConfig struct {
	HTTPListen  string `toml:"http_listen"`
	HTTPSListen string `toml:"https_listen"`
	// Disabled turns the ingress proxy off on this node.
	Disabled bool `toml:"disabled"`
}

type JoinConfig struct {
	// Addr of any control node's public API ("host:8443").
	Addr string `toml:"addr"`
	// Token is the join token ("K10<ca-hash>::<secret>").
	Token string `toml:"token"`
}

type LogsConfig struct {
	// MaxStreamMB caps retained log bytes per stream.
	MaxStreamMB int `toml:"max_stream_mb"`
	// RetentionDays caps log age.
	RetentionDays int `toml:"retention_days"`
}

type MeshConfig struct {
	// Disabled forces no mesh (implied in single-node dev mode).
	Disabled bool `toml:"disabled"`
	// ListenPort for WireGuard UDP.
	ListenPort uint16 `toml:"listen_port"`
	// Interface name (Linux). Darwin picks utunN automatically.
	Interface string `toml:"interface"`
	// PublicEndpoints this node is reachable at ("ip:port"); autodetected
	// when empty and the node has a public address.
	PublicEndpoints []string `toml:"public_endpoints"`
}

type RaftConfig struct {
	// Listen for raft transport (control nodes; bound to mesh IP or
	// 127.0.0.1 in single-node).
	Listen string `toml:"listen"`
}

type RegistryConfig struct {
	Listen string `toml:"listen"`
	// InsecureHTTP serves the embedded registry over plain HTTP instead of
	// TLS. Intended for integration tests (and never for production); the CA
	// server cert is used otherwise.
	InsecureHTTP bool `toml:"insecure_http"`
}