server

type Config struct {
	Server          ServerConfig           `mapstructure:"server"`
	Database        database.Config        `mapstructure:"database"`
	PasswordHasher  crypto.HashConfig      `mapstructure:"password_hasher"`
	Schema          SchemaConfig           `mapstructure:"schema"`
	Keys            KeysConfig             `mapstructure:"keys"`
	Session         service.SessionConfig  `mapstructure:"session"`
	Instrumentation instrumentation.Config `mapstructure:"instrumentation"`
	Platform        PlatformConfig         `mapstructure:"platform"`
	Events          EventsConfig           `mapstructure:"events"`
	// HTTPClient configures the hardened egress client used for every fetch
	// of a URL a platform user can inject (see the egress-policy ADR).
	HTTPClient httputil.ClientConfig `mapstructure:"httpclient"`
}

type EventsConfig struct {
	Retention audit.RetentionConfig `mapstructure:"retention"`
	Export    audit.ExportConfig    `mapstructure:"export"`
}

type KeysConfig struct {
	// CrypterLRUCacheSize bounds the cache of resolved crypters held by key id
	// and algorithm. A key's material never changes, so an entry never needs
	// invalidating.
	CrypterLRUCacheSize int `mapstructure:"crypter_lru_cache_size"`
	// SigningKeyLRUCacheSize bounds the cache of active signing keys held by
	// project and purpose. Nothing retires a signing key today; once something
	// does, this cache needs an eviction path (see GetProjectSigningKey).
	SigningKeyLRUCacheSize int `mapstructure:"signing_key_lru_cache_size"`
}

type MasterKeyConfig struct {
	// File is the path to a file which contains the RSA private key in either a
	// JWK or a PEM file.
	//
	// Not required when PrivateKey is provided.
	// When PrivateKey is provided, File is ignored.
	File string `mapstructure:"file"`
	// UseForEncryption indicates whether this key should be used for
	// encryption. Exactly one key must be marked for encryption, otherwise the
	// application won't start.
	UseForEncryption bool `mapstructure:"use_for_encryption"`
	// PrivateKey is the RSA private key used to decrypt wrapped data.
	// It may be provided as PEM (including OpenSSH) or as a private JWK.
	PrivateKey string `mapstructure:"private_key"`
}

type PlatformConfig struct {
	// ProjectID pins a standalone deployment's default project to an existing
	// project (an id of the form "proj_<...>"). When empty (the default), the
	// deployment tracks its first-created project other than the built-in
	// platform row — the one the customer's `zitadel setup` creates; the
	// platform project is infrastructure and only becomes the default through
	// this pin or BootstrapProject. The server never creates that project
	// itself; a configured id that does not exist is a startup error. Leave
	// empty when BootstrapProject is set — the platform project's id is
	// server-owned (domain.PlatformProjectID), not operator-authored. (#605)
	ProjectID string `mapstructure:"project_id"`

	// BootstrapProject, when true, ensures the well-known platform project
	// (domain.PlatformProjectID) exists at startup (idempotent insert) and
	// resolves it as the default. Off by default: no environment gets a
	// platform project created silently. Needs no ProjectID. (#605)
	BootstrapProject bool `mapstructure:"bootstrap_project"`
}

type SchemaConfig struct {
	BuiltinPublicBase string `mapstructure:"builtin_public_base"`
	LRUCacheSize      int    `mapstructure:"lru_cache_size"`
	// ResolveTimeout bounds one whole schema ingest including every $ref it
	// follows, so recursion depth cannot multiply the per-request
	// httpclient.timeout into sequential waits.
	ResolveTimeout time.Duration `mapstructure:"resolve_timeout"`
}

type ServerConfig struct {
	Address string `mapstructure:"address"`
	// DataDir is the local runtime root used by zero-config server defaults.
	// When unset, it defaults to a nextgen-data directory next to the binary.
	DataDir string `mapstructure:"data_dir"`
	// MasterKeys is a collection of master keys used by the application to wrap
	// the key encryption key (KEK) of every project. The KEKs themselves are
	// created by the application and stored encrypted in the database.
	//
	// This is a collection to enable master key rotation. Multiple keys can be
	// provided but only one should be marked to be used for encryption. Once
	// multiple keys are provided, all wrapped KEKs will be re-encrypted using
	// the master key marked to use for encryption.
	//
	// If no master keys are provided, a default master key is created in the
	// master key directory. If there are no keys specified in the config but
	// files exist in the master key directory, the newest file is used for
	// encryption.
	MasterKeys map[string]*MasterKeyConfig `mapstructure:"master_keys"`
	// GenerateMasterKey allows the server to mint a master key when it starts
	// with none configured and none in the master key directory. It defaults to
	// true, which is what makes a first local start work with no configuration
	// at all.
	//
	// Turn it off wherever a generated key would be the wrong answer rather
	// than a convenience: on ephemeral storage every instance would mint its
	// own key, and project KEKs wrapped by one of them cannot be unwrapped by
	// the next. With it off, a missing key fails the start instead, which is
	// the failure that can still be recovered from.
	GenerateMasterKey bool `mapstructure:"generate_master_key"`

	ConsoleEnabled bool   `mapstructure:"console_enabled"`
	ConsolePath    string `mapstructure:"console_path"`
	LoginEnabled   bool   `mapstructure:"login_enabled"`
	LoginPath      string `mapstructure:"login_path"`
	// PublicBase is the origin this deployment is reachable at from a browser.
	// It only feeds user-facing URLs (claim and dashboard); schema identity
	// stays on schema.builtin_public_base, which is an identifier namespace,
	// not an address.
	PublicBase string `mapstructure:"public_base"`
}

type SessionConfig struct {
	DefaultTTL time.Duration `mapstructure:"default_ttl"`
	MaxTTL     time.Duration `mapstructure:"max_ttl"`
}

type ShutdownFunc func(context.Context) error

type ShutdownFuncs struct {
	// contains filtered or unexported fields
}