config

type Assembly struct {

	// The binary's name, which the binary checks against its own.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// The domains this process hosts. The binary refuses a profile whose list is not exactly
	// the modules it was built with.
	Domains []string `protobuf:"bytes,2,rep,name=domains,proto3" json:"domains,omitempty"`
	// One socket per protocol: a domain's gRPC handlers bind to the PROTOCOL_GRPC listener and
	// its routes to the PROTOCOL_HTTP one. The binary checks, when a domain registers its
	// handlers, that a listener serves each protocol the domain needs.
	Listeners []*Listener `protobuf:"bytes,3,rep,name=listeners,proto3" json:"listeners,omitempty"`
	// labkit's /-/metrics, /-/liveness and /-/readiness. Framework-owned, so not a listener.
	Probe *Probe `protobuf:"bytes,4,opt,name=probe,proto3,oneof" json:"probe,omitempty"`
	// contains filtered or unexported fields
}

type AssemblyConfig struct {
	Version int32 `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
	// Relative to this file's directory, or absolute for a deployed mount.
	SecretsFile *string   `protobuf:"bytes,2,opt,name=secrets_file,json=secretsFile,proto3,oneof" json:"secrets_file,omitempty"`
	Platform    *Platform `protobuf:"bytes,3,opt,name=platform,proto3" json:"platform,omitempty"`
	Assembly    *Assembly `protobuf:"bytes,4,opt,name=assembly,proto3" json:"assembly,omitempty"`
	// The domain blocks, each present exactly when assembly.domains lists it.
	Auth       *AuthDomain         `protobuf:"bytes,5,opt,name=auth,proto3,oneof" json:"auth,omitempty"`
	DataAccess *DataAccessDomain   `protobuf:"bytes,6,opt,name=data_access,json=dataAccess,proto3,oneof" json:"data_access,omitempty"`
	Secrets    *AssemblySecretRefs `protobuf:"bytes,12,opt,name=secrets,proto3,oneof" json:"secrets,omitempty"`
	// contains filtered or unexported fields
}

type AssemblySecretRefs struct {
	Database       *DatabaseSecretRefs               `protobuf:"bytes,1,opt,name=database,proto3" json:"database,omitempty"`
	ServiceTokens  *ServiceTokenRefs                 `protobuf:"bytes,2,opt,name=service_tokens,json=serviceTokens,proto3" json:"service_tokens,omitempty"`
	Oauth          *OauthSecretRefs                  `protobuf:"bytes,3,opt,name=oauth,proto3" json:"oauth,omitempty"`
	OauthProviders map[string]*OauthClientSecretRefs `` /* 177-byte string literal not displayed */
	// contains filtered or unexported fields
}

type AssemblySecrets struct {
	Version        int32                              `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
	Database       *DatabaseSecrets                   `protobuf:"bytes,2,opt,name=database,proto3,oneof" json:"database,omitempty"`
	ServiceTokens  *ServiceTokens                     `protobuf:"bytes,3,opt,name=service_tokens,json=serviceTokens,proto3,oneof" json:"service_tokens,omitempty"`
	Oauth          *OauthSecrets                      `protobuf:"bytes,4,opt,name=oauth,proto3,oneof" json:"oauth,omitempty"`
	OauthProviders map[string]*OauthClientCredentials `` /* 177-byte string literal not displayed */
	// contains filtered or unexported fields
}

type AuthConfig struct {

	// Asserted, not just recorded: LabKit ignores a version mismatch when no
	// migration is registered. To roll a version, widen to `in: [1, 2]`, ship the
	// migration, narrow again.
	Version int32 `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
	// Relative to this file's directory, so CONFIG_DIR alone reaches every input.
	// Deployed environments use an absolute path because `appConfig` renders only
	// one file into CONFIG_DIR and secrets arrive on a separate mount. Omitted
	// when `secrets` references every secret the service needs.
	SecretsFile *string   `protobuf:"bytes,2,opt,name=secrets_file,json=secretsFile,proto3,oneof" json:"secrets_file,omitempty"`
	Platform    *Platform `protobuf:"bytes,3,opt,name=platform,proto3" json:"platform,omitempty"`
	// Default to ":5004" and ":8084" respectively when omitted.
	GrpcAddress *string `protobuf:"bytes,4,opt,name=grpc_address,json=grpcAddress,proto3,oneof" json:"grpc_address,omitempty"`
	HttpAddress *string `protobuf:"bytes,5,opt,name=http_address,json=httpAddress,proto3,oneof" json:"http_address,omitempty"`
	// Metrics listen address. Defaults to ":9090" when omitted.
	MetricsAddress *string `protobuf:"bytes,11,opt,name=metrics_address,json=metricsAddress,proto3,oneof" json:"metrics_address,omitempty"`
	// Externally reachable base URL, used to build OAuth redirect URIs.
	BaseUrl string       `protobuf:"bytes,6,opt,name=base_url,json=baseUrl,proto3" json:"base_url,omitempty"`
	Oauth   *OauthServer `protobuf:"bytes,7,opt,name=oauth,proto3" json:"oauth,omitempty"`
	// Omitting this block, or leaving `providers` empty, disables third-party
	// sign-in.
	OauthClient *OauthClient `protobuf:"bytes,8,opt,name=oauth_client,json=oauthClient,proto3,oneof" json:"oauth_client,omitempty"`
	// Required, not optional: the legacy loader validated allowed_origins for every
	// service, so leaving this optional would let an auth deployment come up with no
	// origins at all. `required` also propagates the nested min_items rule.
	Cors *Cors `protobuf:"bytes,9,opt,name=cors,proto3" json:"cors,omitempty"`
	// The single GitLab URL this deployment talks to: the instance third-party
	// identities are linked into (OauthClient's sign-in flow) and, fronted by
	// gitlab-http-router, the entry point used to reach every configured Cell
	// (OauthServer.cells) via a routing-hint cookie rather than a per-Cell
	// address. One field, not two: in every real deployment these are the same
	// URL, and IAM has no reason to track them as separate endpoints.
	GitlabUrl *string `protobuf:"bytes,10,opt,name=gitlab_url,json=gitlabUrl,proto3,oneof" json:"gitlab_url,omitempty"`
	// Each reference names a file to read one secret from at start; see SecretRef
	// in common.proto.
	Secrets *AuthSecretRefs `protobuf:"bytes,12,opt,name=secrets,proto3,oneof" json:"secrets,omitempty"`
	// contains filtered or unexported fields
}

type AuthDomain struct {
	BaseUrl     string       `protobuf:"bytes,6,opt,name=base_url,json=baseUrl,proto3" json:"base_url,omitempty"`
	Oauth       *OauthServer `protobuf:"bytes,7,opt,name=oauth,proto3" json:"oauth,omitempty"`
	OauthClient *OauthClient `protobuf:"bytes,8,opt,name=oauth_client,json=oauthClient,proto3,oneof" json:"oauth_client,omitempty"`
	GitlabUrl   *string      `protobuf:"bytes,10,opt,name=gitlab_url,json=gitlabUrl,proto3,oneof" json:"gitlab_url,omitempty"`
	// contains filtered or unexported fields
}

type AuthSecretRefs struct {
	Database      *DatabaseSecretRefs `protobuf:"bytes,1,opt,name=database,proto3" json:"database,omitempty"`
	ServiceTokens *ServiceTokenRefs   `protobuf:"bytes,2,opt,name=service_tokens,json=serviceTokens,proto3" json:"service_tokens,omitempty"`
	Oauth         *OauthSecretRefs    `protobuf:"bytes,3,opt,name=oauth,proto3" json:"oauth,omitempty"`
	// Keyed as in AuthConfig.oauth_client.providers.
	OauthProviders map[string]*OauthClientSecretRefs `` /* 177-byte string literal not displayed */
	// contains filtered or unexported fields
}

type AuthSecrets struct {
	Version  int32            `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
	Database *DatabaseSecrets `protobuf:"bytes,2,opt,name=database,proto3,oneof" json:"database,omitempty"`
	// The token iam-auth requires of its own callers.
	ServiceTokens *ServiceTokens `protobuf:"bytes,3,opt,name=service_tokens,json=serviceTokens,proto3,oneof" json:"service_tokens,omitempty"`
	Oauth         *OauthSecrets  `protobuf:"bytes,4,opt,name=oauth,proto3,oneof" json:"oauth,omitempty"`
	// Keyed as in AuthConfig.oauth_client.providers.
	OauthProviders map[string]*OauthClientCredentials `` /* 177-byte string literal not displayed */
	// contains filtered or unexported fields
}

type CellConfig struct {
	Id int32 `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
	// contains filtered or unexported fields
}

type Cors struct {
	AllowedOrigins []string `protobuf:"bytes,1,rep,name=allowed_origins,json=allowedOrigins,proto3" json:"allowed_origins,omitempty"`
	// Omitting these defaults them to the methods and headers the handler sends
	// today.
	AllowedMethods   []string `protobuf:"bytes,2,rep,name=allowed_methods,json=allowedMethods,proto3" json:"allowed_methods,omitempty"`
	AllowedHeaders   []string `protobuf:"bytes,3,rep,name=allowed_headers,json=allowedHeaders,proto3" json:"allowed_headers,omitempty"`
	AllowCredentials *bool    `protobuf:"varint,4,opt,name=allow_credentials,json=allowCredentials,proto3,oneof" json:"allow_credentials,omitempty"` // omitted: false, matching configs/base.toml
	MaxAge           *int32   `protobuf:"varint,5,opt,name=max_age,json=maxAge,proto3,oneof" json:"max_age,omitempty"`                               // omitted: 300
	// contains filtered or unexported fields
}

type DataAccessConfig struct {

	// See AuthConfig.version.
	Version int32 `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
	// See AuthConfig.secrets_file.
	SecretsFile *string   `protobuf:"bytes,2,opt,name=secrets_file,json=secretsFile,proto3,oneof" json:"secrets_file,omitempty"`
	Platform    *Platform `protobuf:"bytes,3,opt,name=platform,proto3" json:"platform,omitempty"`
	// Defaults to ":5005" when omitted. Must match `containerPort` in
	// .runway/fairway.yaml.
	GrpcAddress *string `protobuf:"bytes,4,opt,name=grpc_address,json=grpcAddress,proto3,oneof" json:"grpc_address,omitempty"`
	// Prometheus scrape endpoint, separate from the gRPC port. Defaults to ":9090"
	// when omitted.
	// Must match `metrics: - port:` in .runway/fairway.yaml.
	MetricsAddress *string   `protobuf:"bytes,5,opt,name=metrics_address,json=metricsAddress,proto3,oneof" json:"metrics_address,omitempty"`
	Auth           *UserAuth `protobuf:"bytes,6,opt,name=auth,proto3" json:"auth,omitempty"`
	// See AuthConfig.secrets.
	Secrets *DataAccessSecretRefs `protobuf:"bytes,12,opt,name=secrets,proto3,oneof" json:"secrets,omitempty"`
	// contains filtered or unexported fields
}

type DataAccessDomain struct {
	Auth *UserAuth `protobuf:"bytes,6,opt,name=auth,proto3" json:"auth,omitempty"`
	// contains filtered or unexported fields
}

type DataAccessSecretRefs struct {
	Database      *DatabaseSecretRefs `protobuf:"bytes,1,opt,name=database,proto3" json:"database,omitempty"`
	ServiceTokens *ServiceTokenRefs   `protobuf:"bytes,2,opt,name=service_tokens,json=serviceTokens,proto3" json:"service_tokens,omitempty"`
	// contains filtered or unexported fields
}

type DataAccessSecrets struct {
	Version  int32            `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
	Database *DatabaseSecrets `protobuf:"bytes,2,opt,name=database,proto3,oneof" json:"database,omitempty"`
	// The token iam-data-access requires of its own callers. When iam-auth becomes
	// one of those callers it gains a separate client credential; it does not
	// borrow this one.
	ServiceTokens *ServiceTokens `protobuf:"bytes,3,opt,name=service_tokens,json=serviceTokens,proto3,oneof" json:"service_tokens,omitempty"`
	// contains filtered or unexported fields
}

type Database struct {

	// driver and ssl_mode sit here rather than in a source arm because Fairway can
	// express neither (no yugabyte backend type, no ssl field), so both must be
	// stated whichever source is used. driver also picks the goose migration dir.
	Driver Database_Driver `protobuf:"varint,1,opt,name=driver,proto3,enum=gitlab.iam.config.v1.Database_Driver" json:"driver,omitempty"`
	// Mandatory: `defined_only` alone would let an omitted key take
	// SSL_MODE_UNSPECIFIED. The legacy platformconfig/database.go refused to boot
	// without it, and Fairway cannot supply it either (fairway#36).
	SslMode Database_SslMode `` /* 126-byte string literal not displayed */
	// Declared, not discovered: infrastructure.DefaultConfig() keeps the result of
	// its first read, including a failure, for the life of the process, so
	// environments without a Fairway chart must never reach it.
	//
	// Types that are valid to be assigned to Source:
	//
	//	*Database_Infrastructure
	//	*Database_Endpoint
	Source isDatabase_Source `protobuf_oneof:"source"`
	// Pgx pool property, not endpoint. Omit for default max(4, NumCPU) per node.
	MaxConnections *int32 `protobuf:"varint,5,opt,name=max_connections,json=maxConnections,proto3,oneof" json:"max_connections,omitempty"`
	// An idle floor above the ceiling is accepted silently by pgx and never
	// reached, hence the two CEL rules above.
	MinIdleConnections *int32 `protobuf:"varint,6,opt,name=min_idle_connections,json=minIdleConnections,proto3,oneof" json:"min_idle_connections,omitempty"`
	// contains filtered or unexported fields
}

type DatabaseSecretRefs struct {
	Username          *SecretRef `protobuf:"bytes,1,opt,name=username,proto3" json:"username,omitempty"`
	Password          *SecretRef `protobuf:"bytes,2,opt,name=password,proto3" json:"password,omitempty"`
	MigrationUsername *SecretRef `protobuf:"bytes,3,opt,name=migration_username,json=migrationUsername,proto3" json:"migration_username,omitempty"`
	MigrationPassword *SecretRef `protobuf:"bytes,4,opt,name=migration_password,json=migrationPassword,proto3" json:"migration_password,omitempty"`
	// contains filtered or unexported fields
}

type DatabaseSecrets struct {

	// Service role (DML only). The whole block must be absent when
	// platform.database names the `infrastructure` source; the loader rejects it
	// there.
	Username *string `protobuf:"bytes,1,opt,name=username,proto3,oneof" json:"username,omitempty"`
	// sensitive: must never appear in logs or error messages.
	Password *string `protobuf:"bytes,2,opt,name=password,proto3,oneof" json:"password,omitempty"`
	// Migration role (DDL), for the `endpoint` source and the TOML files. Used
	// only by cmd/migrate, which errors clearly if it is missing.
	MigrationUsername *string `protobuf:"bytes,3,opt,name=migration_username,json=migrationUsername,proto3,oneof" json:"migration_username,omitempty"`
	// sensitive: must never appear in logs or error messages.
	MigrationPassword *string `protobuf:"bytes,4,opt,name=migration_password,json=migrationPassword,proto3,oneof" json:"migration_password,omitempty"`
	// contains filtered or unexported fields
}

type Database_Driver int32

type Database_Endpoint struct {
	Endpoint *Endpoint `protobuf:"bytes,4,opt,name=endpoint,proto3,oneof"`
}

type Database_Infrastructure struct {
	Infrastructure *Infrastructure `protobuf:"bytes,3,opt,name=infrastructure,proto3,oneof"`
}

type Database_SslMode int32

type Endpoint struct {
	Host         string `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
	Port         int32  `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
	DatabaseName string `protobuf:"bytes,3,opt,name=database_name,json=databaseName,proto3" json:"database_name,omitempty"`
	// pool_host and pool_port name a connection pooler in front of host:port.
	// When only one is set, the other defaults to host or port. The service
	// connects through the pooler; migrations connect to host:port directly.
	PoolHost *string `protobuf:"bytes,4,opt,name=pool_host,json=poolHost,proto3,oneof" json:"pool_host,omitempty"`
	PoolPort *int32  `protobuf:"varint,5,opt,name=pool_port,json=poolPort,proto3,oneof" json:"pool_port,omitempty"`
	// contains filtered or unexported fields
}

type Grpc struct {

	// Reflection is a stream RPC, so the unary service-token interceptors do not
	// cover it: it is unauthenticated wherever it is on. Omitting the block turns
	// reflection off.
	EnableReflection *bool `protobuf:"varint,1,opt,name=enable_reflection,json=enableReflection,proto3,oneof" json:"enable_reflection,omitempty"`
	// contains filtered or unexported fields
}

type Http struct {

	// Omitting these defaults them to 30s read, 30s write, 60s idle.
	ReadTimeout  *durationpb.Duration `protobuf:"bytes,1,opt,name=read_timeout,json=readTimeout,proto3,oneof" json:"read_timeout,omitempty"`
	WriteTimeout *durationpb.Duration `protobuf:"bytes,2,opt,name=write_timeout,json=writeTimeout,proto3,oneof" json:"write_timeout,omitempty"`
	IdleTimeout  *durationpb.Duration `protobuf:"bytes,3,opt,name=idle_timeout,json=idleTimeout,proto3,oneof" json:"idle_timeout,omitempty"`
	// contains filtered or unexported fields
}

type Infrastructure struct {

	// Both unset: LabKit's default locations. Both set: build the infrastructure
	// config by hand from these paths.
	Path       *string `protobuf:"bytes,1,opt,name=path,proto3,oneof" json:"path,omitempty"`
	SecretsDir *string `protobuf:"bytes,2,opt,name=secrets_dir,json=secretsDir,proto3,oneof" json:"secrets_dir,omitempty"`
	// contains filtered or unexported fields
}

type Issuer struct {
	Url     string `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
	KeysUrl string `protobuf:"bytes,2,opt,name=keys_url,json=keysUrl,proto3" json:"keys_url,omitempty"`
	// contains filtered or unexported fields
}

type Listener struct {

	// Names the socket in logs and errors.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// The interface to bind; every interface when omitted.
	Host     *string  `protobuf:"bytes,2,opt,name=host,proto3,oneof" json:"host,omitempty"`
	Port     uint32   `protobuf:"varint,3,opt,name=port,proto3" json:"port,omitempty"`
	Protocol Protocol `protobuf:"varint,4,opt,name=protocol,proto3,enum=gitlab.iam.config.v1.Protocol" json:"protocol,omitempty"`
	// contains filtered or unexported fields
}

type MigrationConfig struct {

	// See AuthConfig.version.
	Version int32 `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
	// See AuthConfig.secrets_file.
	SecretsFile *string   `protobuf:"bytes,2,opt,name=secrets_file,json=secretsFile,proto3,oneof" json:"secrets_file,omitempty"`
	Platform    *Platform `protobuf:"bytes,3,opt,name=platform,proto3" json:"platform,omitempty"`
	// See AuthConfig.secrets.
	Secrets *MigrationSecretRefs `protobuf:"bytes,12,opt,name=secrets,proto3,oneof" json:"secrets,omitempty"`
	// contains filtered or unexported fields
}

type MigrationSecretRefs struct {
	Database *DatabaseSecretRefs `protobuf:"bytes,1,opt,name=database,proto3" json:"database,omitempty"`
	// contains filtered or unexported fields
}

type MigrationSecrets struct {
	Version  int32            `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
	Database *DatabaseSecrets `protobuf:"bytes,2,opt,name=database,proto3,oneof" json:"database,omitempty"`
	// contains filtered or unexported fields
}

type OauthClient struct {

	// Closed key set: each name selects a distinct construction path in
	// auth/oauth/client, so an unknown key would be silently ignored.
	Providers map[string]*OauthProvider `` /* 145-byte string literal not displayed */
	// contains filtered or unexported fields
}

type OauthClientCredentials struct {
	ClientId *string `protobuf:"bytes,1,opt,name=client_id,json=clientId,proto3,oneof" json:"client_id,omitempty"`
	// sensitive: must never appear in logs or error messages.
	ClientSecret *string `protobuf:"bytes,2,opt,name=client_secret,json=clientSecret,proto3,oneof" json:"client_secret,omitempty"`
	// contains filtered or unexported fields
}

type OauthClientSecretRefs struct {
	ClientId     *SecretRef `protobuf:"bytes,1,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
	ClientSecret *SecretRef `protobuf:"bytes,2,opt,name=client_secret,json=clientSecret,proto3" json:"client_secret,omitempty"`
	// contains filtered or unexported fields
}

type OauthProvider struct {
	Issuer      *string `protobuf:"bytes,1,opt,name=issuer,proto3,oneof" json:"issuer,omitempty"`
	AuthUrl     *string `protobuf:"bytes,2,opt,name=auth_url,json=authUrl,proto3,oneof" json:"auth_url,omitempty"`
	TokenUrl    *string `protobuf:"bytes,3,opt,name=token_url,json=tokenUrl,proto3,oneof" json:"token_url,omitempty"`
	UserInfoUrl *string `protobuf:"bytes,4,opt,name=user_info_url,json=userInfoUrl,proto3,oneof" json:"user_info_url,omitempty"`
	// Omitting this uses the provider's conventional scopes, from pkg/config.
	// No min_items: repeated fields have no presence, so that would make the
	// default unreachable (see common.proto).
	Scopes []string `protobuf:"bytes,5,rep,name=scopes,proto3" json:"scopes,omitempty"`
	// contains filtered or unexported fields
}

type OauthSecretRefs struct {
	HmacSecret *SecretRef `protobuf:"bytes,1,opt,name=hmac_secret,json=hmacSecret,proto3" json:"hmac_secret,omitempty"`
	// The file holds the PEM itself; pkg/config encodes it as signing_key expects.
	SigningKey *SecretRef `protobuf:"bytes,2,opt,name=signing_key,json=signingKey,proto3" json:"signing_key,omitempty"`
	// contains filtered or unexported fields
}

type OauthSecrets struct {

	// sensitive. Signs opaque authorization codes and refresh tokens.
	HmacSecret *string `protobuf:"bytes,1,opt,name=hmac_secret,json=hmacSecret,proto3,oneof" json:"hmac_secret,omitempty"`
	// A base64-encoded PKCS#8 PEM RSA private key
	// staging/production inject it as SERVICES_AUTH_OAUTH_SIGNING_KEY, and
	// dev/CI use the fixed key in configs/auth/secrets.local.yaml (the same key
	// as configs/environments/secrets.toml)
	// sensitive.
	SigningKey *string `protobuf:"bytes,2,opt,name=signing_key,json=signingKey,proto3,oneof" json:"signing_key,omitempty"`
	// contains filtered or unexported fields
}

type OauthServer struct {

	// The `iss` claim, and the base for the OIDC discovery document.
	Issuer string `protobuf:"bytes,1,opt,name=issuer,proto3" json:"issuer,omitempty"`
	// Rails routes: where to send an unauthenticated user, and where to approve
	// a client's scopes.
	LoginUrl   string `protobuf:"bytes,2,opt,name=login_url,json=loginUrl,proto3" json:"login_url,omitempty"`
	ConsentUrl string `protobuf:"bytes,3,opt,name=consent_url,json=consentUrl,proto3" json:"consent_url,omitempty"`
	// The `aud` claim on issued access tokens (RFC 9068). Defaults to
	// "gitlab-rails" when omitted.
	AccessTokenAudience *string `` /* 126-byte string literal not displayed */
	// How long a fetched JWKS is cached. Omitting it leaves 0, which is what the
	// service resolves today; changing that is deliberately out of scope here.
	JwksCacheDuration *durationpb.Duration `protobuf:"bytes,5,opt,name=jwks_cache_duration,json=jwksCacheDuration,proto3,oneof" json:"jwks_cache_duration,omitempty"`
	// GitLab Rails' `/api/v4/iam/userinfo` endpoint. Called at token-exchange
	// time to fetch ID token claims, authenticated with the access token
	// minted for the same exchange as a bearer credential (see
	// core.ClaimsEnrichedIDTokenHandler). Unlike the OIDC `/oauth/userinfo`
	// endpoint, this one accepts only an IAM-issued OAuth JWT.
	//
	// SECURITY-SENSITIVE: every openid-scoped token exchange sends a bearer
	// access token to this URL. Must resolve to a trusted, TLS-protected
	// GitLab Rails instance; never an attacker-controlled address.
	UserInfoUrl string `protobuf:"bytes,6,opt,name=user_info_url,json=userInfoUrl,proto3" json:"user_info_url,omitempty"`
	// Cells whose OAuth discovery keys IAM aggregates at /oauth/discovery/keys.
	// max_items added for linting, we should not hit this limit
	Cells []*CellConfig `protobuf:"bytes,7,rep,name=cells,proto3" json:"cells,omitempty"`
	// Every DCR app must have an org_id. Set it to the default org uuid of the
	// GitLab instance IAM is deployed against.
	// See https://gitlab.com/gitlab-org/auth/iam/-/blob/main/auth/config/oauth_server.go#L14
	DynamicClientOrganizationId string `` /* 146-byte string literal not displayed */
	// contains filtered or unexported fields
}

type Platform struct {
	Database *Database `protobuf:"bytes,1,opt,name=database,proto3" json:"database,omitempty"`
	// Omitting a block leaves its fields at their Go defaults — see the note above.
	Grpc *Grpc `protobuf:"bytes,2,opt,name=grpc,proto3,oneof" json:"grpc,omitempty"`
	Http *Http `protobuf:"bytes,3,opt,name=http,proto3,oneof" json:"http,omitempty"`
	// Read from an assembly profile only. AuthConfig and DataAccessConfig reject a value here.
	// AuthConfig keeps its root-level cors until iam-auth moves to that root.
	Cors *Cors `protobuf:"bytes,4,opt,name=cors,proto3,oneof" json:"cors,omitempty"`
	// contains filtered or unexported fields
}

type Probe struct {
	Host *string `protobuf:"bytes,1,opt,name=host,proto3,oneof" json:"host,omitempty"`
	Port *uint32 `protobuf:"varint,2,opt,name=port,proto3,oneof" json:"port,omitempty"`
	// contains filtered or unexported fields
}

type Protocol int32

type SecretRef struct {

	// Types that are valid to be assigned to Source:
	//
	//	*SecretRef_File
	Source isSecretRef_Source `protobuf_oneof:"source"`
	// contains filtered or unexported fields
}

type SecretRef_File struct {
	// Absolute path of a file that holds the value, such as one key of a
	// mounted Kubernetes Secret. Read once at start, surrounding whitespace
	// dropped, must not be empty.
	File string `protobuf:"bytes,1,opt,name=file,proto3,oneof"`
}

type ServiceTokenRefs struct {
	ServiceToken     *SecretRef `protobuf:"bytes,1,opt,name=service_token,json=serviceToken,proto3" json:"service_token,omitempty"`
	NextServiceToken *SecretRef `protobuf:"bytes,2,opt,name=next_service_token,json=nextServiceToken,proto3" json:"next_service_token,omitempty"`
	// contains filtered or unexported fields
}

type ServiceTokens struct {

	// sensitive: must never appear in logs or error messages.
	ServiceToken *string `protobuf:"bytes,1,opt,name=service_token,json=serviceToken,proto3,oneof" json:"service_token,omitempty"`
	// sensitive. Accepted alongside service_token during rotation; empty otherwise.
	NextServiceToken *string `protobuf:"bytes,2,opt,name=next_service_token,json=nextServiceToken,proto3,oneof" json:"next_service_token,omitempty"`
	// contains filtered or unexported fields
}

type UserAuth struct {

	// Issuers whose tokens are accepted. At least one is required: with none, the
	// service would reject every request.
	Issuers []*Issuer `protobuf:"bytes,1,rep,name=issuers,proto3" json:"issuers,omitempty"`
	// Keys URLs must be https: the JWKS they serve decides which tokens are
	// trusted. True also admits http, for local setups only.
	AllowInsecureKeysUrls *bool `` /* 135-byte string literal not displayed */
	// Audiences accepted in the `aud` claim. Checked twice on purpose:
	// pkg/userauth/config.go validates it separately and cannot import these
	// protos, so repeating the set here catches a typo at config load.
	ExpectedAudiences []string `protobuf:"bytes,2,rep,name=expected_audiences,json=expectedAudiences,proto3" json:"expected_audiences,omitempty"`
	// contains filtered or unexported fields
}