config

type AWSConfig struct {
	Profile          string `yaml:"profile"`
	CredentialsMount string `yaml:"credentials_mount"`
	CredentialSet    string `yaml:"credential_set"`
	AuthMethod       string `yaml:"auth_method"`
	Readonly         bool   `yaml:"readonly"`
}

type AppleContainerConfig struct {
	ImageName     string `yaml:"image_name"`
	ContainerName string `yaml:"container_name"`
	// PluginCacheName names the same shared Terraform provider cache for the
	// Apple container backend — but as a directory below the user's devvault
	// home, not as a `container` volume: a named volume there is created empty
	// and owned by root, so the container's non-root user cannot write into it.
	// The backend creates the directory and bind-mounts it.
	PluginCacheName string `yaml:"plugin_cache_name"`
}

type Config struct {
	Backend        string               `yaml:"backend"`
	Project        string               `yaml:"project"`
	Customer       string               `yaml:"customer"`
	Terraform      TerraformConfig      `yaml:"terraform"`
	Tools          ToolsConfig          `yaml:"tools"`
	AWS            AWSConfig            `yaml:"aws"`
	Docker         DockerConfig         `yaml:"docker"`
	AppleContainer AppleContainerConfig `yaml:"apple_container"`
	Editor         EditorConfig         `yaml:"editor"`
	SSH            SSHConfig            `yaml:"ssh"`
}

type DockerConfig struct {
	ImageName     string `yaml:"image_name"`
	ContainerName string `yaml:"container_name"`
	Platform      string `yaml:"platform"`
	// PluginCacheVolume names the docker volume holding the shared Terraform
	// provider cache. The generated compose file declares it and mounts it at
	// /home/vscode/.terraform.d/plugin-cache.
	PluginCacheVolume string `yaml:"plugin_cache_volume"`
}

type EditorConfig struct {
	Default string   `yaml:"default"`
	Command string   `yaml:"command"`
	Args    []string `yaml:"args"`
}

type SSHConfig struct {
	// ForwardAgent controls whether the host SSH agent socket is offered to
	// the container.
	ForwardAgent bool `yaml:"forward_agent"`
}

type TerraformConfig struct {
	Version string `yaml:"version"`
	// OpenTofuVersion pins the OpenTofu release. It is only used when
	// Distribution is "opentofu"; OpenTofu's version numbers are unrelated to
	// Terraform's, so the two must never share a field.
	OpenTofuVersion string `yaml:"opentofu_version"`
	// Distribution selects the CLI flavour: "terraform" or "opentofu".
	Distribution string `yaml:"distribution"`
}

type ToolsConfig struct {
	TFLint        string `yaml:"tflint"`
	TerraformDocs string `yaml:"terraform_docs"`
	// The remaining version fields pin the tools the generated Dockerfile
	// downloads. Every download is verified against the checksum file of the
	// pinned release, so a version bump and a checksum re-verification are the
	// same change.
	TrivyVersion     string `yaml:"trivy_version"`
	OPAVersion       string `yaml:"opa_version"`
	CheckovVersion   string `yaml:"checkov_version"`
	PrecommitVersion string `yaml:"precommit_version"`
	GitleaksVersion  string `yaml:"gitleaks_version"`
	ConftestVersion  string `yaml:"conftest_version"`
	InfracostVersion string `yaml:"infracost_version"`
	Preset           string `yaml:"preset"`
	// The switches below decide what a project actually gets. They fall into
	// two groups, and the group decides where a tool lives:
	//
	//   Container tools are installed into the generated image, and only when
	//   their switch is true: Trivy, Checkov, Gitleaks, Conftest, OPA,
	//   Precommit, Graphviz, Age, Infracost. A false switch means the binary is
	//   not in the image, so the commands that call it say so instead of
	//   failing with "not found".
	//
	//   Host tools are never installed by devvault — they authenticate the user
	//   or talk to the user's own keyring, so what lands on the host is the
	//   user's decision. Their switch turns them into an optional
	//   `devvault doctor` check: AWSCLI, SOPS, GPG, SessionManagerPlugin.
	//
	// The Terraform distribution, tflint and terraform-docs have no switch on
	// purpose: they are what the container exists for and are always installed.
	AWSCLI               bool `yaml:"awscli"`
	Trivy                bool `yaml:"trivy"`
	Checkov              bool `yaml:"checkov"`
	Infracost            bool `yaml:"infracost"`
	Gitleaks             bool `yaml:"gitleaks"`
	Precommit            bool `yaml:"precommit"`
	Graphviz             bool `yaml:"graphviz"`
	OPA                  bool `yaml:"opa"`
	Conftest             bool `yaml:"conftest"`
	Age                  bool `yaml:"age"`
	SessionManagerPlugin bool `yaml:"session_manager_plugin"`
	SOPS                 bool `yaml:"sops"`
	GPG                  bool `yaml:"gpg"`
}