config

type AdminConfig struct {
	Hostname string `yaml:"hostname"`
	Listen   string `yaml:"listen"`
	// Subdomain is the shorthand for exposing the dashboard through the managed edge at
	// <subdomain>.<edge.base_domain> (e.g. admin → admin.mooring.example.com). Set EITHER
	// this (with edge.base_domain) or the full Hostname above. Empty = admin stays
	// loopback-only (the default; reach it over an SSH tunnel).
	Subdomain string `yaml:"subdomain"`
	// EdgeListen is a SECOND, dedicated loopback listener the managed edge proxies the
	// admin vhost to (default 127.0.0.1:9001). It is separate from bind_addr (the
	// SSH-tunnel listener) precisely so the two access paths carry different trust: the
	// edge listener REQUIRES an X-Forwarded-For from the edge and re-gates the REAL client
	// against ip_allowlist, while the tunnel keeps peer-allowlisting. Loopback-only.
	EdgeListen string `yaml:"edge_listen"`
}

type AlertingConfig struct {
	Enabled           bool     `yaml:"enabled"`
	EvalInterval      Duration `yaml:"eval_interval"`       // evaluator tick
	NotifyMinInterval Duration `yaml:"notify_min_interval"` // global rate limit between sends
	QuietStartHour    int      `yaml:"quiet_start_hour"`    // [0..23], -1 disables (suppresses WARNING; CRITICAL always pages)
	QuietEndHour      int      `yaml:"quiet_end_hour"`
	DeadMansURL       string   `yaml:"dead_mans_url"` // outbound heartbeat to an external cron-monitor
	DeadMansInterval  Duration `yaml:"dead_mans_interval"`
}

type AuthConfig struct {
	Username     string `yaml:"username"`
	PasswordHash string `yaml:"password_hash"`
	TOTPSecret   string `yaml:"totp_secret"`
}

type BackupConfig struct {
	Enabled     bool      `yaml:"enabled"`
	Schedule    Duration  `yaml:"schedule"`     // default 24h; clamped to a 1h floor
	Retention   int       `yaml:"retention"`    // keep N most-recent per target; default 7
	HelperImage string    `yaml:"helper_image"` // image with `tar` for volume snapshots; default below
	S3          *BackupS3 `yaml:"s3,omitempty"` // optional off-box destination
}

type BackupS3 struct {
	Bucket          string `yaml:"bucket"`
	Endpoint        string `yaml:"endpoint"` // host[:port], e.g. s3.us-east-1.amazonaws.com
	Region          string `yaml:"region"`
	AccessKeyID     string `yaml:"access_key_id"`
	SecretAccessKey string `yaml:"secret_access_key"`
	Prefix          string `yaml:"prefix"`     // optional key prefix, e.g. "mooring/"
	PathStyle       *bool  `yaml:"path_style"` // default true (S3-compatible endpoints)
	Insecure        bool   `yaml:"insecure"`   // allow http:// (private MinIO); default https
}

type Config struct {
	BindAddr string `yaml:"bind_addr"`

	EncryptionKey         string `yaml:"encryption_key"`
	EncryptionKeyPrevious string `yaml:"encryption_key_previous"`

	IPAllowlist    []string `yaml:"ip_allowlist"`
	TrustProxy     bool     `yaml:"trust_proxy"`
	TrustedProxies []string `yaml:"trusted_proxies"`

	Auth       AuthConfig    `yaml:"auth"`
	ExtraUsers []UserConfig  `yaml:"users"` // additional operators beyond the auth owner (RBAC)
	Edge       EdgeConfig    `yaml:"edge"`
	Admin      AdminConfig   `yaml:"admin"`
	Session    SessionConfig `yaml:"session"`
	Cookie     CookieConfig  `yaml:"cookie"`
	Docker     DockerConfig  `yaml:"docker"`
	Monitor    MonitorConfig `yaml:"monitor"`
	Git        GitConfig     `yaml:"git"`
	GitHub     GitHubConfig  `yaml:"github"`

	CaddyEditor       EditorBlock     `yaml:"caddy_editor"`
	ComposeValidation EditorBlock     `yaml:"compose_validation"`
	Setup             SetupConfig     `yaml:"setup"`
	Retention         RetentionConfig `yaml:"retention"`
	Alerting          AlertingConfig  `yaml:"alerting"`
	Server            ServerConfig    `yaml:"server"`
	Backups           BackupConfig    `yaml:"backups"`

	DataDir string `yaml:"data_dir"`

	// ProtectedProjects are Compose projects Mooring must never start/stop/
	// redeploy (the socket-proxy, and later the edge) — plan §3 protected set.
	ProtectedProjects []string `yaml:"protected_projects"`
	// contains filtered or unexported fields
}

type CookieConfig struct {
	Prefix   string `yaml:"prefix"`    // "__Host-" (default) or "__Secure-"
	BasePath string `yaml:"base_path"` // required iff prefix is __Secure-
}

type DockerConfig struct {
	ProxyAddr     string `yaml:"proxy_addr"`
	ExternalProxy bool   `yaml:"external_proxy"`
}

type Duration time.Duration

type EdgeBaseDomain struct {
	Name   string     `yaml:"name"`   // [a-z][a-z0-9-]{0,30}; referenced as `base_domain: <name>`
	Domain string     `yaml:"domain"` // the apex FQDN, e.g. staging.example.com
	DNS01  *EdgeDNS01 `yaml:"dns01,omitempty"`
}

type EdgeCA struct {
	Name         string `yaml:"name"`          // [a-z][a-z0-9-]{0,30}; referenced as `ca: <name>`
	DirectoryURL string `yaml:"directory_url"` // the ACME directory URL (https)
	Email        string `yaml:"email"`         // optional ACME contact; falls back to acme_email
	TrustedRoot  string `yaml:"trusted_root"`  // optional PEM file Caddy trusts for the CA's OWN https
}

type EdgeConfig struct {
	Mode      EdgeMode `yaml:"mode"`
	ACMEEmail string   `yaml:"acme_email"`
	ACMECA    string   `yaml:"acme_ca"`
	CAs       []EdgeCA `yaml:"cas"` // extra named issuers (private CAs) routes/cert-bindings can opt into by name
	// BaseDomain is the namespace root for the subdomain shorthand: a route or cert_binding
	// that sets `subdomain: mqtt` (instead of a full hostname) is expanded to
	// mqtt.<base_domain> at deploy time. The operator points a SINGLE wildcard DNS record
	// (*.<base_domain> → this server) and every declared subdomain resolves. "" disables the
	// shorthand (full hostnames still work). Must be a FQDN, no wildcards.
	BaseDomain string `yaml:"base_domain"`
	// DNS01, when set, issues a single *.<base_domain> WILDCARD certificate via ACME DNS-01
	// (instead of a per-subdomain HTTP-01 cert each) — one cert for every subdomain, no
	// per-name rate limits, and it works for names that aren't HTTP-reachable. It REQUIRES a
	// caddy binary with your DNS provider's module compiled in (vanilla Caddy has none —
	// build one with xcaddy). Optional; leave unset to keep per-subdomain HTTP-01.
	DNS01 *EdgeDNS01 `yaml:"dns01,omitempty"`
	// BaseDomains are ADDITIONAL, named subdomain namespaces on top of the default base_domain
	// above. Colocated apps (e.g. prod + staging on one box) each opt into one BY NAME so both
	// can keep the `subdomain:` shorthand under their own apex without a route collision. The
	// scalar base_domain stays the DEFAULT (unnamed) namespace — this is purely additive, and
	// mirrors how the scalar acme_ca coexists with the named `cas` list. Declared ONLY here in
	// the root-of-trust config; an app references a name and can never introduce an apex.
	BaseDomains      []EdgeBaseDomain `yaml:"base_domains,omitempty"`
	ApplyProbeWindow Duration         `yaml:"apply_probe_window"`
	L4Enabled        bool             `yaml:"l4_enabled"`      // own a managed L4 (TCP/UDP) load balancer (nginx-stream)
	L4NginxDigest    string           `yaml:"l4_nginx_digest"` // pinned SHA-256 of the nginx binary (optional)
}

type EdgeDNS01 struct {
	Provider string `yaml:"provider"`
	APIToken string `yaml:"api_token"`
}

type EdgeMode string

type EditorBlock struct {
	Mode EditorMode `yaml:"mode"`
}

type EditorMode string

type GitConfig struct {
	PollInterval *Duration `yaml:"poll_interval"`
}

type GitHubConfig struct {
	ClientID     string `yaml:"client_id"`
	ClientSecret string `yaml:"client_secret"`
}

type MonitorConfig struct {
	PollInterval     Duration `yaml:"poll_interval"`
	MetricsRetention Duration `yaml:"metrics_retention"`
}

type RetentionConfig struct {
	Interval      Duration `yaml:"interval"`        // how often the retention pass runs
	EventsMaxAge  Duration `yaml:"events_max_age"`  // audit rows older than this are prunable
	EventsMaxRows int      `yaml:"events_max_rows"` // hard cap on audit rows (oldest trimmed)
	ArchiveMaxMB  int      `yaml:"archive_max_mb"`  // rotate the security-archive NDJSON past this
}

type Role string

type ServerConfig struct {
	// FileRoots are directories the operator may browse READ-ONLY in the Server
	// tab (e.g. an app's log dir). Each needs a stable name (used in the URL).
	FileRoots []ServerFileRoot `yaml:"file_roots"`
	// DebCacheDir is the directory the operator downloads Mooring .deb packages
	// into; the Server tab can delete OLD ones there (never the running version),
	// behind password+TOTP re-auth. Must be absolute. It also must be within the
	// service's writable paths for the delete to succeed (see docs).
	DebCacheDir string `yaml:"deb_cache_dir"`

	// VersionCheckEnabled controls the periodic self-update check: Mooring asks the
	// GitHub API whether a newer release exists and whether the RUNNING version is
	// affected by a published security advisory (→ a persistent banner + a CRITICAL
	// alert). It is ON by default (a *bool so "unset" means on); set it to false to
	// disable — then Mooring never contacts GitHub. When on it contacts ONLY
	// api.github.com and sends no telemetry payload.
	VersionCheckEnabled *bool `yaml:"version_check_enabled"`
	// VersionCheckInterval is how often to poll (default 6h; clamped to a 1h floor).
	VersionCheckInterval Duration `yaml:"version_check_interval"`

	// ImageScanEnabled controls periodic vulnerability scanning of each deployed app's
	// images + dependencies with Trivy (High/Critical → an alert; results on the Server
	// tab). ON by default (set false to disable). It is HEAVY — Trivy downloads a
	// vulnerability database and scanning uses CPU/RAM — so a small box may want it off.
	// The scanner never gets the Docker socket: upstream images are scanned from the
	// registry, build checkouts as a filesystem.
	ImageScanEnabled *bool `yaml:"image_scan_enabled"`
	// ImageScanInterval is how often to re-scan (default 24h; clamped to a 1h floor).
	// Re-scanning unchanged images matters — new CVEs are disclosed daily.
	ImageScanInterval Duration `yaml:"image_scan_interval"`

	// DiskGCEnabled controls disk-pressure auto-reclaim: when disk usage crosses
	// DiskGCThreshold, Mooring reclaims DANGLING docker images + build cache (the superseded
	// builds that pile up as apps redeploy) and alerts. ON by default; safe because it only
	// removes unreferenced garbage — never a tagged/in-use image, a rollback (which rebuilds),
	// or any app data volume. Set false to disable.
	DiskGCEnabled *bool `yaml:"disk_gc_enabled"`
	// DiskGCThreshold is the disk-usage percent that triggers auto-reclaim (default 75,
	// clamped to [50, 95]).
	DiskGCThreshold int `yaml:"disk_gc_threshold"`

	// BuildCacheKeepEnabled controls automatic reclamation of Docker/BuildKit build cache
	// after a build-deploy. Mooring's generated multi-stage Dockerfiles emit a unique,
	// single-use runtime layer per deploy (`COPY --from=build /app /app` + the non-root
	// chown), so the cache grows without bound; Mooring runs `docker builder prune
	// --keep-storage` to cap it — evicting the least-recently-used (stale) entries while
	// keeping recent, reusable cache (e.g. the dependency-install layer) warm. ON by
	// default (a *bool: unset = on); set false to disable — then Mooring never prunes.
	BuildCacheKeepEnabled *bool `yaml:"build_cache_keep_enabled"`
	// BuildCacheKeep is how much of the most-recently-used build cache to KEEP when pruning
	// (default "5GB"). A size like "2GB"/"512MB". Smaller = less disk, colder rebuilds.
	BuildCacheKeep string `yaml:"build_cache_keep"`
}

type ServerFileRoot struct {
	Name string `yaml:"name"` // [a-z0-9][a-z0-9-]{0,30}; used in the URL/UI
	Path string `yaml:"path"` // absolute directory path
}

type SessionConfig struct {
	IdleTimeout     Duration `yaml:"idle_timeout"`
	AbsoluteTimeout Duration `yaml:"absolute_timeout"`
}

type SetupConfig struct {
	Enabled bool `yaml:"enabled"`
	// Image is the digest-pinned jail base image (the throwaway container backend).
	Image string `yaml:"image"`
	// Resource limits — counted against the global one-docker-child semaphore.
	WallClock   Duration `yaml:"wall_clock"`    // hard wall-clock timeout
	CPUs        string   `yaml:"cpus"`          // docker --cpus value, e.g. "1.0"
	MemoryMB    int      `yaml:"memory_mb"`     // hard memory cap (MemorySwapMax=0)
	PidsLimit   int      `yaml:"pids_limit"`    // max processes
	ScratchMB   int      `yaml:"scratch_mb"`    // writable scratch quota
	OutputCapKB int      `yaml:"output_cap_kb"` // captured stdout/stderr cap
}

type User struct {
	Username     string
	PasswordHash string
	TOTPSecret   string
	Role         Role
}

type UserConfig struct {
	Username     string `yaml:"username"`
	PasswordHash string `yaml:"password_hash"`
	TOTPSecret   string `yaml:"totp_secret"`
	Role         Role   `yaml:"role"`
}