config

type Bastion struct {
	Host `yaml:",inline"`

	Hosts          []Host          `yaml:"hosts"`
	IdentityFile   string          `yaml:"identity_file"`
	User           string          `yaml:"user"`
	SSHExecCommand *SSHExecCommand `yaml:"ssh_exec_command,omitempty"`
}

type ClientConfig struct {
	// ConfigFile is the path to blessclient config file
	ConfigFile string

	// AWSUserProfile is an aws profile that references a user (not a role)
	// leaving this empty typically means use `default` profile
	AWSUserProfile string ` yaml:"aws_user_profile"`
	// AWSUserName is your AWS username
	AWSUserName *string ` yaml:"aws_username,omitempty"`

	// Path to your ssh private key
	SSHPrivateKey  string `yaml:"ssh_private_key"`
	UpdateSSHAgent bool   `yaml:"update_ssh_agent"`

	// cert related
	CertLifetime Duration `yaml:"cert_lifetime,inline"`
	// ask bless to sign for these remote users
	RemoteUsers []string `yaml:"remote_users"`
	// bless calls these bastion ips - your source ip. 0.0.0.0/0 is all
	BastionIPS []string `yaml:"bastion_ips"`
	// ask bless to validate existing certs against the remote users
	// the default is true.
	SkipPrincipalValidation bool `yaml:"skip_principal_validation"`
}

type Config struct {
	// Version versions this config
	Version int `yaml:"version"`

	// ClientConfig is config for blessclient
	ClientConfig ClientConfig `yaml:"client_config"`
	// LambdaConfig holds configuration around the bless lambda
	LambdaConfig LambdaConfig `yaml:"lambda_config"`
	// OktaConfig holds configuration around aws-okta settings
	OktaConfig *OktaConfig `yaml:"okta_config,omitempty"`
	// For convenience, you can bundle an ~/.ssh/config template here
	SSHConfig *SSHConfig `yaml:"ssh_config,omitempty"`

	// Telemetry does telemetry
	Telemetry Telemetry `yaml:"telemetry,omitempty"`
}

type Duration struct {
	time.Duration
}

type Honeycomb struct {
	WriteKey string `yaml:"write_key,omitempty"`
	Dataset  string `yaml:"dataset,omitempty"`
	// SecretManagerARN is a secret that holds the honeycomb write key
	SecretManagerARN string `yaml:"secret_manager_arn,omitempty"`
}

type Host struct {
	Pattern string `yaml:"pattern"`
}

type LambdaConfig struct {
	// RoleARN used to assume and invoke bless lambda
	RoleARN *string `yaml:"role_arn,omitempty"`
	// Bless lambda function name
	FunctionName string `yaml:"function_name"`
	// Bless lambda function version (lambda alias or version qualifier)
	FunctionVersion *string `yaml:"function_version,omitempty"`
	// bless lambda regions
	Regions []Region `yaml:"regions,omitempty"`
}

type OktaConfig struct {
	Domain         string  `yaml:"domain"`
	Organization   string  `yaml:"organization"`
	Profile        string  `yaml:"profile"`
	KeyringKeyID   *string `yaml:"keyring_key_id,omitempty"`
	MFAProvider    *string `yaml:"mfa_provider,omitempty"`
	MFAFactorType  *string `yaml:"mfa_factor_type,omitempty"`
	DuoDevice      *string `yaml:"duo_device,omitempty"`
	KeyringBackend *string `yaml:"keyring_backend,omitempty"`
}

type Region struct {
	// name of the aws region (us-west-2)
	AWSRegion string `yaml:"aws_region"`
	// region specific kms key id (not arn) of the key used for kmsauth
	KMSAuthKeyID string `yaml:"kms_auth_key_id"`
}

type SSHConfig struct {
	Bastions []Bastion `yaml:"bastions"`
}

type SSHExecCommand string

type Telemetry struct {
	Honeycomb *Honeycomb `yaml:"honeycomb,omitempty"`
}