config

type APIOptions struct {
	// Disabled is true if the gRPC API should be disabled.
	// The node will still be able to join a mesh, but will not be able to
	// serve any APIs or provide proxying services.
	Disabled bool `koanf:"disabled,omitempty"`
	// LibP2P are the options for serving the API over libp2p.
	LibP2P LibP2PAPIOptions `koanf:"libp2p,omitempty"`
	// ListenAddress is the gRPC address to listen on.
	ListenAddress string `koanf:"listen-address,omitempty"`
	// WebEnabled enables serving gRPC over HTTP/1.1.
	WebEnabled bool `koanf:"web-enabled,omitempty"`
	// CORSEnabled enables CORS for the gRPC web server.
	CORSEnabled bool `koanf:"cors-enabled,omitempty"`
	// AllowedOrigins is a list of allowed origins for CORS.
	AllowedOrigins []string `koanf:"allowed-origins,omitempty"`
	// TLSCertFile is the path to the TLS certificate file.
	TLSCertFile string `koanf:"tls-cert-file,omitempty"`
	// TLSCertData is the TLS certificate data.
	TLSCertData string `koanf:"tls-cert-data,omitempty"`
	// TLSKeyFile is the path to the TLS key file.
	TLSKeyFile string `koanf:"tls-key-file,omitempty"`
	// TLSKeyData is the TLS key data.
	TLSKeyData string `koanf:"tls-key-data,omitempty"`
	// MTLS is true if mutual TLS should be enabled.
	MTLS bool `koanf:"mtls,omitempty"`
	// MTLSClientCAFile is the path to the client CA file. This is not usually
	// required and handled by the mtls auth plugin.
	MTLSClientCAFile string `koanf:"mtls-client-ca-file,omitempty"`
	// Insecure is true if the transport is insecure.
	Insecure bool `koanf:"insecure,omitempty"`
	// DisableLeaderProxy is true if the leader proxy should be disabled.
	DisableLeaderProxy bool `koanf:"disable-leader-proxy,omitempty"`
	// MeshEnabled is true if the mesh API should be registered.
	MeshEnabled bool `koanf:"mesh-enabled,omitempty"`
	// AdminEnabled is true if the admin API should be registered.
	AdminEnabled bool `koanf:"admin-enabled,omitempty"`
}

type APIRegistrationOptions struct {
	// Node is the node to register the APIs against.
	Node meshnode.Node
	// Server is the server to register the APIs to.
	Server *services.Server
	// Features are the features to broadcast to other nodes.
	Features []*v1.FeaturePort
	// BuildInfo is the build info to display in the node API.
	BuildInfo version.BuildInfo
	// Description is an optional description to display in the node API.
	Description string
}

type AuthOptions struct {
	// IDAuth indicates to use ID authentication. An ID is derived
	// from the public wireguard key and presented with a signature
	// that can be verified by the private wireguard key.
	IDAuth IDAuthOptions `koanf:"id-auth,omitempty"`
	// MTLS are options for mutual TLS. This is the recommended
	// authentication method.
	MTLS MTLSOptions `koanf:"mtls,omitempty"`
	// Basic are options for basic authentication.
	Basic BasicAuthOptions `koanf:"basic,omitempty"`
	// LDAP are options for LDAP authentication.
	LDAP LDAPAuthOptions `koanf:"ldap,omitempty"`
}

type BasicAuthOptions struct {
	// Username is the username.
	Username string `koanf:"username,omitempty"`
	// Password is the password.
	Password string `koanf:"password,omitempty"`
}

type BootstrapOptions struct {
	// Enabled is the flag to attempt bootstrapping. If true, the node will only bootstrap a new cluster
	// if no data is found. To force a bootstrap, set Force to true.
	Enabled bool `koanf:"enabled,omitempty"`
	// ElectionTimeout is the election timeout to use when bootstrapping a new cluster.
	ElectionTimeout time.Duration `koanf:"election-timeout,omitempty"`
	// Transport are the bootstrap transport options
	Transport BootstrapTransportOptions `koanf:"transport,omitempty"`
	// IPv4Network is the IPv4 network of the mesh to write to the database when bootstraping a new cluster.
	IPv4Network string `koanf:"ipv4-network,omitempty"`
	// IPv6Network is the IPv6 network of the mesh to write to the database when bootstraping a new cluster.
	// If left unset, one will be generated. This must be a /32 prefix.
	IPv6Network string `koanf:"ipv6-network,omitempty"`
	// MeshDomain is the domain of the mesh to write to the database when bootstraping a new cluster.
	MeshDomain string `koanf:"mesh-domain,omitempty"`
	// Admin is the user and/or node name to assign administrator privileges to when bootstraping a new cluster.
	Admin string `koanf:"admin,omitempty"`
	// Voters is a comma separated list of node IDs to assign voting privileges to when bootstraping a new cluster.
	// BootstrapServers are automatically added to this list.
	Voters []string `koanf:"voters,omitempty"`
	// DefaultNetworkPolicy is the default network policy to apply to the mesh when bootstraping a new cluster.
	DefaultNetworkPolicy string `koanf:"default-network-policy,omitempty"`
	// DisableRBAC is the flag to disable RBAC when bootstrapping a new cluster.
	DisableRBAC bool `koanf:"disable-rbac,omitempty"`
	// Force is the force new bootstrap flag.
	Force bool `koanf:"force,omitempty"`
}

type BootstrapTransportOptions struct {
	// TCPAdvertiseAddress is the initial address to advertise for raft consensus.
	TCPAdvertiseAddress string `koanf:"tcp-advertise-address,omitempty"`
	// TCPListenAddress is the initial address to use when using TCP raft consensus to bootstrap.
	TCPListenAddress string `koanf:"tcp-listen-address,omitempty"`
	// TCPServers is a map of node IDs to addresses to bootstrap with. If empty, the node will use the advertise
	// address as the bootstrap server. If not empty, all nodes in the map should be started with the same
	// list configurations. If any are different then the first node to become leader will pick them. This
	// can cause bootstrap to fail when using ACLs. Servers should be in the form of <node-id>=<address>.
	TCPServers map[string]string `koanf:"tcp-servers,omitempty"`
	// TCPConnectionPool is the maximum number of TCP connections to maintain to other nodes.
	TCPConnectionPool int `koanf:"tcp-connection-pool,omitempty"`
	// TCPConnectTimeout is the maximum amount of time to wait for a TCP connection to be established.
	TCPConnectTimeout time.Duration `koanf:"tcp-connect-timeout,omitempty"`
	// ServerGRPCPorts is a map of node IDs to gRPC ports to bootstrap with. If empty, the node will use the
	// advertise address and locally configured gRPC port for every node in bootstrap-servers. Ports should
	// be in the form of <node-id>=<port>.
	ServerGRPCPorts map[string]int `koanf:"server-grpc-ports,omitempty"`
}

type BridgeMeshDNSOptions struct {
	// Enabled enables mesh DNS.
	Enabled bool `koanf:"enabled,omitempty"`
	// ListenUDP is the UDP address to listen on.
	ListenUDP string `koanf:"listen-udp,omitempty"`
	// ListenTCP is the address to listen on for TCP DNS requests.
	ListenTCP string `koanf:"listen-tcp,omitempty"`
	// ReusePort sets the number of listeners to start on each port.
	// This is only supported on Linux.
	ReusePort int `koanf:"reuse-port,omitempty"`
	// EnableCompression is true if DNS compression should be enabled.
	EnableCompression bool `koanf:"compression,omitempty"`
	// RequestTimeout is the timeout for DNS requests.
	RequestTimeout time.Duration `koanf:"request-timeout,omitempty"`
	// Forwarders are the DNS forwarders to use. If empty, the system DNS servers will be used.
	Forwarders []string `koanf:"forwarders,omitempty"`
	// SubscribeForwarders will subscribe to new nodes that are able to forward requests for other meshes.
	// These forwarders will be placed at the bottom of the forwarders list.
	SubscribeForwarders bool `koanf:"subscribe-forwarders,omitempty"`
	// DisableForwarding disables forwarding requests entirely.
	DisableForwarding bool `koanf:"disable-forwarding,omitempty"`
	// CacheSize is the size of the remote DNS cache.
	CacheSize int `koanf:"cache-size,omitempty"`
}

type BridgeOptions struct {
	// Meshes are the meshes to bridge.
	Meshes map[string]*Config `koanf:"meshes,omitempty"`
	// MeshDNS are options for running a meshdns server bridging all meshes.
	MeshDNS BridgeMeshDNSOptions `koanf:"meshdns,omitempty"`
	// UseMeshDNS is true if the bridge should use the meshdns server for local name resolution.
	UseMeshDNS bool `koanf:"use-meshdns,omitempty"`
}

type Config struct {
	// Global are global options that are overlaid on all other options.
	Global GlobalOptions `koanf:"global,omitempty"`
	// Bootstrap are the bootstrap options.
	Bootstrap BootstrapOptions `koanf:"bootstrap,omitempty"`
	// Auth are the authentication options.
	Auth AuthOptions `koanf:"auth,omitempty"`
	// Mesh are the mesh options.
	Mesh MeshOptions `koanf:"mesh,omitempty"`
	// Storage are the storage options.
	Storage StorageOptions `koanf:"storage,omitempty"`
	// Services are the service options.
	Services ServiceOptions `koanf:"services,omitempty"`
	// TLS are the TLS options.
	TLS TLSOptions `koanf:"tls,omitempty"`
	// WireGuard are the WireGuard options.
	WireGuard WireGuardOptions `koanf:"wireguard,omitempty"`
	// Discovery are the discovery options.
	Discovery DiscoveryOptions `koanf:"discovery,omitempty"`
	// Plugins are the plugin options.
	Plugins PluginOptions `koanf:"plugins,omitempty"`
	// Bridge are the bridge options.
	Bridge BridgeOptions `koanf:"bridge,omitempty"`
}

type DiscoveryOptions struct {
	// Discover is a flag to use the libp2p kademlia DHT for discovery.
	Discover bool `koanf:"discover,omitempty"`
	// Rendezvous is the pre-shared key string to use as a rendezvous point for peer discovery.
	Rendezvous string `koanf:"rendezvous,omitempty"`
	// BootstrapServers is a list of bootstrap servers to use for the DHT.
	// If empty or nil, the default bootstrap servers will be used.
	BootstrapServers []string `koanf:"bootstrap-servers,omitempty"`
	// LocalAddrs is a list of local addresses to announce to the discovery service.
	// If empty, the default local addresses will be used.
	LocalAddrs []string `koanf:"local-addrs,omitempty"`
	// ConnectTimeout is the timeout for connecting to a peer.
	ConnectTimeout time.Duration `koanf:"connect-timeout,omitempty"`
}

type ExecutablePluginConfig struct {
	// Path is the path to an executable for the plugin.
	Path string `kaonf:"path,omitempty"`
}

type ExternalStorageOptions struct {
	// Server is the address of a server for the plugin.
	Server string `koanf:"server,omitempty"`
	// Config is the configuration to pass to the plugin.
	Config PluginMapConfig `koanf:"config,omitempty"`
	// Insecure is whether to use an insecure connection to the plugin server.
	Insecure bool `koanf:"insecure,omitempty"`
	// TLSCAData is the base64 PEM-encoded CA data for verifying certificates.
	TLSCAData string `koanf:"tls-ca-data,omitempty"`
	// TLSCAFile is the path to a CA for verifying certificates.
	TLSCAFile string `koanf:"tls-ca-file,omitempty"`
	// TLSCertData is the base64 PEM-encoded certificate data for authenticating to the plugin server.
	TLSCertData string `koanf:"tls-cert-data,omitempty"`
	// TLSCertFile is the path to a certificate for authenticating to the plugin server.
	TLSCertFile string `koanf:"tls-cert-file,omitempty"`
	// TLSKeyData is the base64 PEM-encoded key data for authenticating to the plugin server.
	TLSKeyData string `koanf:"tls-key-data,omitempty"`
	// TLSKeyFile is the path to a key for authenticating to the plugin server.
	TLSKeyFile string `koanf:"tls-key-file,omitempty"`
	// TLSSkipVerify is whether to skip verifying the plugin server's certificate.
	TLSSkipVerify bool `koanf:"tls-skip-verify,omitempty"`
}

type GlobalOptions struct {
	// LogLevel is the log level.
	LogLevel string `koanf:"log-level,omitempty"`
	// LogFormat is the log format. One of "text" or "json".
	LogFormat string `koanf:"log-format,omitempty"`
	// TLSCertFile is the TLS certificate file.
	TLSCertFile string `koanf:"tls-cert-file,omitempty"`
	// TLSKeyFile is the TLS key file.
	TLSKeyFile string `koanf:"tls-key-file,omitempty"`
	// TLACAFile is the TLS CA file.
	TLSCAFile string `koanf:"tls-ca-file,omitempty"`
	// TLSClientCAFile is the path to the TLS client CA file.
	// If empty, either TLSCAFile or the system CA pool is used.
	TLSClientCAFile string `koanf:"tls-client-ca-file,omitempty"`
	// MTLS is true if mutual TLS is enabled.
	MTLS bool `koanf:"mtls,omitempty"`
	// VerifyChainOnly is true if only the chain should be verified.
	VerifyChainOnly bool `koanf:"verify-chain-only,omitempty"`
	// InsecureSkipVerify is true if the server TLS cert should not be verified.
	InsecureSkipVerify bool `koanf:"insecure-skip-verify,omitempty"`
	// Insecure is true if TLS should be disabled.
	Insecure bool `koanf:"insecure,omitempty"`
	// PrimaryEndpoint is the preferred publicly routable address of this node.
	// Setting this value will override the mesh advertise address with its
	// configured listen port.
	PrimaryEndpoint string `koanf:"primary-endpoint,omitempty"`
	// Endpoints are the additional publicly routable addresses of this node.
	// If PrimaryEndpoint is not set, it will be set to the first endpoint.
	// Setting this value will override the mesh advertise with its configured
	// listen port.
	Endpoints []string `koanf:"endpoints,omitempty"`
	// DetectEndpoints is true if the endpoints should be detected.
	DetectEndpoints bool `koanf:"detect-endpoints,omitempty"`
	// DetectPrivateEndpoints is true if private IP addresses should be included in detection.
	// This automatically enables DetectEndpoints.
	DetectPrivateEndpoints bool `koanf:"detect-private-endpoints,omitempty"`
	// AllowRemoteDetection is true if remote detection is allowed.
	AllowRemoteDetection bool `koanf:"allow-remote-detection,omitempty"`
	// DetectIPv6 is true if IPv6 addresses should be included in detection.
	DetectIPv6 bool `koanf:"detect-ipv6,omitempty"`
	// DisableIPv4 is true if IPv4 should be disabled.
	DisableIPv4 bool `koanf:"disable-ipv4,omitempty"`
	// DisableIPv6 is true if IPv6 should be disabled.
	DisableIPv6 bool `koanf:"disable-ipv6,omitempty"`
}

type IDAuthOptions struct {
	// Enabled is true if ID authentication is enabled.
	Enabled bool `koanf:"enabled,omitempty"`
	// Alias is an optional alias to attempt to register with our ID.
	// If empty, no registration will be attempted. If alias registration
	// fails it will be logged and the node will continue to run.
	Alias string `koanf:"alias,omitempty"`
	// Registrar is the registrar to attempt to use to register with our ID.
	// If left unset and an alias is provided, the node will attempt to discover
	// one via the mesh.
	// TODO: Credentials for non-mesh registrars.
	Registrar string `koanf:"registrar,omitempty"`
}

type LDAPAuthOptions struct {
	// Username is the username.
	Username string `koanf:"username,omitempty"`
	// Password is the password.
	Password string `koanf:"password,omitempty"`
}

type LibP2PAPIOptions struct {
	// Enabled is true if the libp2p API should be enabled.
	Enabled bool `koanf:"enabled,omitempty"`
	// Announce is true if the node should announce itself to the DHT.
	Announce bool `koanf:"announce,omitempty"`
	// Rendezvous is the pre-shared key string to use as a rendezvous point for peer discovery.
	Rendezvous string `koanf:"rendezvous,omitempty"`
	// BootstrapServers is a list of bootstrap servers to use for the DHT.
	// If empty or nil, the default bootstrap servers will be used.
	BootstrapServers []string `koanf:"bootstrap-servers,omitempty"`
	// LocalAddrs is a list of local addresses to announce to the discovery service.
	// If empty, the default local addresses will be used.
	LocalAddrs []string `koanf:"local-addrs,omitempty"`
	// ConnectTimeout is the timeout for connecting to a peer.
	ConnectTimeout time.Duration `koanf:"connect-timeout,omitempty"`
}

type MTLSOptions struct {
	// CertFile is the path to a TLS certificate file to present when joining. Either this
	// or CertData must be set.
	CertFile string `koanf:"cert-file,omitempty"`
	// CertData is the base64 encoded TLS certificate data to present when joining. Either this
	// or CertFile must be set.
	CertData string `koanf:"cert-data,omitempty"`
	// KeyFile is the path to a TLS key file for the certificate. Either this or KeyData must be set.
	KeyFile string `koanf:"key-file,omitempty"`
	// KeyData is the base64 encoded TLS key data for the certificate. Either this or KeyFile must be set.
	KeyData string `koanf:"key-data,omitempty"`
}

type MeshDNSOptions struct {
	// Enabled enables mesh DNS.
	Enabled bool `koanf:"enabled,omitempty"`
	// ListenUDP is the UDP address to listen on.
	ListenUDP string `koanf:"listen-udp,omitempty"`
	// ListenTCP is the address to listen on for TCP DNS requests.
	ListenTCP string `koanf:"listen-tcp,omitempty"`
	// ReusePort sets the number of listeners to start on each port.
	// This is only supported on Linux.
	ReusePort int `koanf:"reuse-port,omitempty"`
	// EnableCompression is true if DNS compression should be enabled.
	EnableCompression bool `koanf:"compression,omitempty"`
	// RequestTimeout is the timeout for DNS requests.
	RequestTimeout time.Duration `koanf:"request-timeout,omitempty"`
	// Forwarders are the DNS forwarders to use. If empty, the system DNS servers will be used.
	Forwarders []string `koanf:"forwarders,omitempty"`
	// IncludeSystemResolvers includes the system DNS servers in the forwarders list.
	IncludeSystemResolvers bool `koanf:"include-system-resolvers,omitempty"`
	// SubscribeForwarders will subscribe to new nodes that are able to forward requests for other meshes.
	// These forwarders will be placed at the bottom of the forwarders list.
	SubscribeForwarders bool `koanf:"subscribe-forwarders,omitempty"`
	// DisableForwarding disables forwarding requests entirely.
	DisableForwarding bool `koanf:"disable-forwarding,omitempty"`
	// CacheSize is the size of the remote DNS cache.
	CacheSize int `koanf:"cache-size,omitempty"`
	// IPv6Only will only respond to IPv6 requests.
	IPv6Only bool `koanf:"ipv6-only,omitempty"`
}

type MeshOptions struct {
	// NodeID is the node ID.
	NodeID string `koanf:"node-id,omitempty"`
	// PrimaryEndpoint is the primary endpoint to advertise when joining.
	// This can be empty to signal the node is not publicly reachable.
	PrimaryEndpoint string `koanf:"primary-endpoint,omitempty"`
	// ZoneAwarenessID is the zone awareness ID.
	ZoneAwarenessID string `koanf:"zone-awareness-id,omitempty"`
	// JoinAddresses are addresses of nodes to attempt to join.
	JoinAddresses []string `koanf:"join-addresses,omitempty"`
	// JoinMultiaddrs are multiaddresses to attempt to join over libp2p.
	// These cannot be used with JoinAddresses.
	JoinMultiaddrs []string `koanf:"join-multiaddrs,omitempty"`
	// MaxJoinRetries is the maximum number of join retries.
	MaxJoinRetries int `koanf:"max-join-retries,omitempty"`
	// Routes are additional routes to advertise to the mesh. These routes are advertised to all peers.
	// If the node is not allowed to put routes in the mesh, the node will be unable to join.
	Routes []string `koanf:"routes,omitempty"`
	// ICEPeers are peers to request direct edges to over ICE. If the node is not allowed to create edges
	// and data channels, the node will be unable to join.
	ICEPeers []string `koanf:"ice-peers,omitempty"`
	// LibP2PPeers are peers to request direct edges to over libp2p. If the node is not allowed to create edges
	// and data channels, the node will be unable to join.
	LibP2PPeers []string `koanf:"libp2p-peers,omitempty"`
	// GRPCAdvertisePort is the port to advertise for gRPC.
	GRPCAdvertisePort int `koanf:"grpc-advertise-port,omitempty"`
	// MeshDNSAdvertisePort is the port to advertise for DNS.
	MeshDNSAdvertisePort int `koanf:"meshdns-advertise-port,omitempty"`
	// UseMeshDNS indicates whether to set mesh DNS servers to the system configuration.
	UseMeshDNS bool `koanf:"use-meshdns,omitempty"`
	// RequestVote is true if the node should can provide storage and consensus.
	RequestVote bool `koanf:"request-vote,omitempty"`
	// RequestObserver is true if the node should be a storage observer.
	RequestObserver bool `koanf:"request-observer,omitempty"`
	// StoragePreferIPv6 is the prefer IPv6 flag for storage provider connections.
	StoragePreferIPv6 bool `koanf:"prefer-ipv6,omitempty"`
	// DisableIPv4 disables IPv4 usage.
	DisableIPv4 bool `koanf:"disable-ipv4,omitempty"`
	// DisableIPv6 disables IPv6 usage.
	DisableIPv6 bool `koanf:"disable-ipv6,omitempty"`
	// DisableFeatureAdvertisement is true if feature advertisement should be disabled.
	DisableFeatureAdvertisement bool `koanf:"disable-feature-advertisement,omitempty"`
	// DisableDefaultIPAM is true if the default IPAM should be disabled.
	DisableDefaultIPAM bool `koanf:"disable-default-ipam,omitempty"`
	// DefaultIPAMStaticIPv4 are static IPv4 assignments to use for the default IPAM.
	DefaultIPAMStaticIPv4 map[string]string `koanf:"default-ipam-static-ipv4,omitempty"`
}

type MetricsOptions struct {
	// Enabled is true if metrics should be enabled.
	Enabled bool `koanf:"enabled,omitempty"`
	// MetricsListenAddress is the address to listen on for metrics.
	ListenAddress string `koanf:"listen-address,omitempty"`
	// MetricsPath is the path to serve metrics on.
	Path string `koanf:"path,omitempty"`
}

type PluginConfig struct {
	// Exec is the configuration for an executable plugin.
	Exec ExecutablePluginConfig `koanf:"exec,omitempty"`
	// Remote is the configuration for a plugin that connects to an external server.
	Remote RemotePluginConfig `koanf:"remote,omitempty"`
	// Config is the configuration that will be passed to the plugin's Configure method.
	Config PluginMapConfig `koanf:"config,omitempty"`
	// contains filtered or unexported fields
}

type PluginMapConfig map[string]any

type PluginOptions struct {
	// Configs is a map of plugin names to plugin configurations.
	Configs map[string]PluginConfig `koanf:"configs"`
}

type RaftOptions struct {
	// ListenAddress is the address to listen on.
	ListenAddress string `koanf:"listen-address,omitempty"`
	// ConnectionPoolCount is the number of connections to pool. If 0, no connection pooling is used.
	ConnectionPoolCount int `koanf:"connection-pool-count,omitempty"`
	// ConnectionTimeout is the timeout for connections.
	ConnectionTimeout time.Duration `koanf:"connection-timeout,omitempty"`
	// HeartbeatTimeout is the timeout for heartbeats.
	HeartbeatTimeout time.Duration `koanf:"heartbeat-timeout,omitempty"`
	// ElectionTimeout is the timeout for elections.
	ElectionTimeout time.Duration `koanf:"election-timeout,omitempty"`
	// ApplyTimeout is the timeout for applying.
	ApplyTimeout time.Duration `koanf:"apply-timeout,omitempty"`
	// CommitTimeout is the timeout for committing.
	CommitTimeout time.Duration `koanf:"commit-timeout,omitempty"`
	// MaxAppendEntries is the maximum number of append entries.
	MaxAppendEntries int `koanf:"max-append-entries,omitempty"`
	// LeaderLeaseTimeout is the timeout for leader leases.
	LeaderLeaseTimeout time.Duration `koanf:"leader-lease-timeout,omitempty"`
	// SnapshotInterval is the interval to take snapshots.
	SnapshotInterval time.Duration `koanf:"snapshot-interval,omitempty"`
	// SnapshotThreshold is the threshold to take snapshots.
	SnapshotThreshold uint64 `koanf:"snapshot-threshold,omitempty"`
	// SnapshotRetention is the number of snapshots to retain.
	SnapshotRetention uint64 `koanf:"snapshot-retention,omitempty"`
	// ObserverChanBuffer is the buffer size for the observer channel.
	ObserverChanBuffer int `koanf:"observer-chan-buffer,omitempty"`
	// HeartbeatPurgeThreshold is the threshold of failed heartbeats before purging a peer.
	HeartbeatPurgeThreshold int `koanf:"heartbeat-purge-threshold,omitempty"`
}

type RegistrarOptions struct {
	// Enabled is true if the registrar should be enabled.
	Enabled bool `koanf:"enabled,omitempty"`
	// Private means the registrar should only respond to lookup
	// requests from authenticated nodes.
	Private bool `koanf:"private,omitempty"`
	// IDAuth are configurations for id-auth. These are only
	// applicable of the id-auth plugin is not already configured.
	IDAuth idauth.Config `koanf:"id-auth,omitempty"`
}

type RemotePluginConfig struct {
	// Server is the address of a server for the plugin.
	Server string `koanf:"server,omitempty"`
	// Insecure is whether to use an insecure connection to the plugin server.
	Insecure bool `koanf:"insecure,omitempty"`
	// TLSCAFile is the path to a CA for verifying certificates.
	TLSCAFile string `koanf:"tls-ca-file,omitempty"`
	// TLSCertFile is the path to a certificate for authenticating to the plugin server.
	TLSCertFile string `koanf:"tls-cert-file,omitempty"`
	// TLSKeyFile is the path to a key for authenticating to the plugin server.
	TLSKeyFile string `koanf:"tls-key-file,omitempty"`
	// TLSSkipVerify is whether to skip verifying the plugin server's certificate.
	TLSSkipVerify bool `koanf:"tls-skip-verify,omitempty"`
}

type ServiceOptions struct {
	// API options
	API APIOptions `koanf:"api,omitempty"`
	// WebRTC options
	WebRTC WebRTCOptions `koanf:"webrtc,omitempty"`
	// MeshDNS options
	MeshDNS MeshDNSOptions `koanf:"meshdns,omitempty"`
	// TURN options
	TURN TURNOptions `koanf:"turn,omitempty"`
	// Registrar options
	Registrar RegistrarOptions `koanf:"registrar,omitempty"`
	// Metrics options
	Metrics MetricsOptions `koanf:"metrics,omitempty"`
}

type StorageOptions struct {
	// InMemory is a flag to use in-memory storage.
	InMemory bool `koanf:"in-memory,omitempty"`
	// Path is the path to the storage directory.
	Path string `koanf:"path,omitempty"`
	// Provider is the storage provider. If empty, the default is used.
	Provider string `koanf:"provider,omitempty"`
	// Raft are the raft storage options.
	Raft RaftOptions `koanf:"raft,omitempty"`
	// External are the external storage options.
	External ExternalStorageOptions `koanf:"external,omitempty"`
	// LogLevel is the log level for the storage provider.
	LogLevel string `koanf:"log-level,omitempty"`
	// LogFormat is the log format for the storage provider.
	LogFormat string `koanf:"log-format,omitempty"`
}

type StorageProvider string

type TLSOptions struct {
	// CAFile is the path to a TLS CA file for verification. If this and CAData are empty, the system CA pool is used.
	CAFile string `koanf:"tls-ca-file,omitempty"`
	// CAData is the base64 encoded TLS CA data for verification. If this and CAFile are empty, the system CA pool is used.
	CAData string `koanf:"tls-ca-data,omitempty"`
	// VerifyChainOnly is true if only the certificate chain should be verified.
	VerifyChainOnly bool `koanf:"verify-chain-only,omitempty"`
	// InsecureSkipVerify is true if the server TLS cert should not be verified.
	InsecureSkipVerify bool `koanf:"insecure-skip-verify,omitempty"`
	// Insecure is true if the gRPC connection should be insecure.
	Insecure bool `koanf:"insecure,omitempty"`
}

type TURNOptions struct {
	// Enabled enables the TURN server.
	Enabled bool `koanf:"enabled,omitempty"`
	// Endpoint is the endpoint to advertise for the TURN server. If empty, the public IP and listen port is used.
	Endpoint string `koanf:"endpoint,omitempty"`
	// PublicIP is the address advertised for STUN/TURN requests.
	PublicIP string `koanf:"public-ip,omitempty"`
	// ListenAddress is the address to listen on for STUN/TURN connections.
	ListenAddress string `koanf:"listen-address,omitempty"`
	// Realm is the realm used for TURN server authentication.
	Realm string `koanf:"realm,omitempty"`
	// TURNPortRange is the port range to use for allocating TURN relays.
	TURNPortRange string `koanf:"port-range,omitempty"`
}

type WebRTCOptions struct {
	// Enabled enables the WebRTC API.
	Enabled bool `koanf:"enabled,omitempty"`
	// STUNServers is a list of STUN servers to use for the WebRTC API.
	STUNServers []string `koanf:"stun-servers,omitempty"`
}

type WireGuardOptions struct {
	// ListenPort is the port to listen on.
	ListenPort int `koanf:"listen-port,omitempty"`
	// Modprobe attempts to load the wireguard kernel module on linux systems.
	Modprobe bool `koanf:"modprobe,omitempty"`
	// InterfaceName is the name of the interface.
	InterfaceName string `koanf:"interface-name,omitempty"`
	// ForceInterfaceName forces the use of the given name by deleting
	// any pre-existing interface with the same name.
	ForceInterfaceName bool `koanf:"force-interface-name,omitempty"`
	// ForceTUN forces the use of a TUN interface.
	ForceTUN bool `koanf:"force-tun,omitempty"`
	// Masquerade enables masquerading of traffic from the wireguard interface.
	Masquerade bool `koanf:"masquerade,omitempty"`
	// PersistentKeepAlive is the interval at which to send keepalive packets
	// to peers. If unset, keepalive packets will automatically be sent to publicly
	// accessible peers when this instance is behind a NAT. Otherwise, no keep-alive
	// packets are sent.
	PersistentKeepAlive time.Duration `koanf:"persistent-keepalive,omitempty"`
	// MTU is the MTU to use for the interface.
	MTU int `koanf:"mtu,omitempty"`
	// Endpoints are additional WireGuard endpoints to broadcast when joining.
	Endpoints []string `koanf:"endpoints,omitempty"`
	// KeyFile is the path to the WireGuard private key. If it does not exist it will be created.
	KeyFile string `koanf:"key-file,omitempty"`
	// KeyRotationInterval is the interval to rotate wireguard keys.
	// Set this to 0 to disable key rotation.
	KeyRotationInterval time.Duration `koanf:"key-rotation-interval,omitempty"`
	// RecordMetrics enables recording of WireGuard metrics. These are only exposed if the
	// metrics server is enabled.
	RecordMetrics bool `koanf:"record-metrics,omitempty"`
	// RecordMetricsInterval is the interval at which to update WireGuard metrics.
	RecordMetricsInterval time.Duration `koanf:"record-metrics-interval,omitempty"`
	// DisableFullTunnel will ignore routes for a default gateway.
	DisableFullTunnel bool `koanf:"disable-full-tunnel,omitempty"`
	// contains filtered or unexported fields
}