config

type App struct {
	App string `yaml:"app,omitempty"`
}

type Bot interface {
	// AuthPing pings the auth server and returns the (possibly cached) response.
	AuthPing(ctx context.Context) (*proto.PingResponse, error)

	// ProxyPing returns a (possibly cached) ping response from the Teleport proxy.
	// Note that it relies on the auth server being configured with a sane proxy
	// public address.
	ProxyPing(ctx context.Context) (*webclient.PingResponse, error)

	// GetCertAuthorities returns the possibly cached CAs of the given type and
	// requests them from the server if unavailable.
	GetCertAuthorities(ctx context.Context, caType types.CertAuthType) ([]types.CertAuthority, error)

	// Client retrieves the current auth client.
	Client() auth.ClientI

	// AuthenticatedUserClientFromIdentity returns a client backed by a specific
	// identity.
	AuthenticatedUserClientFromIdentity(ctx context.Context, id *identity.Identity) (auth.ClientI, error)

	// Config returns the current bot config
	Config() *BotConfig
}

type BotConfig struct {
	Onboarding   *OnboardingConfig    `yaml:"onboarding,omitempty"`
	Storage      *StorageConfig       `yaml:"storage,omitempty"`
	Destinations []*DestinationConfig `yaml:"destinations,omitempty"`

	Debug           bool          `yaml:"debug"`
	AuthServer      string        `yaml:"auth_server"`
	CertificateTTL  time.Duration `yaml:"certificate_ttl"`
	RenewalInterval time.Duration `yaml:"renewal_interval"`
	Oneshot         bool          `yaml:"oneshot"`
}

type BotConfigWriter struct {
	// contains filtered or unexported fields
}

type CLIConf struct {
	ConfigPath string

	Debug bool

	// AuthServer is a Teleport auth server address. It may either point
	// directly to an auth server, or to a Teleport proxy server in which case
	// a tunneled auth connection will be established.
	AuthServer string

	// DataDir stores the bot's internal data.
	DataDir string

	// DestinationDir stores the generated end-user certificates.
	DestinationDir string

	// CAPins is a list of pinned SKPI hashes of trusted auth server CAs, used
	// only on first connect.
	CAPins []string

	// Token is a bot join token.
	Token string

	// RenewalInterval is the interval at which certificates are renewed, as a
	// time.ParseDuration() string. It must be less than the certificate TTL.
	RenewalInterval time.Duration

	// CertificateTTL is the requested TTL of certificates. It should be some
	// multiple of the renewal interval to allow for failed renewals.
	CertificateTTL time.Duration

	// JoinMethod is the method the bot should use to exchange a token for the
	// initial certificate
	JoinMethod string

	// Oneshot controls whether the bot quits after a single renewal.
	Oneshot bool

	// InitDir specifies which destination to initialize if multiple are
	// configured.
	InitDir string

	// BotUser is a Unix username that should be given permission to write
	BotUser string

	// ReaderUser is the Unix username that will be reading the files
	ReaderUser string

	// Owner is the user:group that will own the destination files. Due to SSH
	// restrictions on key permissions, it cannot be the same as the reader
	// user. If ACL support is unused or unavailable, the reader user will own
	// files directly.
	Owner string

	// Clean is a flag that, if set, instructs `tbot init` to remove existing
	// unexpected files.
	Clean bool

	// ConfigureOutput provides a path that the generated configuration file
	// should be written to
	ConfigureOutput string

	// Proxy is the teleport proxy address. Unlike `AuthServer` this must
	// explicitly point to a Teleport proxy.
	Proxy string

	// Cluster is the name of the Teleport cluster on which resources should
	// be accessed.
	Cluster string

	// RemainingArgs is the remaining string arguments for commands that
	// require them.
	RemainingArgs []string
}

type CertAuthType types.CertAuthType

type Database struct {
	// Service is the service name of the Teleport database. Generally this is
	// the name of the Teleport resource.
	Service string `yaml:"service,omitempty"`

	// Database is the name of the database to request access to.
	Database string `yaml:"database,omitempty"`

	// Username is the database username to request access as.
	Username string `yaml:"username,omitempty"`
}

type DestinationConfig struct {
	DestinationMixin `yaml:",inline"`

	Roles   []string         `yaml:"roles,omitempty"`
	Configs []TemplateConfig `yaml:"configs,omitempty"`

	// Database is a database to request access to. Mutually exclusive with
	// `kubernetes_cluster` and other special cert requests.
	Database *Database `yaml:"database,omitempty"`

	// KubernetesCluster is a cluster to request access to. Mutually exclusive
	// with `database` and other special cert requests.
	KubernetesCluster *KubernetesCluster `yaml:"kubernetes_cluster,omitempty"`

	// App is an app access request. Mutually exclusive with `database`,
	// `kubernetes_cluster`, and other special cert requests.
	App *App `yaml:"app,omitempty"`
}

type DestinationDefaults = func(*DestinationMixin) error

type DestinationDirectory struct {
	Path     string             `yaml:"path,omitempty"`
	Symlinks botfs.SymlinksMode `yaml:"symlinks,omitempty"`
	ACLs     botfs.ACLMode      `yaml:"acls,omitempty"`
}

type DestinationMemory struct {
	// contains filtered or unexported fields
}

type DestinationMixin struct {
	Directory *DestinationDirectory `yaml:"directory,omitempty"`
	Memory    *DestinationMemory    `yaml:"memory,omitempty"`
}

type FileDescription struct {
	// Name is the name of the file or directory to create.
	Name string

	// IsDir designates whether this describes a subdirectory inside the
	// destination.
	IsDir bool
}

type KubernetesCluster struct {
	// ClusterName is the name of the Kubernetes cluster in Teleport.
	ClusterName string
}

type OnboardingConfig struct {
	// TokenValue is either the token needed to join the auth server, or a path pointing to a file
	// that contains the token
	//
	// You should use Token() instead - this has to be an exported field for YAML unmarshalling
	// to work correctly, but this could be a path instead of a token
	TokenValue string `yaml:"token"`

	// CAPath is an optional path to a CA certificate.
	CAPath string `yaml:"ca_path"`

	// CAPins is a list of certificate authority pins, used to validate the
	// connection to the Teleport auth server.
	CAPins []string `yaml:"ca_pins"`

	// JoinMethod is the method the bot should use to exchange a token for the
	// initial certificate
	JoinMethod types.JoinMethod `yaml:"join_method"`
}

type RemainingArgsList []string

type StorageConfig struct {
	DestinationMixin `yaml:",inline"`
}

type Template interface {
	// Name returns the name of this config template.
	Name() string

	// Describe generates a list of all files this ConfigTemplate will generate
	// at runtime. Currently ConfigTemplates are required to know this
	// statically as this must be callable without any auth clients (or any
	// secrets) for use with `tbot init`. If an arbitrary number of files must
	// be generated, they should be placed in a subdirectory.
	Describe(destination bot.Destination) []FileDescription

	// Render writes the config template to the destination.
	Render(ctx context.Context, bot Bot, currentIdentity *identity.Identity, destination *DestinationConfig) error
}

type TemplateCockroach struct {
	DirName string `yaml:"dir_name,omitempty"`
}

type TemplateConfig struct {
	SSHClient   *TemplateSSHClient   `yaml:"ssh_client,omitempty"`
	Identity    *TemplateIdentity    `yaml:"identity,omitempty"`
	TLS         *TemplateTLS         `yaml:"tls,omitempty"`
	TLSCAs      *TemplateTLSCAs      `yaml:"tls_cas,omitempty"`
	Mongo       *TemplateMongo       `yaml:"mongo,omitempty"`
	Cockroach   *TemplateCockroach   `yaml:"cockroach,omitempty"`
	Kubernetes  *TemplateKubernetes  `yaml:"kubernetes,omitempty"`
	SSHHostCert *TemplateSSHHostCert `yaml:"ssh_host_cert,omitempty"`
}

type TemplateIdentity struct {
	FileName string `yaml:"file_name,omitempty"`
}

type TemplateKubernetes struct {
	Path string `yaml:"path,omitempty"`

	// ClusterAddress may be used to override the k8s cluster address. It's
	// resolved from Teleport's ping responses if unset.
	ClusterAddress string `yaml:"cluster_addr,omitempty"`
	// contains filtered or unexported fields
}

type TemplateMongo struct {
	Prefix string `yaml:"prefix,omitempty"`
}

type TemplateSSHClient struct {
	ProxyPort uint16 `yaml:"proxy_port"`
	// contains filtered or unexported fields
}

type TemplateSSHHostCert struct {
	// Prefix is the filename prefix for the generated SSH host
	// certificates
	Prefix string `yaml:"prefix,omitempty"`

	// Principals is a list of principals to request for the host cert.
	Principals []string `yaml:"principals"`
}

type TemplateTLS struct {
	// Prefix is the filename prefix for the output files.
	Prefix string `yaml:"prefix,omitempty"`

	// CACertType is the type of CA cert to be written
	CACertType CertAuthType `yaml:"ca_cert_type,omitempty"`
}

type TemplateTLSCAs struct {
	// HostCAPath is the path to which Teleport's host CAs will be written.
	HostCAPath string `yaml:"host_ca_path,omitempty"`

	// UserCAPath is the path to which Teleport's user CAs will be written.
	UserCAPath string `yaml:"user_ca_path,omitempty"`

	// DatabaseCAPath is the path to which Teleport's database CA will be
	// written.
	DatabaseCAPath string `yaml:"database_ca_path,omitempty"`
}