metacrypt/internal/config/config.go

// Package config provides TOML configuration loading and validation.
package config

import (
	"fmt"
	"os"

	"github.com/pelletier/go-toml/v2"
)

// Config is the top-level configuration for Metacrypt.
type Config struct {
	Server   ServerConfig   `toml:"server"`
	Web      WebConfig      `toml:"web"`
	MCIAS    MCIASConfig    `toml:"mcias"`
	Database DatabaseConfig `toml:"database"`
	Log      LogConfig      `toml:"log"`
	Seal     SealConfig     `toml:"seal"`
}

// ServerConfig holds HTTP/gRPC server settings.
type ServerConfig struct {
	ListenAddr  string `toml:"listen_addr"`
	GRPCAddr string `toml:"grpc_addr"`
	TLSCert     string `toml:"tls_cert"`
	TLSKey      string `toml:"tls_key"`
	ExternalURL string `toml:"external_url"` // public base URL for ACME directory, e.g. "https://metacrypt.example.com"
}

// WebConfig holds settings for the standalone web UI server (metacrypt-web).
type WebConfig struct {
	// ListenAddr is the address the web server listens on (default: 127.0.0.1:8080).
	ListenAddr string `toml:"listen_addr"`
	// VaultGRPC is the gRPC address of the vault server (e.g. "127.0.0.1:9443").
	VaultGRPC string `toml:"vault_grpc"`
	// VaultCACert is the path to the CA certificate used to verify the vault's TLS cert.
	VaultCACert string `toml:"vault_ca_cert"`
	// TLSCert and TLSKey are optional. If empty, the web server uses plain HTTP
	// (suitable for deployment behind a TLS-terminating reverse proxy).
	TLSCert string `toml:"tls_cert"`
	TLSKey  string `toml:"tls_key"`
}

// DatabaseConfig holds SQLite database settings.
type DatabaseConfig struct {
	Path string `toml:"path"`
}

// MCIASConfig holds MCIAS integration settings.
type MCIASConfig struct {
	ServerURL string `toml:"server_url"`
	CACert    string `toml:"ca_cert"`
}

// SealConfig holds Argon2id parameters for the seal process.
type SealConfig struct {
	Argon2Time    uint32 `toml:"argon2_time"`
	Argon2Memory  uint32 `toml:"argon2_memory"`
	Argon2Threads uint8  `toml:"argon2_threads"`
}

// LogConfig holds logging settings.
type LogConfig struct {
	Level string `toml:"level"`
}

// Load reads and parses a TOML config file.
func Load(path string) (*Config, error) {
	data, err := os.ReadFile(path) //nolint:gosec
	if err != nil {
		return nil, fmt.Errorf("config: read file: %w", err)
	}
	var cfg Config
	if err := toml.Unmarshal(data, &cfg); err != nil {
		return nil, fmt.Errorf("config: parse: %w", err)
	}
	if err := cfg.Validate(); err != nil {
		return nil, err
	}
	return &cfg, nil
}

// Validate checks required fields and applies defaults.
func (c *Config) Validate() error {
	if c.Server.ListenAddr == "" {
		return fmt.Errorf("config: server.listen_addr is required")
	}
	if c.Server.TLSCert == "" {
		return fmt.Errorf("config: server.tls_cert is required")
	}
	if c.Server.TLSKey == "" {
		return fmt.Errorf("config: server.tls_key is required")
	}
	if c.Database.Path == "" {
		return fmt.Errorf("config: database.path is required")
	}
	if c.MCIAS.ServerURL == "" {
		return fmt.Errorf("config: mcias.server_url is required")
	}

	// Apply defaults for seal parameters.
	if c.Seal.Argon2Time == 0 {
		c.Seal.Argon2Time = 3
	}
	if c.Seal.Argon2Memory == 0 {
		c.Seal.Argon2Memory = 128 * 1024
	}
	if c.Seal.Argon2Threads == 0 {
		c.Seal.Argon2Threads = 4
	}

	if c.Log.Level == "" {
		c.Log.Level = "info"
	}

	// Apply defaults for web server.
	if c.Web.ListenAddr == "" {
		c.Web.ListenAddr = "127.0.0.1:8080"
	}

	return nil
}