<?php
declare(strict_types=1);

/*
 * SafeTun backend policy. Copy to config.php outside public_html, set mode 0600,
 * replace example.invalid values, and add only IP/CIDRs you control.
 * Documentation IP ranges below stay commented so a fresh install denies everyone.
 */
return [
    'app' => [
        'environment' => 'production',
        'debug' => false,
        'issuer' => 'https://auth.example.invalid',
        'audience' => 'safetun-hub',
        'timezone' => 'UTC',
        'api_base_urls' => ['https://auth.example.invalid/api/v1'],
    ],

    'api' => [
        'require_https' => true,
        'max_body_bytes' => 32768,
        'challenge_ttl_seconds' => 120,
        'request_clock_skew_seconds' => 90,
        'rate_limit_window_seconds' => 60,
        'challenge_rate_limit' => 30,
        'protected_rate_limit' => 20,
        'release_rate_limit' => 120,
    ],

    'authorization' => [
        'client_ip_mode' => 'direct',
        'allowed_iran_cidrs' => [
            // '203.0.113.0/26',      // documentation only; replace with an owned range
            // '198.51.100.0/27',    // documentation only; replace with an owned range
            // '192.0.2.10',         // a single IPv4 becomes /32
            // '2001:db8:1234::/48', // documentation only; replace with an owned range
        ],
        'denied_cidrs' => [],
        'trusted_proxy_cidrs' => [],
        'trusted_ip_headers' => ['CF-Connecting-IP', 'X-Forwarded-For'],
        'require_public_ip' => true,
        'dangerously_allow_all' => false,
        'revoked_node_key_hashes' => [],
        'max_edges_per_hub' => null,
    ],

    'access_policy' => [
        'policy_id' => 'default-secure-v1',
        // Grant only capabilities wired into the production role binaries.
        // Add 'l3' only in a future release that activates an audited L3 driver.
        'hub_features' => ['smart_auto', 'tcp_forward', 'udp_forward', 'full_port'],
        'edge_features' => ['tcp_forward', 'udp_forward', 'full_port'],
    ],

    'endpoint_policy' => [
        'mode' => 'explicit_pair_only',
        'allowed_foreign_cidrs' => [],
        'max_foreign_endpoints_per_hub' => 3,
        'allow_arbitrary_target_scan' => false,
        'require_reverse_probe' => true,
    ],

    'lease' => [
        'ttl_seconds' => 1800,
        'renew_after_seconds' => 300,
        'offline_grace_seconds' => 3600,
        'clock_skew_seconds' => 30,
        'fail_closed_after_grace' => true,
        'active_key_id' => 'auth-current',
        'private_key_path' => __DIR__ . '/keys/auth-current.key',
        'verification_keys' => [
            'auth-current' => __DIR__ . '/keys/auth-current.pub',
        ],
    ],

    'pair' => [
        'ttl_seconds' => 900,
        'offline_grace_seconds' => 3600,
        'active_key_id' => 'pair-current',
        'private_key_path' => __DIR__ . '/keys/pair-current.key',
        'verification_keys' => [
            'pair-current' => __DIR__ . '/keys/pair-current.pub',
        ],
    ],

    'transports' => [
        'easy_profile' => 'smart_secure',
        'security_floor' => 'encrypted',
        'priority' => [
            'wireguard_udp', 'quic_tls', 'ikev2_ipsec',
            'tls_tcp_443', 'wss_tls_443', 'openvpn_tcp_443',
        ],
        'enabled' => [
            'wireguard_udp' => true,
            'quic_tls' => true,
            'ikev2_ipsec' => false,
            'tls_tcp_443' => true,
            'wss_tls_443' => true,
            'openvpn_udp' => false,
            'openvpn_tcp_443' => false,
            'sit_6in4' => true,
            'ipip_4in4' => true,
            'gre' => true,
        ],
        'allow_plain_raw_in_easy' => false,
        'allow_plain_raw_in_advanced' => true,
        'tcp_ports' => [443, 8443],
        'udp_ports' => [443, 8443, 51820],
        'owned_tls_server_name' => 'tunnel.example.invalid',
        'certificate_path' => __DIR__ . '/keys/tunnel-chain.pem',
        'certificate_key_path' => __DIR__ . '/keys/tunnel.key',
    ],

    'diagnostics' => [
        'enabled' => true,
        'bidirectional' => true,
        'timeout_ms' => 2500,
        'probe_rounds' => 5,
        'tcp_ports' => [443, 8443],
        'udp_ports' => [443, 8443],
        'raw_protocols' => [4, 41, 47],
        'pmtu_probe' => true,
        'short_throughput_probe' => true,
        'max_probe_bytes' => 1048576,
        'packet_capture' => false,
        'redact_support_bundle' => true,
    ],

    'health' => [
        'interval_seconds' => 5,
        'failure_threshold' => 3,
        'recovery_threshold' => 5,
        'max_backoff_seconds' => 60,
        'make_before_break' => true,
        'hot_standby' => true,
        'hysteresis_seconds' => 180,
    ],

    'forwarding' => [
        'default_mode' => 'full_port',
        'tcp_ranges' => ['1-65535'],
        'udp_ranges' => ['1-65535'],
        'protected_tcp_ports' => [22, 443, 8443],
        'protected_udp_ports' => [443, 8443, 51820],
        'remote_ssh_port' => 22,
        'control_port' => 8443,
    ],

    'network' => [
        'auto_interface' => true,
        'auto_route' => true,
        'auto_mtu' => true,
        'pmtu_probe' => true,
        'mss_clamp' => 'auto',
        'safe_mtu_fallback' => 1280,
    ],

    'optimizer' => [
        'profile' => 'balanced',
        'bbr' => 'auto',
        'qdisc' => 'auto',
        'buffer_tuning' => 'auto',
        'replace_kernel' => false,
        'automatic_reboot' => false,
        'backup_before_change' => true,
        'rollback_on_failure' => true,
    ],

    'assigned_source_ip' => [
        'enabled' => false,
        'allowed_source_cidrs' => [],
        'require_local_or_provider_routed' => true,
        'require_reverse_path_probe' => true,
        'advanced_only' => true,
    ],

    'release' => [
        'channel' => 'stable',
        'manifest_url' => 'https://downloads.example.invalid/safetun/api/v1/releases/stable/manifest',
        'manifest_path' => __DIR__ . '/release/manifest.json',
        'manifest_signature_path' => __DIR__ . '/release/manifest.json.sig',
        'active_key_id' => 'release-root-v1',
        'release_public_key_path' => __DIR__ . '/keys/release.pub',
        'require_signature' => true,
        'allow_foreign_direct_download' => false,
        'iran_hub_pushes_edge' => true,
    ],

    'runtime' => [
        'nonce_dir' => __DIR__ . '/runtime/nonces',
        'rate_limit_dir' => __DIR__ . '/runtime/rate-limits',
        'cache_dir' => __DIR__ . '/runtime/cache',
        'audit_log_dir' => __DIR__ . '/logs',
        'retention_days' => 14,
    ],
];
