data-mesher/nix/nixosModules/data-mesher/settings.nix

{ lib, ... }:
{
  options = {
    plugin_directories = lib.mkOption {
      type = lib.types.listOf lib.types.str;
      default = [ ];
      description = "List of plugin subdirectories to create under each network's files directory on startup.";
    };

    log_level = lib.mkOption {
      type = lib.types.enum [
        "fatal"
        "error"
        "warn"
        "info"
        "debug"
      ];
      default = "info";
      description = "Log level";
    };

    sweep_interval = lib.mkOption {
      type = lib.types.str;
      default = "1m";
      description = ''
        How often the background sweeper walks the signature store to remove
        files whose `valid_for` TTL has elapsed. A Golang time.Duration string
        (e.g. "30s", "5m"). Set to a smaller value if you publish files with
        very short TTLs.
      '';
    };

    clock_skew_tolerance = lib.mkOption {
      type = lib.types.str;
      default = "2m";
      description = ''
        Tolerance applied when rejecting already-expired remote signatures
        during gossip. A remote signature is rejected only if its effective
        expiry (signed_at + valid_for) is more than this far in the past
        relative to the local clock. A Golang time.Duration string.
      '';
    };

    cluster = {
      port = lib.mkOption {
        type = lib.types.port;
        default = 7946;
        description = "TCP port to listen on for libp2p cluster communication";
      };

      interfaces = lib.mkOption {
        type = lib.types.listOf lib.types.str;
        default = [ ];
        description = "Network interfaces to listen on for cluster connections. If empty, listens on all interfaces.";
      };

      bootstrap_peers = lib.mkOption {
        type = lib.types.listOf lib.types.str;
        default = [ ];
        description = ''
          A list of libp2p multiaddresses (including peer ID) to connect to when joining the cluster.
          Example: /ip4/192.168.1.1/tcp/7946/p2p/12D3KooW...
        '';
      };

      push_pull_interval = lib.mkOption {
        type = lib.types.str;
        description = ''
          An interval, in the form of a Golang time.Duration, which controls how frequently a node will perform a
          push/pull sync with another random node
        '';
        default = "30s";
      };

      identity_key = lib.mkOption {
        type = lib.types.nullOr lib.types.str;
        default = null;
        description = ''
          Path to the libp2p identity key file (base64-encoded ED25519 private key).
          If null, a key will be auto-generated on first start.
        '';
      };

      identity_cert = lib.mkOption {
        type = lib.types.nullOr lib.types.str;
        default = null;
        description = "Path to the node identity certificate file (CA-signed)";
      };

      auth_timeout = lib.mkOption {
        type = lib.types.str;
        default = "30s";
        description = "Auth exchange timeout duration";
      };
    };

    http = {
      port = lib.mkOption {
        type = lib.types.port;
        default = 7331;
        description = "Port to listen on for http requests";
      };

      interface = lib.mkOption {
        type = lib.types.str;
        default = "lo";
        description = "Interface to listen on for http requests";
      };
    };

    network = {
      id = lib.mkOption {
        type = lib.types.str;
        description = ''
          Path to the network ID public key file, or a base64-encoded ED25519 public key.
          This identifies the network and is used to derive CA authorities for peer communication.
        '';
      };

      files = lib.mkOption {
        type = lib.types.attrsOf (lib.types.listOf lib.types.str);
        default = { };
        example = {
          "dns:sol" = [ "P6AE0lukf9/qmVglYrGPNYo5ZnpFrnqLeAzlCZF0lTk=" ];
          "dns:vulcan" = [
            "ZasdhiAVJTa5b2qG8ynWvdHqALUxC6Eg8pdn6RVXuQE="
            "1ru2QQ1eWV7yDlyfTTDEml3xTiacASYn0KprzknN8Pc="
          ];
        };
        description = ''
          A mapping of file names to lists of base64-encoded ED25519 public keys.
          Only files listed here can be uploaded or imported from other nodes,
          and they must be signed by one of the configured public keys.
          The network ID is automatically added as an implicit signer for all files.
        '';
      };

      namespaces = lib.mkOption {
        type = lib.types.listOf lib.types.str;
        default = [ ];
        description = ''
          List of namespace names for certificate-based file authorization.
          When configured, files named {namespace}/{signer_public_key_url_encoded}
          are permitted from any peer with a valid certificate signed by this network.
        '';
      };
    };

    extra_networks = lib.mkOption {
      type = lib.types.attrsOf (
        lib.types.submodule {
          options = {
            id = lib.mkOption {
              type = lib.types.str;
              description = ''
                Path to the network ID public key file, or a base64-encoded ED25519 public key.
              '';
            };

            files = lib.mkOption {
              type = lib.types.attrsOf (lib.types.listOf lib.types.str);
              default = { };
              description = ''
                A mapping of file names to lists of authorized signer public keys for this network.
              '';
            };

            namespaces = lib.mkOption {
              type = lib.types.listOf lib.types.str;
              default = [ ];
              description = ''
                List of namespace names for certificate-based file authorization on this network.
              '';
            };
          };
        }
      );
      default = { };
      description = ''
        Additional networks to participate in beyond the home network.
        Each entry maps a name to a network configuration with its own ID, files, and optional export restrictions.
      '';
    };
  };

}