<?php

namespace App\Support;

/**
 * Deployment configuration an operator can change from the console instead of
 * editing .env and restarting: which DNS zone customer instances live under,
 * where the WireGuard hub is reachable, where Traefik's dynamic config lives,
 * the public half of the SSH identity, and where the monitoring bridge is.
 *
 * None of these are secret — the counterpart credentials live in SecretVault,
 * not here — but several are read from more than one class, so the Settings
 * key name and its .env-derived default are centralised here rather than
 * repeated at every call site, where a copy-pasted default could drift from
 * the others.
 *
 * Falls back to the existing config() value (itself env()-derived) when
 * nothing has been saved from the console yet, so an installation that
 * already has these in .env keeps working unchanged until an operator
 * chooses to move a value onto this page.
 *
 * Deliberately NOT here: CLUPILOT_WG_SUBNET and CLUPILOT_WG_HUB_IP. The
 * compose file reads them too (vpn-dns, vpn-gateway), at container boot —
 * moving them here would let the console show one value while the containers
 * that already started keep another, which is worse than the single .env
 * source of truth it would replace. KUMA_URL/KUMA_USERNAME are the same
 * problem one layer further out: docker/kuma-bridge/app.py reads them from
 * its own process environment at boot, and nothing in this application reads
 * them at all, so there is no consumer here to wire them to.
 */
final class ProvisioningSettings
{
    public static function dnsZone(): string
    {
        return (string) Settings::get('provisioning.dns_zone', (string) config('provisioning.dns.zone'));
    }

    public static function wgEndpoint(): string
    {
        return (string) Settings::get('provisioning.wg_endpoint', (string) config('provisioning.wireguard.endpoint'));
    }

    public static function wgHubPublicKey(): string
    {
        return (string) Settings::get('provisioning.wg_hub_pubkey', (string) config('provisioning.wireguard.hub_public_key'));
    }

    public static function traefikDynamicPath(): string
    {
        return (string) Settings::get('provisioning.traefik_dynamic_path', (string) config('provisioning.traefik.dynamic_path'));
    }

    /** The PUBLIC half only. The private key is a secret — see SecretVault's ssh.private_key. */
    public static function sshPublicKey(): string
    {
        return (string) Settings::get('provisioning.ssh_public_key', (string) config('provisioning.ssh.public_key'));
    }

    public static function monitoringUrl(): string
    {
        return (string) Settings::get('monitoring.api_url', (string) config('services.monitoring.url'));
    }

    /**
     * The support mailbox this installation reads customer mail from.
     *
     * Host, user and folder are plain settings; the PASSWORD is a vault entry
     * (SecretVault 'inbound_mail.password'), like every other credential that
     * opens something. Same fall-back shape as the rest: what an operator saved
     * wins, and the .env value stands in until they have.
     *
     * @return array{host: string, port: int, username: string, folder: string}
     */
    public static function inboundMailbox(): array
    {
        return [
            'host' => (string) Settings::get('inbound_mail.host', (string) config('services.inbound_mail.host')),
            'port' => (int) Settings::get('inbound_mail.port', (int) config('services.inbound_mail.port', 993)),
            'username' => (string) Settings::get('inbound_mail.username', (string) config('services.inbound_mail.username')),
            'folder' => (string) Settings::get('inbound_mail.folder', (string) config('services.inbound_mail.folder', 'INBOX')),
        ];
    }
}