at-container-registry/scanner/internal/config/config.go

// Package config provides Viper-based configuration for the scanner service.
package config

import (
	"fmt"
	"time"

	"github.com/spf13/viper"

	"atcr.io/pkg/config"
)

// Config holds all scanner configuration.
type Config struct {
	Version    string                  `yaml:"version" comment:"Configuration format version."`
	LogLevel   string                  `yaml:"log_level" comment:"Log level: debug, info, warn, error."`
	LogShipper config.LogShipperConfig `yaml:"log_shipper" comment:"Remote log shipping settings."`
	Server     ServerConfig            `yaml:"server" comment:"Health endpoint settings."`
	Hold       HoldConfig              `yaml:"hold" comment:"Hold service connection settings."`
	Scanner    ScannerConfig           `yaml:"scanner" comment:"Worker pool settings."`
	Vuln       VulnConfig              `yaml:"vuln" comment:"Vulnerability scanning (Grype) settings."`
}

// ServerConfig defines the health endpoint settings.
type ServerConfig struct {
	// Listen address for the health endpoint.
	Addr string `yaml:"addr" comment:"Listen address for the health endpoint, e.g. \":9090\"."`
}

// HoldConfig defines the hold service connection.
type HoldConfig struct {
	// WebSocket URL of the hold service.
	URL string `yaml:"url" comment:"WebSocket URL of the hold service (REQUIRED), e.g. \"ws://localhost:8080\"."`

	// Shared secret for scanner authentication.
	Secret string `yaml:"secret" comment:"Shared secret for scanner WebSocket auth (REQUIRED)."`
}

// ScannerConfig defines worker pool settings.
type ScannerConfig struct {
	// Number of concurrent scan workers.
	Workers int `yaml:"workers" comment:"Number of concurrent scan workers."`

	// Maximum priority queue depth.
	QueueSize int `yaml:"queue_size" comment:"Maximum priority queue depth."`

	// Wall-clock budget for one scan job, measured from the moment a worker
	// dequeues it — the same instant the "started" message goes to the hold,
	// so this budget and the hold's scanning timeout measure the same
	// interval.
	//
	// It must stay below the hold's, or the hold reclaims and re-dispatches a
	// job this scanner is still working on. See the comment on
	// scan.holdScanningTimeout.
	JobTimeout time.Duration `yaml:"job_timeout" comment:"Wall-clock budget for one scan job, from the moment a worker picks it up. Must stay BELOW the hold's scanning timeout (10m), or the hold reclaims the job while this scanner is still running it and the image is scanned twice. 0 disables the deadline. Default: 8m."`
}

// VulnConfig defines vulnerability scanning settings.
type VulnConfig struct {
	// Enable Grype vulnerability scanning.
	Enabled bool `yaml:"enabled" comment:"Enable Grype vulnerability scanning."`

	// Directory for the Grype vulnerability database.
	DBPath string `yaml:"db_path" comment:"Directory for the Grype vulnerability database."`

	// Directory for temporary layer extraction.
	TmpDir string `yaml:"tmp_dir" comment:"Directory for temporary layer extraction."`

	// Maximum total compressed image size in bytes. Images exceeding this are skipped. 0 = no limit.
	MaxImageSize int64 `yaml:"max_image_size" comment:"Maximum total compressed image size in bytes. 0 = no limit. Default: 2 GiB."`

	// Age threshold for the startup sweep of tmp_dir. A scan killed mid-flight
	// (a restart, a deploy) never runs its own cleanup, so its layout and
	// extraction directories stay on disk forever; the sweep reclaims the ones
	// older than this. It must stay well above the longest a scan can take, so
	// that a second scanner sharing the directory keeps its live work.
	SweepMaxAge time.Duration `yaml:"sweep_max_age" comment:"Age threshold for the startup sweep of stale scan directories in tmp_dir (scan-*, syft-scan-*, syft-cataloger-*), which a scan interrupted by a restart leaves behind. Must stay above the longest scan so a second scanner sharing the directory keeps its live work. 0 disables the sweep. Default: 1h."`
}

// setScannerDefaults registers all default values on the given Viper instance.
func setScannerDefaults(v *viper.Viper) {
	v.SetDefault("version", "0.1")
	v.SetDefault("log_level", "info")

	// Server defaults
	v.SetDefault("server.addr", ":9090")

	// Hold defaults
	v.SetDefault("hold.url", "")
	v.SetDefault("hold.secret", "")

	// Scanner defaults
	v.SetDefault("scanner.workers", 1)
	v.SetDefault("scanner.queue_size", 100)
	v.SetDefault("scanner.job_timeout", "8m")

	// Vuln defaults
	v.SetDefault("vuln.enabled", true)
	v.SetDefault("vuln.db_path", "/var/lib/atcr-scanner/vulndb")
	v.SetDefault("vuln.tmp_dir", "/var/lib/atcr-scanner/tmp")
	v.SetDefault("vuln.max_image_size", 2*1024*1024*1024) // 2 GiB
	v.SetDefault("vuln.sweep_max_age", "1h")

	// Log shipper defaults
	v.SetDefault("log_shipper.batch_size", 100)
	v.SetDefault("log_shipper.flush_interval", "5s")
}

// DefaultConfig returns a Config populated with all default values (no validation).
func DefaultConfig() *Config {
	v := config.NewViper("SCANNER", "")
	setScannerDefaults(v)

	cfg := &Config{}
	_ = v.Unmarshal(cfg, config.UnmarshalOption())
	return cfg
}

// ExampleYAML returns a fully-commented YAML configuration with default values.
func ExampleYAML() ([]byte, error) {
	return config.MarshalCommentedYAML("ATCR Scanner Configuration", DefaultConfig())
}

// LoadConfig builds a complete configuration using Viper layered loading:
// defaults -> YAML file -> environment variables.
// yamlPath is optional; empty string means env-only (backward compatible).
func LoadConfig(yamlPath string) (*Config, error) {
	v := config.NewViper("SCANNER", yamlPath)
	setScannerDefaults(v)

	cfg := &Config{}
	if err := v.Unmarshal(cfg, config.UnmarshalOption()); err != nil {
		return nil, fmt.Errorf("failed to unmarshal config: %w", err)
	}

	if cfg.Hold.URL == "" {
		return nil, fmt.Errorf("hold.url is required (env: SCANNER_HOLD_URL)")
	}
	if cfg.Hold.Secret == "" {
		return nil, fmt.Errorf("hold.secret is required (env: SCANNER_HOLD_SECRET)")
	}

	return cfg, nil
}