environment-config.json

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "title": "EnvironmentCreationConfig",
  "description": "Configuration for creating a deployment environment\n\nThis is the top-level configuration object that contains all information\nneeded to create a new deployment environment. It deserializes from JSON\nconfiguration and provides type-safe conversion to domain parameters.\n\n# Examples\n\n```rust\nuse torrust_tracker_deployer_lib::application::command_handlers::create::config::{\n    EnvironmentCreationConfig, EnvironmentSection, ProviderSection, LxdProviderSection\n};\n\nlet json = r#\"{\n    \"environment\": {\n        \"name\": \"dev\"\n    },\n    \"ssh_credentials\": {\n        \"private_key_path\": \"fixtures/testing_rsa\",\n        \"public_key_path\": \"fixtures/testing_rsa.pub\"\n    },\n    \"provider\": {\n        \"provider\": \"lxd\",\n        \"profile_name\": \"torrust-profile-dev\"\n    },\n    \"tracker\": {\n        \"core\": {\n            \"database\": {\n                \"driver\": \"sqlite3\",\n                \"database_name\": \"tracker.db\"\n            },\n            \"private\": false\n        },\n        \"udp_trackers\": [\n            {\n                \"bind_address\": \"0.0.0.0:6969\"\n            }\n        ],\n        \"http_trackers\": [\n            {\n                \"bind_address\": \"0.0.0.0:7070\"\n            }\n        ],\n        \"http_api\": {\n            \"bind_address\": \"0.0.0.0:1212\",\n            \"admin_token\": \"MyAccessToken\"\n        },\n        \"health_check_api\": {\n            \"bind_address\": \"127.0.0.1:1313\"\n        }\n    },\n    \"prometheus\": {\n        \"scrape_interval_in_secs\": 15\n    },\n    \"grafana\": {\n        \"admin_user\": \"admin\",\n        \"admin_password\": \"admin\"\n    },\n    \"backup\": {\n        \"schedule\": \"0 3 * * *\",\n        \"retention_days\": 7\n    }\n}\"#;\n\nlet config: EnvironmentCreationConfig = serde_json::from_str(json)?;\n# Ok::<(), Box<dyn std::error::Error>>(())\n```",
  "type": "object",
  "properties": {
    "backup": {
      "description": "Backup configuration (optional)\n\nWhen present, automated backups will be configured for the tracker\ndatabase and other persistent data.\n\nUses `BackupSection` for JSON parsing with String primitives (cron schedule).\nConverted to domain `BackupConfig` via `TryInto<EnvironmentParams>`.\n\nDefault schedule: 3:00 AM daily (\"0 3 * * *\")\nDefault retention: 7 days",
      "anyOf": [
        {
          "$ref": "#/$defs/BackupSection"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "environment": {
      "description": "Environment-specific settings",
      "$ref": "#/$defs/EnvironmentSection"
    },
    "grafana": {
      "description": "Grafana dashboard configuration (optional)\n\nWhen present, Grafana will be deployed for visualization.\n**Requires Prometheus to be configured** - Grafana depends on\nPrometheus as its data source.\n\nUses `GrafanaSection` for JSON parsing with String primitives.\nConverted to domain `GrafanaConfig` via `TryInto<EnvironmentParams>`.",
      "anyOf": [
        {
          "$ref": "#/$defs/GrafanaSection"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "https": {
      "description": "HTTPS configuration (optional)\n\nWhen present, enables HTTPS for services that have TLS configured.\nContains common settings like admin email for Let's Encrypt.\n\n**Required if any service has TLS configured** - The `admin_email`\nis needed for Let's Encrypt certificate management.\n\nUses `HttpsSection` for JSON parsing.",
      "anyOf": [
        {
          "$ref": "#/$defs/HttpsSection"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "prometheus": {
      "description": "Prometheus monitoring configuration (optional)\n\nWhen present, Prometheus will be deployed to monitor the tracker.\nUses `PrometheusSection` for JSON parsing with String primitives.\nConverted to domain `PrometheusConfig` via `TryInto<EnvironmentParams>`.",
      "anyOf": [
        {
          "$ref": "#/$defs/PrometheusSection"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "provider": {
      "description": "Provider-specific configuration (LXD, Hetzner, etc.)\n\nUses `ProviderSection` for JSON parsing with raw primitives.\nConverted to domain `ProviderConfig` via `TryInto<EnvironmentParams>`.",
      "$ref": "#/$defs/ProviderSection"
    },
    "ssh_credentials": {
      "description": "SSH credentials configuration",
      "$ref": "#/$defs/SshCredentialsConfig"
    },
    "tracker": {
      "description": "Tracker deployment configuration\n\nUses `TrackerSection` for JSON parsing with String primitives.\nConverted to domain `TrackerConfig` via `TryInto<EnvironmentParams>`.",
      "$ref": "#/$defs/TrackerSection"
    }
  },
  "required": [
    "environment",
    "ssh_credentials",
    "provider",
    "tracker"
  ],
  "$defs": {
    "BackupSection": {
      "description": "Backup configuration section (DTO)\n\nOptional configuration for automated backups. If present, backup support\nis enabled with the specified schedule and retention policy.\n\n# Examples\n\n```json\n{\n    \"schedule\": \"0 3 * * *\",\n    \"retention_days\": 7\n}\n```\n\nAll fields have defaults, so you can enable backup with minimal config:\n\n```json\n{\n    \"backup\": {}\n}\n```",
      "type": "object",
      "properties": {
        "retention_days": {
          "description": "Number of days to retain backups before automatic deletion\n\nDefault: 7 days\n\nMust be greater than 0.",
          "type": "integer",
          "format": "uint32",
          "default": 7,
          "minimum": 0
        },
        "schedule": {
          "description": "Cron schedule for backups (5-field format: minute hour day month weekday)\n\nDefault: \"0 3 * * *\" (3:00 AM daily)\n\nExamples:\n- \"0 3 * * *\" - 3:00 AM daily\n- \"0 */6 * * *\" - Every 6 hours\n- \"0 0 * * 0\" - Midnight every Sunday",
          "type": "string",
          "default": "0 3 * * *"
        }
      }
    },
    "DatabaseSection": {
      "description": "Database configuration section (application DTO)\n\nMirrors the domain `DatabaseConfig` enum but at the application layer.\nSupports both `SQLite` and `MySQL` database backends.\n\n# Examples\n\n```json\n{\n  \"driver\": \"sqlite3\",\n  \"database_name\": \"tracker.db\"\n}\n```\n\n```json\n{\n  \"driver\": \"mysql\",\n  \"host\": \"localhost\",\n  \"port\": 3306,\n  \"database_name\": \"tracker\",\n  \"username\": \"tracker_user\",\n  \"password\": \"secure_password\"\n}\n```",
      "oneOf": [
        {
          "description": "`SQLite` file-based database",
          "type": "object",
          "properties": {
            "database_name": {
              "description": "Database file name",
              "type": "string"
            },
            "driver": {
              "type": "string",
              "const": "sqlite3"
            }
          },
          "required": [
            "driver",
            "database_name"
          ]
        },
        {
          "description": "`MySQL` server-based database",
          "type": "object",
          "properties": {
            "database_name": {
              "description": "Database name",
              "type": "string"
            },
            "driver": {
              "type": "string",
              "const": "mysql"
            },
            "host": {
              "description": "`MySQL` server host",
              "type": "string"
            },
            "password": {
              "description": "Database password (plain text during DTO serialization/deserialization)\n\nUses `PlainPassword` type alias to explicitly mark this as a temporarily visible secret.\nConverted to secure `Password` type in `to_database_config()` at the DTO-to-domain boundary.",
              "type": "string"
            },
            "port": {
              "description": "`MySQL` server port",
              "type": "integer",
              "format": "uint16",
              "maximum": 65535,
              "minimum": 0
            },
            "username": {
              "description": "Database username",
              "type": "string"
            },
            "root_password": {
              "description": "Optional `MySQL` root password\n\nWhen provided, used as `MYSQL_ROOT_PASSWORD` in the rendered `.env` file.\nWhen absent, a cryptographically random password is generated at render time.\nNever set this to the same value as `password` in production environments.",
              "type": [
                "string",
                "null"
              ],
              "default": null
            }
          },
          "required": [
            "driver",
            "host",
            "port",
            "database_name",
            "username",
            "password"
          ]
        }
      ]
    },
    "EnvironmentSection": {
      "description": "Environment-specific configuration section\n\nContains configuration specific to the environment being created.",
      "type": "object",
      "properties": {
        "description": {
          "description": "Optional description of the environment\n\nFree-text field (2-3 sentences recommended) describing:\n- Use case: What this environment is designed for\n- Key decisions: Why certain values were chosen\n- Context: When this environment is appropriate\n\nThis field is primarily used for documentation and AI agent training\nto provide context about environment intent and design decisions.\n\n# Examples\n\n```text\n\"Minimal development setup with SQLite and UDP/HTTP trackers.\n No HTTPS or monitoring. Ideal for local testing.\"\n```",
          "type": [
            "string",
            "null"
          ],
          "default": null
        },
        "instance_name": {
          "description": "Optional custom instance name for the VM/container\n\nIf not provided, auto-generated as `torrust-tracker-vm-{env_name}`.\nWhen provided, must follow instance naming rules:\n- 1-63 characters\n- ASCII letters, numbers, and dashes only\n- Cannot start with digit or dash\n- Cannot end with dash",
          "type": [
            "string",
            "null"
          ],
          "default": null
        },
        "name": {
          "description": "Name of the environment to create\n\nMust follow environment naming rules:\n- Lowercase letters and numbers only\n- Dashes as word separators\n- Cannot start or end with separators\n- Cannot start with numbers",
          "type": "string"
        }
      },
      "required": [
        "name"
      ]
    },
    "GrafanaSection": {
      "description": "Grafana configuration section (DTO)\n\nThis is a DTO that deserializes from JSON strings and validates\nwhen converting to the domain `GrafanaConfig`.\n\n# Security\n\nThe `admin_password` field uses `PlainPassword` type alias for string at\nDTO boundaries. It will be converted to `Password` (secrecy-wrapped) in\nthe domain layer.\n\n# Examples\n\n```json\n{\n    \"admin_user\": \"admin\",\n    \"admin_password\": \"admin\"\n}\n```\n\nWith TLS proxy configuration:\n```json\n{\n    \"admin_user\": \"admin\",\n    \"admin_password\": \"admin\",\n    \"domain\": \"grafana.example.com\",\n    \"use_tls_proxy\": true\n}\n```",
      "type": "object",
      "properties": {
        "admin_password": {
          "description": "Grafana admin password (plain string at DTO boundary)\n\nThis will be converted to `Password` type in the domain layer\nto prevent accidental exposure in logs or debug output.",
          "type": "string"
        },
        "admin_user": {
          "description": "Grafana admin username",
          "type": "string"
        },
        "domain": {
          "description": "Domain name for external HTTPS access (optional)\n\nWhen present, defines the domain at which Grafana will be accessible.\nCaddy uses this for automatic certificate management.",
          "type": [
            "string",
            "null"
          ]
        },
        "use_tls_proxy": {
          "description": "Whether to use TLS proxy via Caddy (default: false)\n\nWhen true:\n- Caddy handles HTTPS termination with automatic certificates\n- Requires a domain to be configured\n- Grafana is accessed via HTTPS through Caddy",
          "type": [
            "boolean",
            "null"
          ]
        }
      },
      "required": [
        "admin_user",
        "admin_password"
      ]
    },
    "HealthCheckApiSection": {
      "type": "object",
      "properties": {
        "bind_address": {
          "type": "string"
        },
        "domain": {
          "description": "Domain name for HTTPS access via Caddy reverse proxy\n\nWhen present with `use_tls_proxy: true`, this service will be accessible\nvia HTTPS at this domain. The domain will be used for Let's Encrypt\ncertificate acquisition.",
          "type": [
            "string",
            "null"
          ]
        },
        "use_tls_proxy": {
          "description": "Whether to proxy this service through Caddy with TLS termination\n\nWhen `true`, the service will be accessible via HTTPS through Caddy.\nRequires `domain` to be set.\nThis is useful for exposing health checks to external monitoring systems.",
          "type": [
            "boolean",
            "null"
          ]
        }
      },
      "required": [
        "bind_address"
      ]
    },
    "HetznerProviderSection": {
      "description": "Hetzner-specific configuration section\n\nUses raw `String` fields for JSON deserialization. Convert to domain\n`HetznerConfig` via `ProviderSection::to_provider_config()`.\n\n# Examples\n\n```rust\nuse torrust_tracker_deployer_lib::application::command_handlers::create::config::HetznerProviderSection;\n\nlet section = HetznerProviderSection {\n    api_token: \"your-api-token\".to_string(),\n    server_type: \"cx22\".to_string(),\n    location: \"nbg1\".to_string(),\n    image: \"ubuntu-24.04\".to_string(),\n};\n```",
      "type": "object",
      "properties": {
        "api_token": {
          "description": "Hetzner API token in plain text format (DTO layer).\n\nThis uses [`PlainApiToken`] to mark it as a transparent secret during\ndeserialization. Convert to domain `ApiToken` at the DTO-to-domain boundary.",
          "type": "string"
        },
        "image": {
          "description": "Hetzner server image (e.g., \"ubuntu-24.04\", \"ubuntu-22.04\", \"debian-12\").",
          "type": "string"
        },
        "location": {
          "description": "Hetzner datacenter location (e.g., \"fsn1\", \"nbg1\", \"hel1\").",
          "type": "string"
        },
        "server_type": {
          "description": "Hetzner server type (e.g., \"cx22\", \"cx32\", \"cpx11\").",
          "type": "string"
        }
      },
      "required": [
        "api_token",
        "server_type",
        "location",
        "image"
      ]
    },
    "HttpApiSection": {
      "description": "HTTP API configuration section (Application DTO)\n\nThis is a Data Transfer Object that uses primitive types (`String`) for\nJSON deserialization. It converts to the domain type `HttpApiConfig` via\nthe `TryFrom` trait, which delegates validation to the domain layer.\n\n# Responsibility Split\n\n- **This DTO**: Parse strings into typed values (`SocketAddr`, `DomainName`)\n- **Domain type**: Enforce business invariants (port != 0, TLS requires domain, etc.)\n\n# Usage\n\n```rust\nuse torrust_tracker_deployer_lib::application::command_handlers::create::config::tracker::HttpApiSection;\nuse torrust_tracker_deployer_lib::domain::tracker::HttpApiConfig;\n\nlet section = HttpApiSection {\n    bind_address: \"0.0.0.0:1212\".to_string(),\n    admin_token: \"MyToken\".to_string(),\n    domain: None,\n    use_tls_proxy: None,\n};\n\nlet config: HttpApiConfig = section.try_into()?;\n# Ok::<(), Box<dyn std::error::Error>>(())\n```\n\n# JSON Example\n\n```json\n{\n    \"bind_address\": \"0.0.0.0:1212\",\n    \"admin_token\": \"MyAccessToken\",\n    \"domain\": \"api.example.com\",\n    \"use_tls_proxy\": true\n}\n```",
      "type": "object",
      "properties": {
        "admin_token": {
          "description": "Admin token as plain string (at DTO boundary)\n\nConverted to `ApiToken` (secrecy-wrapped) in domain layer.",
          "type": "string"
        },
        "bind_address": {
          "description": "Bind address as string (e.g., \"0.0.0.0:1212\")\n\nParsed to `SocketAddr` during conversion.",
          "type": "string"
        },
        "domain": {
          "description": "Domain name for HTTPS certificate acquisition\n\nWhen present along with `use_tls_proxy: true`, this service will be\naccessible via HTTPS through the Caddy reverse proxy using this domain.\nThe domain is used for Let's Encrypt certificate acquisition.",
          "type": [
            "string",
            "null"
          ]
        },
        "use_tls_proxy": {
          "description": "Whether to proxy this service through Caddy with TLS termination\n\nWhen `true`:\n- The service is proxied through Caddy with HTTPS enabled\n- `domain` field is required\n- Cannot be used with localhost bind addresses (`127.0.0.1`, `::1`)\n\nWhen `false` or omitted:\n- The service is accessed directly without TLS termination\n- `domain` field is optional (ignored if present)",
          "type": [
            "boolean",
            "null"
          ]
        }
      },
      "required": [
        "bind_address",
        "admin_token"
      ]
    },
    "HttpTrackerSection": {
      "type": "object",
      "properties": {
        "bind_address": {
          "type": "string"
        },
        "domain": {
          "description": "Domain name for HTTPS certificate acquisition\n\nWhen present along with `use_tls_proxy: true`, this HTTP tracker will be\naccessible via HTTPS through the Caddy reverse proxy using this domain.\nThe domain is used for Let's Encrypt certificate acquisition.",
          "type": [
            "string",
            "null"
          ]
        },
        "use_tls_proxy": {
          "description": "Whether to proxy this service through Caddy with TLS termination\n\nWhen `true`:\n- The service is proxied through Caddy with HTTPS enabled\n- `domain` field is required\n- Cannot be used with localhost bind addresses (`127.0.0.1`, `::1`)\n- Implies the tracker's `on_reverse_proxy` should be `true`\n\nWhen `false` or omitted:\n- The service is accessed directly without TLS termination\n- `domain` field is optional (ignored if present)",
          "type": [
            "boolean",
            "null"
          ]
        }
      },
      "required": [
        "bind_address"
      ]
    },
    "HttpsSection": {
      "description": "Common HTTPS configuration (top-level)\n\nContains configuration shared across all TLS-enabled services.\nThis section is required if any service has TLS enabled.\n\n# Let's Encrypt Environments\n\n- **Production** (default): Uses `https://acme-v02.api.letsencrypt.org/directory`\n  - Rate limits: 50 certs/week per domain, 5 duplicates/week\n  - Certificates are trusted by all browsers\n\n- **Staging** (`use_staging: true`): Uses `https://acme-staging-v02.api.letsencrypt.org/directory`\n  - Much higher rate limits for testing\n  - Certificates show browser warnings (not trusted)\n  - Use only for testing the HTTPS flow\n\n# Examples\n\nProduction configuration:\n```json\n{\n    \"https\": {\n        \"admin_email\": \"admin@example.com\"\n    }\n}\n```\n\nStaging configuration (for testing):\n```json\n{\n    \"https\": {\n        \"admin_email\": \"admin@example.com\",\n        \"use_staging\": true\n    }\n}\n```",
      "type": "object",
      "properties": {
        "admin_email": {
          "description": "Admin email for Let's Encrypt certificate notifications\n\nThis email will receive:\n- Certificate expiration warnings (30 days before expiry)\n- Certificate renewal failure notifications\n- Important Let's Encrypt service announcements\n\n**Note**: This email may be publicly visible in certificate transparency logs.",
          "type": "string"
        },
        "use_staging": {
          "description": "Use Let's Encrypt staging environment for testing\n\nWhen `true`:\n- Uses staging CA: `https://acme-staging-v02.api.letsencrypt.org/directory`\n- Certificates will show browser warnings (not trusted by browsers)\n- Higher rate limits allow extensive testing\n\nWhen `false` or omitted (default):\n- Uses production CA: `https://acme-v02.api.letsencrypt.org/directory`\n- Certificates are trusted by all browsers\n- Subject to rate limits (50 certs/week, 5 duplicates/week)",
          "type": "boolean",
          "default": false
        }
      },
      "required": [
        "admin_email"
      ]
    },
    "LxdProviderSection": {
      "description": "LXD-specific configuration section\n\nUses raw `String` for JSON deserialization. Convert to domain `LxdConfig`\nvia `ProviderSection::to_provider_config()`.\n\n# Examples\n\n```rust\nuse torrust_tracker_deployer_lib::application::command_handlers::create::config::LxdProviderSection;\n\nlet section = LxdProviderSection {\n    profile_name: \"torrust-profile-dev\".to_string(),\n};\n```",
      "type": "object",
      "properties": {
        "profile_name": {
          "description": "LXD profile name (raw string - validated on conversion).",
          "type": "string"
        }
      },
      "required": [
        "profile_name"
      ]
    },
    "PrometheusSection": {
      "description": "Prometheus configuration section (DTO)\n\nThis is a simple DTO that deserializes from JSON numbers and validates\nwhen converting to the domain `PrometheusConfig`.\n\n# Examples\n\n```json\n{\n    \"scrape_interval_in_secs\": 15\n}\n```",
      "type": "object",
      "properties": {
        "scrape_interval_in_secs": {
          "description": "Interval for Prometheus to scrape metrics from targets (in seconds)\n\nMust be greater than 0. The Prometheus template adds the 's' suffix.\nExamples: 15 (15 seconds), 30 (30 seconds), 60 (1 minute)",
          "type": "integer",
          "format": "uint32",
          "minimum": 0
        }
      },
      "required": [
        "scrape_interval_in_secs"
      ]
    },
    "ProviderSection": {
      "description": "Provider-specific configuration section\n\nEach variant contains the configuration fields specific to that provider\nusing **raw primitives** (`String`) for JSON deserialization.\n\nThis is a tagged enum that deserializes based on the `\"provider\"` field in JSON.\n\n# Conversion\n\nUse `try_into()` or `ProviderConfig::try_from()` to validate and convert to domain types.\n\n# Examples\n\n```rust\nuse torrust_tracker_deployer_lib::application::command_handlers::create::config::{\n    ProviderSection, LxdProviderSection\n};\nuse torrust_tracker_deployer_lib::domain::provider::ProviderConfig;\nuse std::convert::TryInto;\n\nlet section = ProviderSection::Lxd(LxdProviderSection {\n    profile_name: \"torrust-profile-dev\".to_string(),\n});\n\nlet config: ProviderConfig = section.try_into().unwrap();\nassert_eq!(config.provider_name(), \"lxd\");\n```",
      "oneOf": [
        {
          "description": "LXD provider configuration",
          "type": "object",
          "properties": {
            "provider": {
              "type": "string",
              "const": "lxd"
            }
          },
          "$ref": "#/$defs/LxdProviderSection",
          "required": [
            "provider"
          ]
        },
        {
          "description": "Hetzner provider configuration",
          "type": "object",
          "properties": {
            "provider": {
              "type": "string",
              "const": "hetzner"
            }
          },
          "$ref": "#/$defs/HetznerProviderSection",
          "required": [
            "provider"
          ]
        }
      ]
    },
    "SshCredentialsConfig": {
      "description": "SSH credentials configuration for remote instance authentication\n\nThis is a configuration-layer value object that uses strings for paths\nand username. It is distinct from `adapters::ssh::SshCredentials` which\nuses domain types (`PathBuf`, `Username`).\n\n# Examples\n\n```no_run\nuse torrust_tracker_deployer_lib::application::command_handlers::create::config::SshCredentialsConfig;\n\nlet config = SshCredentialsConfig {\n    private_key_path: \"fixtures/testing_rsa\".to_string(),\n    public_key_path: \"fixtures/testing_rsa.pub\".to_string(),\n    username: \"torrust\".to_string(),\n    port: 22,\n};\n```",
      "type": "object",
      "properties": {
        "port": {
          "description": "SSH port for remote connections\n\nDefaults to 22 (standard SSH port) if not specified in configuration.",
          "type": "integer",
          "format": "uint16",
          "default": 22,
          "maximum": 65535,
          "minimum": 0
        },
        "private_key_path": {
          "description": "Path to the SSH private key file (as string in config)",
          "type": "string"
        },
        "public_key_path": {
          "description": "Path to the SSH public key file (as string in config)",
          "type": "string"
        },
        "username": {
          "description": "SSH username (as string in config)\n\nDefaults to \"torrust\" if not specified in configuration.",
          "type": "string",
          "default": "torrust"
        }
      },
      "required": [
        "private_key_path",
        "public_key_path"
      ]
    },
    "TrackerCoreSection": {
      "description": "Tracker core configuration section (application DTO)\n\nContains core tracker settings like database and privacy mode.\n\n# Examples\n\n```json\n{\n  \"database\": {\n    \"driver\": \"sqlite3\",\n    \"database_name\": \"tracker.db\"\n  },\n  \"private\": false\n}\n```",
      "type": "object",
      "properties": {
        "database": {
          "description": "Database configuration",
          "$ref": "#/$defs/DatabaseSection"
        },
        "private": {
          "description": "Privacy mode: true for private tracker, false for public",
          "type": "boolean"
        }
      },
      "required": [
        "database",
        "private"
      ]
    },
    "TrackerSection": {
      "description": "Tracker configuration section (application DTO)\n\nAggregates all tracker configuration sections: core, UDP trackers,\nHTTP trackers, and HTTP API.\n\n# Examples\n\n```json\n{\n  \"core\": {\n    \"database\": {\n      \"driver\": \"sqlite3\",\n      \"database_name\": \"tracker.db\"\n    },\n    \"private\": false\n  },\n  \"udp_trackers\": [\n    { \"bind_address\": \"0.0.0.0:6969\" }\n  ],\n  \"http_trackers\": [\n    { \"bind_address\": \"0.0.0.0:7070\" }\n  ],\n  \"http_api\": {\n    \"bind_address\": \"0.0.0.0:1212\",\n    \"admin_token\": \"MyAccessToken\"\n  },\n  \"health_check_api\": {\n    \"bind_address\": \"127.0.0.1:1313\"\n  }\n}\n```",
      "type": "object",
      "properties": {
        "core": {
          "description": "Core tracker configuration (database, privacy mode)",
          "$ref": "#/$defs/TrackerCoreSection"
        },
        "health_check_api": {
          "description": "Health Check API configuration",
          "$ref": "#/$defs/HealthCheckApiSection"
        },
        "http_api": {
          "description": "HTTP API configuration",
          "$ref": "#/$defs/HttpApiSection"
        },
        "http_trackers": {
          "description": "HTTP tracker instances",
          "type": "array",
          "items": {
            "$ref": "#/$defs/HttpTrackerSection"
          }
        },
        "udp_trackers": {
          "description": "UDP tracker instances",
          "type": "array",
          "items": {
            "$ref": "#/$defs/UdpTrackerSection"
          }
        }
      },
      "required": [
        "core",
        "udp_trackers",
        "http_trackers",
        "http_api",
        "health_check_api"
      ]
    },
    "UdpTrackerSection": {
      "type": "object",
      "properties": {
        "bind_address": {
          "type": "string"
        },
        "domain": {
          "description": "Domain name for the UDP tracker (optional)\n\nWhen present, this domain can be used in announce URLs instead of the IP.\nExample: `udp://tracker.example.com:6969/announce`\n\nNote: Unlike HTTP trackers, UDP does not support TLS, so there is no\n`use_tls_proxy` field for UDP trackers.",
          "type": [
            "string",
            "null"
          ]
        }
      },
      "required": [
        "bind_address"
      ]
    }
  }
}