Add Config structure, TOML parser, and tests for zocket configuration

src/config/config.zig

@@ -0,0 +1,30 @@
+const Config = @import("models.zig").Config;
+
+const std  = @import("std");
+const toml = @import("toml");
+
+pub fn parse(io: std.Io, allocator: std.mem.Allocator, path: []const u8) !toml.Parsed(Config)
+{
+    var parser = toml.Parser(Config).init(allocator);
+    defer parser.deinit();
+
+    return parser.parseFile(io,path);
+}
+
+test "parse zocket config"
+{
+    var threaded: std.Io.Threaded = .init(std.testing.allocator, .{});
+    defer threaded.deinit();
+    const io = threaded.io();
+
+    const allocator = std.testing.allocator;
+
+    const parsed = try parse(io, allocator, "zocket/config.toml");
+    defer parsed.deinit();
+
+    const cfg = parsed.value;
+    try std.testing.expectEqualStrings("node-01", cfg.node.id);
+    try std.testing.expect(cfg.listen.client.enabled);
+    try std.testing.expectEqual(@as(usize, 1), cfg.mesh.peers.len);
+    try std.testing.expectEqualStrings("node-02", cfg.mesh.peers[0].id);
+}

src/config/models.zig

@@ -0,0 +1,209 @@
+const std  = @import("std");
+const toml = @import("toml");
+
+//
+
+pub const Config = struct {
+    node:    Node, 
+    log:     Log     = .{},
+    listen:  Listen  = .{},
+    mesh:    Mesh    = .{},
+    metrics: Metrics = .{},
+};
+
+//
+
+/// Per-instance identity. Intentionally has no defaults - id/data_dir/private_key
+/// are meaningless without a concrete deployment behind them.
+pub const Node = struct {
+    id:          []const u8,
+    data_dir:    []const u8,
+    private_key: []const u8, // ed25519; auto-generated on first run if missing
+};
+
+pub const LogLevel = enum {
+    debug,
+    info,
+    warn,
+    @"error",
+};
+
+pub const LogFormat = enum {
+    json,
+    text,
+};
+
+pub const Log = struct {
+    level:  LogLevel   = .info,
+    format: LogFormat  = .json,
+    output: []const u8 = "stdout", // or "/path/to/file.log"
+};
+
+pub const Listen = struct {
+    client: ListenClient = .{},
+    peer:   ListenPeer   = .{},
+};
+
+pub const ListenClient = struct {
+    enabled:        bool          = true,
+    bind:           []const u8    = "0.0.0.0:8080",
+    tls:            ClientTls     = .{},
+    auth:           ClientAuth    = .{},
+    access_control: AccessControl = .{},
+    limits:         ClientLimits  = .{},
+};
+
+pub const ClientTls = struct {
+    enabled: bool       = false,
+    cert:    []const u8 = "/etc/zocket/client.crt",
+    key:     []const u8 = "/etc/zocket/client.key",
+};
+
+pub const ClientAuthMode = enum {
+    none,  // clients self-declare their client_id
+    token, // client_id is derived from the matched identity below
+};
+
+pub const ClientAuth = struct {
+    mode:       ClientAuthMode = .token,
+    identities: []Identity     = &[_]Identity{},
+};
+
+/// A single client credential. No defaults as each identity is a distinct
+/// (id, token) pair that must be explicitly provisioned.
+pub const Identity = struct {
+    id:    []const u8,
+    token: []const u8,
+};
+
+/// Shared by listen.client.access_control and listen.peer.access_control.
+pub const AccessControlMode = enum {
+    allowlist,
+    blocklist,
+    disabled,
+};
+
+pub const AccessControl = struct {
+    mode: AccessControlMode = .allowlist,
+    list: [][]const u8      = &[_][]const u8{}, // IP | CIDR entries
+};
+
+pub const ClientLimits = struct {
+    max_message_bytes:  i64        = 65536,
+    max_frame_bytes:    i64        = 65536,
+    idle_timeout_secs:  i64        = 300,
+    ping_interval_secs: i64        = 30,
+    max_missed_pongs:   i64        = 2,
+    max_connections:    i64        = 256,
+    rate_limit:         RateLimit  = .{},
+};
+
+pub const RateLimit = struct {
+    enabled:          bool = true,
+    messages_per_sec: i64  = 50,
+    burst:            i64  = 100,
+};
+
+pub const ListenPeer = struct {
+    enabled:        bool          = true,
+    bind:           []const u8    = "0.0.0.0:8181",
+    tls:            PeerTls       = .{},
+    auth:           PeerAuth      = .{},
+    access_control: AccessControl = .{},
+    limits:         PeerLimits    = .{},
+};
+
+pub const PeerTls = struct {
+    enabled:             bool       = false,
+    cert:                []const u8 = "/etc/zocket/peer.crt",
+    key:                 []const u8 = "/etc/zocket/peer.key",
+    require_client_cert: bool       = false,
+};
+
+pub const PeerAuthMode = enum {
+    pubkey, // only supported mode: signed-nonce challenge, never a shared secret
+};
+
+pub const PeerAuth = struct {
+    mode: PeerAuthMode = .pubkey,
+};
+
+pub const PeerLimits = struct {
+    max_message_bytes:  i64 = 1048576,
+    idle_timeout_secs:  i64 = 60,
+    ping_interval_secs: i64 = 15,
+};
+
+pub const MeshTopology = enum {
+    full,
+    @"static-partial",
+    disabled,
+};
+
+pub const RoutingMode = enum {
+    gossip,
+    reactive,
+    static,
+};
+
+pub const Mesh = struct {
+    enabled:         bool            = true,
+    topology:        MeshTopology    = .full,
+    routing_mode:    RoutingMode     = .gossip,
+    discoverability: Discoverability = .{},
+    peers:           []MeshPeer      = &[_]MeshPeer{},
+    trust:           Trust           = .{},
+    gossip:          Gossip          = .{},
+    broadcast:       Broadcast       = .{},
+    reactive:        Reactive        = .{},
+};
+
+pub const DiscoverabilityMode = enum {
+    // mesh.peers is the complete, manually-maintained set of instances.
+    static,
+    // mesh.peers is just the initial seed; unknown nodes may connect and
+    // prove possession of a pubkey, then get auto-trusted and gossiped
+    // mesh-wide. listen.peer.access_control is the real gate in this mode.
+    broadcast,
+};
+
+pub const Discoverability = struct {
+    mode: DiscoverabilityMode = .static,
+};
+
+/// A statically-pinned peer. No defaults for id/addr/pubkey as pinning a
+/// peer's identity is the entire point, so these must be explicit.
+pub const MeshPeer = struct {
+    id:             []const u8,
+    addr:           []const u8,
+    pubkey:         []const u8,
+    reconnect:      bool = true,
+    backoff_min_ms: i64  = 500,
+    backoff_max_ms: i64  = 30000,
+};
+
+pub const Trust = struct {
+    gossip_new_peers: bool = true, // propagate newly-enrolled peer identities mesh-wide
+};
+
+pub const Gossip = struct {
+    seen_cache_ttl_secs: i64 = 300,
+    route_ttl_secs:      i64 = 0, // 0 = no expiry, rely on explicit ROUTE_REMOVE
+};
+
+pub const Broadcast = struct {
+    // Peer-only (target = "*"); never exposed to clients on listen.client.
+    enabled: bool = true,
+};
+
+pub const Reactive = struct {
+    // Only used when mesh.routing_mode = .reactive.
+    query_ttl_hops:      i64 = 4,
+    query_timeout_ms:    i64 = 2000,
+    negative_cache_secs: i64 = 30,
+};
+
+pub const Metrics = struct {
+    enabled: bool       = true,
+    bind:    []const u8 = "127.0.0.1:9090", // prometheus format
+};

src/main.zig

@@ -1,8 +1,7 @@
-const std = @import("std");
-const Io = std.Io;
-
 const zocket = @import("zocket");
 
+const std = @import("std");
+
 pub fn main(init: std.process.Init) !void
 {
     _ = init;

src/root.zig

@@ -1 +1,6 @@
 const std = @import("std");
+pub const config = @import("config/config.zig");
+
+test {
+    _ = config;
+}