Initial commit: full Phases 1-6 implementation

Post-repair hardware validation pipeline for Proxmox cluster hosts.
Go orchestrator + in-image agent + mkosi live image + bundled dnsmasq
PXE + SQLite + HTMX/SSE UI + notify registry + janitor + full docs.

internal/config/config.go

@@ -0,0 +1,142 @@
+package config
+
+import (
+	"encoding/hex"
+	"fmt"
+	"os"
+
+	"gopkg.in/yaml.v3"
+)
+
+type Config struct {
+	Server     Server     `yaml:"server"`
+	Database   Database   `yaml:"database"`
+	Artifacts  Artifacts  `yaml:"artifacts"`
+	Logs       Logs       `yaml:"logs"`
+	Auth       Auth       `yaml:"auth"`
+	Dispatcher Dispatcher `yaml:"dispatcher"`
+	Janitor    Janitor    `yaml:"janitor"`
+	PXE        PXE        `yaml:"pxe"`
+	Network    Network    `yaml:"network"`
+	Notifiers  []Notifier `yaml:"notifiers"`
+	Routes     []Route    `yaml:"routes"`
+}
+
+type Server struct {
+	Bind      string `yaml:"bind"`
+	PublicURL string `yaml:"public_url"` // user-visible base URL, e.g. https://vetting.lan:8443; used in notification click-throughs
+	TLS       TLS    `yaml:"tls"`
+}
+
+type TLS struct {
+	Enabled  bool   `yaml:"enabled"`
+	CertFile string `yaml:"cert_file"`
+	KeyFile  string `yaml:"key_file"`
+}
+
+type Database struct {
+	Path string `yaml:"path"`
+}
+
+type Artifacts struct {
+	Dir           string `yaml:"dir"`
+	RetentionDays int    `yaml:"retention_days"` // 0 = keep forever
+}
+
+type Logs struct {
+	Dir           string `yaml:"dir"`
+	RetentionDays int    `yaml:"retention_days"` // 0 = keep forever
+}
+
+type Janitor struct {
+	IntervalMinutes int `yaml:"interval_minutes"` // 0 = 60
+}
+
+type Auth struct {
+	AdminPasswordBcrypt string `yaml:"admin_password_bcrypt"`
+	SessionSecretHex    string `yaml:"session_secret_hex"`
+	SessionTTLHours     int    `yaml:"session_ttl_hours"`
+}
+
+func (a Auth) SessionSecret() ([]byte, error) {
+	b, err := hex.DecodeString(a.SessionSecretHex)
+	if err != nil {
+		return nil, fmt.Errorf("session_secret_hex: %w", err)
+	}
+	if len(b) < 32 {
+		return nil, fmt.Errorf("session_secret_hex must decode to at least 32 bytes, got %d", len(b))
+	}
+	return b, nil
+}
+
+type Dispatcher struct {
+	MaxConcurrentRuns int `yaml:"max_concurrent_runs"`
+}
+
+type Network struct {
+	IperfPort int `yaml:"iperf_port"`
+}
+
+// PXE / Notifier / Route are declared up front so the config file is
+// forward-compatible across phases. Phase 1 does not act on these.
+
+type PXE struct {
+	Enabled         bool   `yaml:"enabled"`
+	Interface       string `yaml:"interface"`
+	DHCPRange       string `yaml:"dhcp_range"`
+	OrchestratorURL string `yaml:"orchestrator_url"`
+	TFTPRoot        string `yaml:"tftp_root"` // holds ipxe.efi + undionly.kpxe
+	LiveDir         string `yaml:"live_dir"`  // holds vmlinuz + initrd.img; served at /live
+}
+
+type Notifier struct {
+	Name       string `yaml:"name"`
+	Type       string `yaml:"type"`
+	Topic      string `yaml:"topic,omitempty"`
+	Server     string `yaml:"server,omitempty"`
+	WebhookURL string `yaml:"webhook_url,omitempty"`
+	SMTP       SMTP   `yaml:"smtp,omitempty"`
+}
+
+type SMTP struct {
+	Host string   `yaml:"host,omitempty"`
+	Port int      `yaml:"port,omitempty"`
+	From string   `yaml:"from,omitempty"`
+	To   []string `yaml:"to,omitempty"`
+}
+
+type Route struct {
+	MatchKind     []string `yaml:"match_kind"`
+	MatchSeverity []string `yaml:"match_severity,omitempty"`
+	Notifier      string   `yaml:"notifier"`
+}
+
+func Load(path string) (*Config, error) {
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("read config: %w", err)
+	}
+	var c Config
+	if err := yaml.Unmarshal(b, &c); err != nil {
+		return nil, fmt.Errorf("parse config: %w", err)
+	}
+	if c.Server.Bind == "" {
+		c.Server.Bind = "127.0.0.1:8080"
+	}
+	if c.Database.Path == "" {
+		c.Database.Path = "./var/vetting.db"
+	}
+	if c.Artifacts.Dir == "" {
+		c.Artifacts.Dir = "./var/artifacts"
+	}
+	if c.Logs.Dir == "" {
+		c.Logs.Dir = "./var/logs"
+	}
+	if c.Auth.SessionTTLHours == 0 {
+		c.Auth.SessionTTLHours = 24
+	}
+	if c.Dispatcher.MaxConcurrentRuns == 0 {
+		c.Dispatcher.MaxConcurrentRuns = 3
+	}
+	return &c, nil
+}