clearer idea?

wakey-control-plane/src/config/init.rs

@@ -50,7 +50,7 @@ pub fn write_init_config(args: &InitConfigArgs) -> Result<()> {
         command_timeout_ms: args.command_timeout_ms.unwrap_or(30_000).max(1),
         enroll_token_ttl_seconds: args.enroll_token_ttl_seconds.unwrap_or(86_400).max(1),
         pid_file,
-        enroll_tokens: args.enroll_tokens.clone(),
+        bootstrap_enroll_tokens: args.bootstrap_enroll_tokens.clone(),
         telemetry: WritableTelemetry {
             otlp_endpoint: args.telemetry_otlp_endpoint.clone(),
             service_name: args
@@ -86,7 +86,7 @@ pub fn bootstrap_config_if_missing(args: &ServeArgs) -> Result<bool> {
         pid_file: args.pid_file.clone(),
         command_timeout_ms: args.command_timeout_ms,
         enroll_token_ttl_seconds: args.enroll_token_ttl_seconds,
-        enroll_tokens: args.enroll_tokens.clone(),
+        bootstrap_enroll_tokens: args.bootstrap_enroll_tokens.clone(),
         telemetry_otlp_endpoint: None,
         telemetry_service_name: None,
         telemetry_json_logs: false,

wakey-control-plane/src/config/mod.rs

@@ -4,8 +4,7 @@ mod types;
 
 pub use init::{bootstrap_config_if_missing, write_init_config};
 pub use resolve::{
-    issue_token_endpoint, normalize_public_url, resolve_issue_token_settings,
-    resolve_list_enroll_token_settings, resolve_revoke_enroll_token_settings,
-    resolve_state_stats_settings,
+    issue_token_endpoint, resolve_issue_token_settings, resolve_list_enroll_token_settings,
+    resolve_revoke_enroll_token_settings, resolve_state_stats_settings,
 };
 pub use types::{DaemonConfig, TelemetryConfig};

wakey-control-plane/src/config/resolve.rs

@@ -5,7 +5,8 @@ use std::time::Duration;
 use anyhow::{Context, Result};
 
 use crate::cli::{
-    IssueEnrollTokenArgs, ListEnrollTokensArgs, RevokeEnrollTokenArgs, ServeArgs, StateStatsArgs,
+    AdminTargetArgs, IssueEnrollTokenArgs, ListEnrollTokensArgs, RevokeEnrollTokenArgs, ServeArgs,
+    StateStatsArgs,
 };
 use crate::config::types::{
     DaemonConfig, FileConfig, FileTelemetryConfig, IssueTokenSettings, StateAccessSettings,
@@ -72,10 +73,10 @@ impl DaemonConfig {
             .unwrap_or_else(|| PathBuf::from("wakey-control-plane.pid"));
         let pid_file = resolve_path(&data_dir, pid_file_raw);
 
-        let enroll_tokens = if args.enroll_tokens.is_empty() {
-            file.enroll_tokens.unwrap_or_default()
+        let bootstrap_enroll_tokens = if args.bootstrap_enroll_tokens.is_empty() {
+            file.bootstrap_enroll_tokens.unwrap_or_default()
         } else {
-            args.enroll_tokens.clone()
+            args.bootstrap_enroll_tokens.clone()
         };
 
         let telemetry = resolve_telemetry(file.telemetry);
@@ -88,7 +89,7 @@ impl DaemonConfig {
             command_timeout,
             enroll_token_ttl,
             pid_file,
-            enroll_tokens,
+            bootstrap_enroll_tokens,
             telemetry,
         })
     }
@@ -120,6 +121,7 @@ pub fn resolve_issue_token_settings(args: &IssueEnrollTokenArgs) -> Result<Issue
         args.data_dir.clone(),
         args.state_file.clone(),
         args.public_url.clone(),
+        &args.target,
     )?;
 
     let ttl = Duration::from_secs(
@@ -132,6 +134,7 @@ pub fn resolve_issue_token_settings(args: &IssueEnrollTokenArgs) -> Result<Issue
     Ok(IssueTokenSettings {
         data_dir: state.data_dir,
         state_file: state.state_file,
+        public_url: state.public_url,
         ttl,
     })
 }
@@ -144,6 +147,7 @@ pub fn resolve_list_enroll_token_settings(
         args.data_dir.clone(),
         args.state_file.clone(),
         args.public_url.clone(),
+        &args.target,
     )
 }
 
@@ -155,6 +159,7 @@ pub fn resolve_revoke_enroll_token_settings(
         args.data_dir.clone(),
         args.state_file.clone(),
         args.public_url.clone(),
+        &args.target,
     )
 }
 
@@ -164,6 +169,7 @@ pub fn resolve_state_stats_settings(args: &StateStatsArgs) -> Result<StateAccess
         args.data_dir.clone(),
         args.state_file.clone(),
         args.public_url.clone(),
+        &args.target,
     )
 }
 
@@ -178,6 +184,19 @@ pub(crate) fn load_file_config(path: &Path) -> Result<FileConfig> {
         .with_context(|| format!("failed to parse config file {}", path.display()))
 }
 
+fn resolve_admin_public_url(
+    mode: &AdminTargetArgs,
+    config_public_url: Option<String>,
+) -> Result<Option<String>> {
+    match (mode.live, mode.offline) {
+        (true, false) => config_public_url
+            .ok_or_else(|| anyhow::anyhow!("--live requires --public-url or a configured public_url"))
+            .map(Some),
+        (false, true) => Ok(None),
+        _ => Ok(config_public_url),
+    }
+}
+
 fn resolve_telemetry(file: Option<FileTelemetryConfig>) -> TelemetryConfig {
     let mut out = TelemetryConfig::default();
     if let Some(file) = file {
@@ -205,6 +224,7 @@ fn resolve_state_access(
     cli_data_dir: Option<PathBuf>,
     cli_state_file: Option<PathBuf>,
     cli_public_url: Option<String>,
+    mode: &AdminTargetArgs,
 ) -> Result<StateAccessSettings> {
     let file = load_file_config(config_file)?;
 
@@ -219,9 +239,10 @@ fn resolve_state_access(
             .unwrap_or_else(|| PathBuf::from("state.db")),
     );
 
-    let public_url = cli_public_url
+    let resolved_public_url = cli_public_url
         .or(file.public_url)
         .map(|url| normalize_public_url(&url));
+    let public_url = resolve_admin_public_url(mode, resolved_public_url)?;
 
     Ok(StateAccessSettings {
         data_dir,

wakey-control-plane/src/config/types.rs

@@ -13,7 +13,7 @@ pub struct DaemonConfig {
     pub command_timeout: Duration,
     pub enroll_token_ttl: Duration,
     pub pid_file: PathBuf,
-    pub enroll_tokens: Vec<String>,
+    pub bootstrap_enroll_tokens: Vec<String>,
     pub telemetry: TelemetryConfig,
 }
 
@@ -43,7 +43,8 @@ pub(crate) struct FileConfig {
     pub(crate) command_timeout_ms: Option<u64>,
     pub(crate) enroll_token_ttl_seconds: Option<u64>,
     pub(crate) pid_file: Option<PathBuf>,
-    pub(crate) enroll_tokens: Option<Vec<String>>,
+    #[serde(alias = "enroll_tokens")]
+    pub(crate) bootstrap_enroll_tokens: Option<Vec<String>>,
     pub(crate) telemetry: Option<FileTelemetryConfig>,
 }
 
@@ -64,7 +65,7 @@ pub(crate) struct WritableConfig {
     pub(crate) enroll_token_ttl_seconds: u64,
     pub(crate) pid_file: PathBuf,
     #[serde(skip_serializing_if = "Vec::is_empty")]
-    pub(crate) enroll_tokens: Vec<String>,
+    pub(crate) bootstrap_enroll_tokens: Vec<String>,
     pub(crate) telemetry: WritableTelemetry,
 }
 
@@ -79,6 +80,7 @@ pub(crate) struct WritableTelemetry {
 pub struct IssueTokenSettings {
     pub data_dir: PathBuf,
     pub state_file: PathBuf,
+    pub public_url: Option<String>,
     pub ttl: Duration,
 }