refactor(config): centralize env loading and enforce typed access

- Centralize environment variable loading in config.MustLoad
- Parse and validate all env vars once at initialization
- Make config fields private and read-only
- Remove public Getenv usage in favor of typed accessors
- Improve validation and initialization order
- Normalize enum naming to be idiomatic and avoid constant collisions

main.go

@@ -9,8 +9,6 @@ import (
 	_ "net/http/pprof"
 	"os"
 	"os/signal"
-	"strconv"
-	"strings"
 	"syscall"
 	"time"
 	"tunnel_pls/internal/config"
@@ -21,6 +19,7 @@ import (
 	"tunnel_pls/internal/transport"
 	"tunnel_pls/internal/version"
 	"tunnel_pls/server"
+	"tunnel_pls/types"
 
 	"golang.org/x/crypto/ssh"
 )
@@ -36,27 +35,12 @@ func main() {
 
 	log.Printf("Starting %s", version.GetVersion())
 
-	err := config.Load()
+	conf, err := config.MustLoad()
 	if err != nil {
 		log.Fatalf("Failed to load configuration: %s", err)
 		return
 	}
 
-	mode := strings.ToLower(config.Getenv("MODE", "standalone"))
-	isNodeMode := mode == "node"
-
-	pprofEnabled := config.Getenv("PPROF_ENABLED", "false")
-	if pprofEnabled == "true" {
-		pprofPort := config.Getenv("PPROF_PORT", "6060")
-		go func() {
-			pprofAddr := fmt.Sprintf("localhost:%s", pprofPort)
-			log.Printf("Starting pprof server on http://%s/debug/pprof/", pprofAddr)
-			if err = http.ListenAndServe(pprofAddr, nil); err != nil {
-				log.Printf("pprof server error: %v", err)
-			}
-		}()
-	}
-
 	sshConfig := &ssh.ServerConfig{
 		NoClientAuth:  true,
 		ServerVersion: fmt.Sprintf("SSH-2.0-TunnelPlease-%s", version.GetShortVersion()),
@@ -88,16 +72,11 @@ func main() {
 	signal.Notify(shutdownChan, os.Interrupt, syscall.SIGTERM)
 
 	var grpcClient client.Client
-	if isNodeMode {
-		grpcHost := config.Getenv("GRPC_ADDRESS", "localhost")
-		grpcPort := config.Getenv("GRPC_PORT", "8080")
-		grpcAddr := fmt.Sprintf("%s:%s", grpcHost, grpcPort)
-		nodeToken := config.Getenv("NODE_TOKEN", "")
-		if nodeToken == "" {
-			log.Fatalf("NODE_TOKEN is required in node mode")
-		}
 
-		grpcClient, err = client.New(grpcAddr, sessionRegistry)
+	if conf.Mode() == types.ServerModeNODE {
+		grpcAddr := fmt.Sprintf("%s:%s", conf.GRPCAddress(), conf.GRPCPort())
+
+		grpcClient, err = client.New(conf, grpcAddr, sessionRegistry)
 		if err != nil {
 			log.Fatalf("failed to create grpc client: %v", err)
 		}
@@ -110,46 +89,15 @@ func main() {
 		healthCancel()
 
 		go func() {
-			identity := config.Getenv("DOMAIN", "localhost")
-			if err = grpcClient.SubscribeEvents(ctx, identity, nodeToken); err != nil {
+			if err = grpcClient.SubscribeEvents(ctx, conf.Domain(), conf.NodeToken()); err != nil {
 				errChan <- fmt.Errorf("failed to subscribe to events: %w", err)
 			}
 		}()
 	}
 
-	portManager := port.New()
-	rawRange := config.Getenv("ALLOWED_PORTS", "")
-	if rawRange != "" {
-		splitRange := strings.Split(rawRange, "-")
-		if len(splitRange) == 2 {
-			var start, end uint64
-			start, err = strconv.ParseUint(splitRange[0], 10, 16)
-			if err != nil {
-				log.Fatalf("Failed to parse start port: %s", err)
-			}
-
-			end, err = strconv.ParseUint(splitRange[1], 10, 16)
-			if err != nil {
-				log.Fatalf("Failed to parse end port: %s", err)
-			}
-
-			if err = portManager.AddRange(uint16(start), uint16(end)); err != nil {
-				log.Fatalf("Failed to add port range: %s", err)
-			}
-			log.Printf("PortRegistry range configured: %d-%d", start, end)
-		} else {
-			log.Printf("Invalid ALLOWED_PORTS format, expected 'start-end', got: %s", rawRange)
-		}
-	}
-
-	tlsEnabled := config.Getenv("TLS_ENABLED", "false") == "true"
-	redirectTLS := config.Getenv("TLS_ENABLED", "false") == "true" && config.Getenv("TLS_REDIRECT", "false") == "true"
-
 	go func() {
-		httpPort := config.Getenv("HTTP_PORT", "8080")
-
 		var httpListener net.Listener
-		httpserver := transport.NewHTTPServer(httpPort, sessionRegistry, redirectTLS)
+		httpserver := transport.NewHTTPServer(conf.Domain(), conf.HTTPPort(), sessionRegistry, conf.TLSRedirect())
 		httpListener, err = httpserver.Listen()
 		if err != nil {
 			errChan <- fmt.Errorf("failed to start http server: %w", err)
@@ -162,37 +110,52 @@ func main() {
 		}
 	}()
 
-	if tlsEnabled {
+	if conf.TLSEnabled() {
 		go func() {
-			httpsPort := config.Getenv("HTTPS_PORT", "8443")
-			domain := config.Getenv("DOMAIN", "localhost")
-
-			var httpListener net.Listener
-			httpserver := transport.NewHTTPSServer(domain, httpsPort, sessionRegistry, redirectTLS)
-			httpListener, err = httpserver.Listen()
+			var httpsListener net.Listener
+			tlsConfig, _ := transport.NewTLSConfig(conf)
+			httpsServer := transport.NewHTTPSServer(conf.Domain(), conf.HTTPSPort(), sessionRegistry, conf.TLSRedirect(), tlsConfig)
+			httpsListener, err = httpsServer.Listen()
 			if err != nil {
 				errChan <- fmt.Errorf("failed to start http server: %w", err)
 				return
 			}
-			err = httpserver.Serve(httpListener)
+			err = httpsServer.Serve(httpsListener)
 			if err != nil {
 				errChan <- fmt.Errorf("error when serving http server: %w", err)
 				return
 			}
 		}()
 	}
+	
+	portManager := port.New()
+	err = portManager.AddRange(conf.AllowedPortsStart(), conf.AllowedPortsEnd())
+	if err != nil {
+		log.Fatalf("Failed to initialize port manager: %s", err)
+		return
+	}
 
 	var app server.Server
 	go func() {
-		sshPort := config.Getenv("PORT", "2200")
-		app, err = server.New(sshConfig, sessionRegistry, grpcClient, portManager, sshPort)
+		app, err = server.New(conf, sshConfig, sessionRegistry, grpcClient, portManager, conf.SSHPort())
 		if err != nil {
 			errChan <- fmt.Errorf("failed to start server: %s", err)
 			return
 		}
 		app.Start()
+
 	}()
 
+	if conf.PprofEnabled() {
+		go func() {
+			pprofAddr := fmt.Sprintf("localhost:%s", conf.PprofPort())
+			log.Printf("Starting pprof server on http://%s/debug/pprof/", pprofAddr)
+			if err = http.ListenAndServe(pprofAddr, nil); err != nil {
+				log.Printf("pprof server error: %v", err)
+			}
+		}()
+	}
+
 	select {
 	case err = <-errChan:
 		log.Printf("error happen : %s", err)