feat: support nested structs, structured arrays, and better secret value handling in config (#4727)

cli/deployment/config.go

@@ -19,356 +19,328 @@ import (
 	"github.com/coder/coder/codersdk"
 )
 
-func newConfig() codersdk.DeploymentConfig {
-	return codersdk.DeploymentConfig{
-		AccessURL: codersdk.DeploymentConfigField[string]{
+func newConfig() *codersdk.DeploymentConfig {
+	return &codersdk.DeploymentConfig{
+		AccessURL: &codersdk.DeploymentConfigField[string]{
 			Name:  "Access URL",
-			Key:   "access_url",
 			Usage: "External URL to access your deployment. This must be accessible by all provisioned workspaces.",
 			Flag:  "access-url",
 		},
-		WildcardAccessURL: codersdk.DeploymentConfigField[string]{
+		WildcardAccessURL: &codersdk.DeploymentConfigField[string]{
 			Name:  "Wildcard Access URL",
-			Key:   "wildcard_access_url",
 			Usage: "Specifies the wildcard hostname to use for workspace applications in the form \"*.example.com\".",
 			Flag:  "wildcard-access-url",
 		},
-		Address: codersdk.DeploymentConfigField[string]{
+		Address: &codersdk.DeploymentConfigField[string]{
 			Name:      "Address",
-			Key:       "address",
 			Usage:     "Bind address of the server.",
 			Flag:      "address",
 			Shorthand: "a",
-			Value:     "127.0.0.1:3000",
+			Default:   "127.0.0.1:3000",
 		},
-		AutobuildPollInterval: codersdk.DeploymentConfigField[time.Duration]{
-			Name:   "Autobuild Poll Interval",
-			Key:    "autobuild_poll_interval",
-			Usage:  "Interval to poll for scheduled workspace builds.",
-			Flag:   "autobuild-poll-interval",
-			Hidden: true,
-			Value:  time.Minute,
+		AutobuildPollInterval: &codersdk.DeploymentConfigField[time.Duration]{
+			Name:    "Autobuild Poll Interval",
+			Usage:   "Interval to poll for scheduled workspace builds.",
+			Flag:    "autobuild-poll-interval",
+			Hidden:  true,
+			Default: time.Minute,
 		},
-		DERPServerEnable: codersdk.DeploymentConfigField[bool]{
-			Name:  "DERP Server Enable",
-			Key:   "derp.server.enable",
-			Usage: "Whether to enable or disable the embedded DERP relay server.",
-			Flag:  "derp-server-enable",
-			Value: true,
+		DERP: &codersdk.DERP{
+			Server: &codersdk.DERPServerConfig{
+				Enable: &codersdk.DeploymentConfigField[bool]{
+					Name:    "DERP Server Enable",
+					Usage:   "Whether to enable or disable the embedded DERP relay server.",
+					Flag:    "derp-server-enable",
+					Default: true,
+				},
+				RegionID: &codersdk.DeploymentConfigField[int]{
+					Name:    "DERP Server Region ID",
+					Usage:   "Region ID to use for the embedded DERP server.",
+					Flag:    "derp-server-region-id",
+					Default: 999,
+				},
+				RegionCode: &codersdk.DeploymentConfigField[string]{
+					Name:    "DERP Server Region Code",
+					Usage:   "Region code to use for the embedded DERP server.",
+					Flag:    "derp-server-region-code",
+					Default: "coder",
+				},
+				RegionName: &codersdk.DeploymentConfigField[string]{
+					Name:    "DERP Server Region Name",
+					Usage:   "Region name that for the embedded DERP server.",
+					Flag:    "derp-server-region-name",
+					Default: "Coder Embedded Relay",
+				},
+				STUNAddresses: &codersdk.DeploymentConfigField[[]string]{
+					Name:    "DERP Server STUN Addresses",
+					Usage:   "Addresses for STUN servers to establish P2P connections. Set empty to disable P2P connections.",
+					Flag:    "derp-server-stun-addresses",
+					Default: []string{"stun.l.google.com:19302"},
+				},
+				RelayURL: &codersdk.DeploymentConfigField[string]{
+					Name:       "DERP Server Relay URL",
+					Usage:      "An HTTP URL that is accessible by other replicas to relay DERP traffic. Required for high availability.",
+					Flag:       "derp-server-relay-url",
+					Enterprise: true,
+				},
+			},
+			Config: &codersdk.DERPConfig{
+				URL: &codersdk.DeploymentConfigField[string]{
+					Name:  "DERP Config URL",
+					Usage: "URL to fetch a DERP mapping on startup. See: https://tailscale.com/kb/1118/custom-derp-servers/",
+					Flag:  "derp-config-url",
+				},
+				Path: &codersdk.DeploymentConfigField[string]{
+					Name:  "DERP Config Path",
+					Usage: "Path to read a DERP mapping from. See: https://tailscale.com/kb/1118/custom-derp-servers/",
+					Flag:  "derp-config-path",
+				},
+			},
 		},
-		DERPServerRegionID: codersdk.DeploymentConfigField[int]{
-			Name:  "DERP Server Region ID",
-			Key:   "derp.server.region_id",
-			Usage: "Region ID to use for the embedded DERP server.",
-			Flag:  "derp-server-region-id",
-			Value: 999,
+		Prometheus: &codersdk.PrometheusConfig{
+			Enable: &codersdk.DeploymentConfigField[bool]{
+				Name:  "Prometheus Enable",
+				Usage: "Serve prometheus metrics on the address defined by prometheus address.",
+				Flag:  "prometheus-enable",
+			},
+			Address: &codersdk.DeploymentConfigField[string]{
+				Name:    "Prometheus Address",
+				Usage:   "The bind address to serve prometheus metrics.",
+				Flag:    "prometheus-address",
+				Default: "127.0.0.1:2112",
+			},
 		},
-		DERPServerRegionCode: codersdk.DeploymentConfigField[string]{
-			Name:  "DERP Server Region Code",
-			Key:   "derp.server.region_code",
-			Usage: "Region code to use for the embedded DERP server.",
-			Flag:  "derp-server-region-code",
-			Value: "coder",
+		Pprof: &codersdk.PprofConfig{
+			Enable: &codersdk.DeploymentConfigField[bool]{
+				Name:  "Pprof Enable",
+				Usage: "Serve pprof metrics on the address defined by pprof address.",
+				Flag:  "pprof-enable",
+			},
+			Address: &codersdk.DeploymentConfigField[string]{
+				Name:    "Pprof Address",
+				Usage:   "The bind address to serve pprof.",
+				Flag:    "pprof-address",
+				Default: "127.0.0.1:6060",
+			},
 		},
-		DERPServerRegionName: codersdk.DeploymentConfigField[string]{
-			Name:  "DERP Server Region Name",
-			Key:   "derp.server.region_name",
-			Usage: "Region name that for the embedded DERP server.",
-			Flag:  "derp-server-region-name",
-			Value: "Coder Embedded Relay",
-		},
-		DERPServerSTUNAddresses: codersdk.DeploymentConfigField[[]string]{
-			Name:  "DERP Server STUN Addresses",
-			Key:   "derp.server.stun_addresses",
-			Usage: "Addresses for STUN servers to establish P2P connections. Set empty to disable P2P connections.",
-			Flag:  "derp-server-stun-addresses",
-			Value: []string{"stun.l.google.com:19302"},
-		},
-		DERPServerRelayURL: codersdk.DeploymentConfigField[string]{
-			Name:       "DERP Server Relay URL",
-			Key:        "derp.server.relay_url",
-			Usage:      "An HTTP URL that is accessible by other replicas to relay DERP traffic. Required for high availability.",
-			Flag:       "derp-server-relay-url",
-			Enterprise: true,
-		},
-		DERPConfigURL: codersdk.DeploymentConfigField[string]{
-			Name:  "DERP Config URL",
-			Key:   "derp.config.url",
-			Usage: "URL to fetch a DERP mapping on startup. See: https://tailscale.com/kb/1118/custom-derp-servers/",
-			Flag:  "derp-config-url",
-		},
-		DERPConfigPath: codersdk.DeploymentConfigField[string]{
-			Name:  "DERP Config Path",
-			Key:   "derp.config.path",
-			Usage: "Path to read a DERP mapping from. See: https://tailscale.com/kb/1118/custom-derp-servers/",
-			Flag:  "derp-config-path",
-		},
-		PrometheusEnable: codersdk.DeploymentConfigField[bool]{
-			Name:  "Prometheus Enable",
-			Key:   "prometheus.enable",
-			Usage: "Serve prometheus metrics on the address defined by prometheus address.",
-			Flag:  "prometheus-enable",
-		},
-		PrometheusAddress: codersdk.DeploymentConfigField[string]{
-			Name:  "Prometheus Address",
-			Key:   "prometheus.address",
-			Usage: "The bind address to serve prometheus metrics.",
-			Flag:  "prometheus-address",
-			Value: "127.0.0.1:2112",
-		},
-		PprofEnable: codersdk.DeploymentConfigField[bool]{
-			Name:  "Pprof Enable",
-			Key:   "pprof.enable",
-			Usage: "Serve pprof metrics on the address defined by pprof address.",
-			Flag:  "pprof-enable",
-		},
-		PprofAddress: codersdk.DeploymentConfigField[string]{
-			Name:  "Pprof Address",
-			Key:   "pprof.address",
-			Usage: "The bind address to serve pprof.",
-			Flag:  "pprof-address",
-			Value: "127.0.0.1:6060",
-		},
-		ProxyTrustedHeaders: codersdk.DeploymentConfigField[[]string]{
+		ProxyTrustedHeaders: &codersdk.DeploymentConfigField[[]string]{
 			Name:  "Proxy Trusted Headers",
-			Key:   "proxy.trusted_headers",
 			Flag:  "proxy-trusted-headers",
 			Usage: "Headers to trust for forwarding IP addresses. e.g. Cf-Connecting-IP True-Client-Ip, X-Forwarded-for",
 		},
-		ProxyTrustedOrigins: codersdk.DeploymentConfigField[[]string]{
+		ProxyTrustedOrigins: &codersdk.DeploymentConfigField[[]string]{
 			Name:  "Proxy Trusted Origins",
-			Key:   "proxy.trusted_origins",
 			Flag:  "proxy-trusted-origins",
 			Usage: "Origin addresses to respect \"proxy-trusted-headers\". e.g. example.com",
 		},
-		CacheDirectory: codersdk.DeploymentConfigField[string]{
-			Name:  "Cache Directory",
-			Key:   "cache_directory",
-			Usage: "The directory to cache temporary files. If unspecified and $CACHE_DIRECTORY is set, it will be used for compatibility with systemd.",
-			Flag:  "cache-dir",
-			Value: defaultCacheDir(),
+		CacheDirectory: &codersdk.DeploymentConfigField[string]{
+			Name:    "Cache Directory",
+			Usage:   "The directory to cache temporary files. If unspecified and $CACHE_DIRECTORY is set, it will be used for compatibility with systemd.",
+			Flag:    "cache-dir",
+			Default: defaultCacheDir(),
 		},
-		InMemoryDatabase: codersdk.DeploymentConfigField[bool]{
+		InMemoryDatabase: &codersdk.DeploymentConfigField[bool]{
 			Name:   "In Memory Database",
-			Key:    "in_memory_database",
 			Usage:  "Controls whether data will be stored in an in-memory database.",
 			Flag:   "in-memory",
 			Hidden: true,
 		},
-		ProvisionerDaemons: codersdk.DeploymentConfigField[int]{
-			Name:  "Provisioner Daemons",
-			Key:   "provisioner.daemons",
-			Usage: "Number of provisioner daemons to create on start. If builds are stuck in queued state for a long time, consider increasing this.",
-			Flag:  "provisioner-daemons",
-			Value: 3,
+		ProvisionerDaemons: &codersdk.DeploymentConfigField[int]{
+			Name:    "Provisioner Daemons",
+			Usage:   "Number of provisioner daemons to create on start. If builds are stuck in queued state for a long time, consider increasing this.",
+			Flag:    "provisioner-daemons",
+			Default: 3,
 		},
-		PostgresURL: codersdk.DeploymentConfigField[string]{
-			Name:  "Postgres Connection URL",
-			Key:   "pg_connection_url",
-			Usage: "URL of a PostgreSQL database. If empty, PostgreSQL binaries will be downloaded from Maven (https://repo1.maven.org/maven2) and store all data in the config root. Access the built-in database with \"coder server postgres-builtin-url\".",
-			Flag:  "postgres-url",
+		PostgresURL: &codersdk.DeploymentConfigField[string]{
+			Name:   "Postgres Connection URL",
+			Usage:  "URL of a PostgreSQL database. If empty, PostgreSQL binaries will be downloaded from Maven (https://repo1.maven.org/maven2) and store all data in the config root. Access the built-in database with \"coder server postgres-builtin-url\".",
+			Flag:   "postgres-url",
+			Secret: true,
 		},
-		OAuth2GithubClientID: codersdk.DeploymentConfigField[string]{
-			Name:  "OAuth2 GitHub Client ID",
-			Key:   "oauth2.github.client_id",
-			Usage: "Client ID for Login with GitHub.",
-			Flag:  "oauth2-github-client-id",
+		OAuth2: &codersdk.OAuth2Config{
+			Github: &codersdk.OAuth2GithubConfig{
+				ClientID: &codersdk.DeploymentConfigField[string]{
+					Name:  "OAuth2 GitHub Client ID",
+					Usage: "Client ID for Login with GitHub.",
+					Flag:  "oauth2-github-client-id",
+				},
+				ClientSecret: &codersdk.DeploymentConfigField[string]{
+					Name:   "OAuth2 GitHub Client Secret",
+					Usage:  "Client secret for Login with GitHub.",
+					Flag:   "oauth2-github-client-secret",
+					Secret: true,
+				},
+				AllowedOrgs: &codersdk.DeploymentConfigField[[]string]{
+					Name:  "OAuth2 GitHub Allowed Orgs",
+					Usage: "Organizations the user must be a member of to Login with GitHub.",
+					Flag:  "oauth2-github-allowed-orgs",
+				},
+				AllowedTeams: &codersdk.DeploymentConfigField[[]string]{
+					Name:  "OAuth2 GitHub Allowed Teams",
+					Usage: "Teams inside organizations the user must be a member of to Login with GitHub. Structured as: <organization-name>/<team-slug>.",
+					Flag:  "oauth2-github-allowed-teams",
+				},
+				AllowSignups: &codersdk.DeploymentConfigField[bool]{
+					Name:  "OAuth2 GitHub Allow Signups",
+					Usage: "Whether new users can sign up with GitHub.",
+					Flag:  "oauth2-github-allow-signups",
+				},
+				EnterpriseBaseURL: &codersdk.DeploymentConfigField[string]{
+					Name:  "OAuth2 GitHub Enterprise Base URL",
+					Usage: "Base URL of a GitHub Enterprise deployment to use for Login with GitHub.",
+					Flag:  "oauth2-github-enterprise-base-url",
+				},
+			},
 		},
-		OAuth2GithubClientSecret: codersdk.DeploymentConfigField[string]{
-			Name:  "OAuth2 GitHub Client Secret",
-			Key:   "oauth2.github.client_secret",
-			Usage: "Client secret for Login with GitHub.",
-			Flag:  "oauth2-github-client-secret",
+		OIDC: &codersdk.OIDCConfig{
+			AllowSignups: &codersdk.DeploymentConfigField[bool]{
+				Name:    "OIDC Allow Signups",
+				Usage:   "Whether new users can sign up with OIDC.",
+				Flag:    "oidc-allow-signups",
+				Default: true,
+			},
+			ClientID: &codersdk.DeploymentConfigField[string]{
+				Name:  "OIDC Client ID",
+				Usage: "Client ID to use for Login with OIDC.",
+				Flag:  "oidc-client-id",
+			},
+			ClientSecret: &codersdk.DeploymentConfigField[string]{
+				Name:   "OIDC Client Secret",
+				Usage:  "Client secret to use for Login with OIDC.",
+				Flag:   "oidc-client-secret",
+				Secret: true,
+			},
+			EmailDomain: &codersdk.DeploymentConfigField[string]{
+				Name:  "OIDC Email Domain",
+				Usage: "Email domain that clients logging in with OIDC must match.",
+				Flag:  "oidc-email-domain",
+			},
+			IssuerURL: &codersdk.DeploymentConfigField[string]{
+				Name:  "OIDC Issuer URL",
+				Usage: "Issuer URL to use for Login with OIDC.",
+				Flag:  "oidc-issuer-url",
+			},
+			Scopes: &codersdk.DeploymentConfigField[[]string]{
+				Name:    "OIDC Scopes",
+				Usage:   "Scopes to grant when authenticating with OIDC.",
+				Flag:    "oidc-scopes",
+				Default: []string{oidc.ScopeOpenID, "profile", "email"},
+			},
 		},
-		OAuth2GithubAllowedOrgs: codersdk.DeploymentConfigField[[]string]{
-			Name:  "OAuth2 GitHub Allowed Orgs",
-			Key:   "oauth2.github.allowed_orgs",
-			Usage: "Organizations the user must be a member of to Login with GitHub.",
-			Flag:  "oauth2-github-allowed-orgs",
+
+		Telemetry: &codersdk.TelemetryConfig{
+			Enable: &codersdk.DeploymentConfigField[bool]{
+				Name:    "Telemetry Enable",
+				Usage:   "Whether telemetry is enabled or not. Coder collects anonymized usage data to help improve our product.",
+				Flag:    "telemetry",
+				Default: flag.Lookup("test.v") == nil,
+			},
+			Trace: &codersdk.DeploymentConfigField[bool]{
+				Name:    "Telemetry Trace",
+				Usage:   "Whether Opentelemetry traces are sent to Coder. Coder collects anonymized application tracing to help improve our product. Disabling telemetry also disables this option.",
+				Flag:    "telemetry-trace",
+				Default: flag.Lookup("test.v") == nil,
+			},
+			URL: &codersdk.DeploymentConfigField[string]{
+				Name:    "Telemetry URL",
+				Usage:   "URL to send telemetry.",
+				Flag:    "telemetry-url",
+				Hidden:  true,
+				Default: "https://telemetry.coder.com",
+			},
 		},
-		OAuth2GithubAllowedTeams: codersdk.DeploymentConfigField[[]string]{
-			Name:  "OAuth2 GitHub Allowed Teams",
-			Key:   "oauth2.github.allowed_teams",
-			Usage: "Teams inside organizations the user must be a member of to Login with GitHub. Structured as: <organization-name>/<team-slug>.",
-			Flag:  "oauth2-github-allowed-teams",
+		TLS: &codersdk.TLSConfig{
+			Enable: &codersdk.DeploymentConfigField[bool]{
+				Name:  "TLS Enable",
+				Usage: "Whether TLS will be enabled.",
+				Flag:  "tls-enable",
+			},
+			CertFiles: &codersdk.DeploymentConfigField[[]string]{
+				Name:  "TLS Certificate Files",
+				Usage: "Path to each certificate for TLS. It requires a PEM-encoded file. To configure the listener to use a CA certificate, concatenate the primary certificate and the CA certificate together. The primary certificate should appear first in the combined file.",
+				Flag:  "tls-cert-file",
+			},
+			ClientCAFile: &codersdk.DeploymentConfigField[string]{
+				Name:  "TLS Client CA Files",
+				Usage: "PEM-encoded Certificate Authority file used for checking the authenticity of client",
+				Flag:  "tls-client-ca-file",
+			},
+			ClientAuth: &codersdk.DeploymentConfigField[string]{
+				Name:    "TLS Client Auth",
+				Usage:   "Policy the server will follow for TLS Client Authentication. Accepted values are \"none\", \"request\", \"require-any\", \"verify-if-given\", or \"require-and-verify\".",
+				Flag:    "tls-client-auth",
+				Default: "request",
+			},
+			KeyFiles: &codersdk.DeploymentConfigField[[]string]{
+				Name:  "TLS Key Files",
+				Usage: "Paths to the private keys for each of the certificates. It requires a PEM-encoded file.",
+				Flag:  "tls-key-file",
+			},
+			MinVersion: &codersdk.DeploymentConfigField[string]{
+				Name:    "TLS Minimum Version",
+				Usage:   "Minimum supported version of TLS. Accepted values are \"tls10\", \"tls11\", \"tls12\" or \"tls13\"",
+				Flag:    "tls-min-version",
+				Default: "tls12",
+			},
 		},
-		OAuth2GithubAllowSignups: codersdk.DeploymentConfigField[bool]{
-			Name:  "OAuth2 GitHub Allow Signups",
-			Key:   "oauth2.github.allow_signups",
-			Usage: "Whether new users can sign up with GitHub.",
-			Flag:  "oauth2-github-allow-signups",
-		},
-		OAuth2GithubEnterpriseBaseURL: codersdk.DeploymentConfigField[string]{
-			Name:  "OAuth2 GitHub Enterprise Base URL",
-			Key:   "oauth2.github.enterprise_base_url",
-			Usage: "Base URL of a GitHub Enterprise deployment to use for Login with GitHub.",
-			Flag:  "oauth2-github-enterprise-base-url",
-		},
-		OIDCAllowSignups: codersdk.DeploymentConfigField[bool]{
-			Name:  "OIDC Allow Signups",
-			Key:   "oidc.allow_signups",
-			Usage: "Whether new users can sign up with OIDC.",
-			Flag:  "oidc-allow-signups",
-			Value: true,
-		},
-		OIDCClientID: codersdk.DeploymentConfigField[string]{
-			Name:  "OIDC Client ID",
-			Key:   "oidc.client_id",
-			Usage: "Client ID to use for Login with OIDC.",
-			Flag:  "oidc-client-id",
-		},
-		OIDCClientSecret: codersdk.DeploymentConfigField[string]{
-			Name:  "OIDC Client Secret",
-			Key:   "oidc.client_secret",
-			Usage: "Client secret to use for Login with OIDC.",
-			Flag:  "oidc-client-secret",
-		},
-		OIDCEmailDomain: codersdk.DeploymentConfigField[string]{
-			Name:  "OIDC Email Domain",
-			Key:   "oidc.email_domain",
-			Usage: "Email domain that clients logging in with OIDC must match.",
-			Flag:  "oidc-email-domain",
-		},
-		OIDCIssuerURL: codersdk.DeploymentConfigField[string]{
-			Name:  "OIDC Issuer URL",
-			Key:   "oidc.issuer_url",
-			Usage: "Issuer URL to use for Login with OIDC.",
-			Flag:  "oidc-issuer-url",
-		},
-		OIDCScopes: codersdk.DeploymentConfigField[[]string]{
-			Name:  "OIDC Scopes",
-			Key:   "oidc.scopes",
-			Usage: "Scopes to grant when authenticating with OIDC.",
-			Flag:  "oidc-scopes",
-			Value: []string{oidc.ScopeOpenID, "profile", "email"},
-		},
-		TelemetryEnable: codersdk.DeploymentConfigField[bool]{
-			Name:  "Telemetry Enable",
-			Key:   "telemetry.enable",
-			Usage: "Whether telemetry is enabled or not. Coder collects anonymized usage data to help improve our product.",
-			Flag:  "telemetry",
-			Value: flag.Lookup("test.v") == nil,
-		},
-		TelemetryTrace: codersdk.DeploymentConfigField[bool]{
-			Name:  "Telemetry Trace",
-			Key:   "telemetry.trace",
-			Usage: "Whether Opentelemetry traces are sent to Coder. Coder collects anonymized application tracing to help improve our product. Disabling telemetry also disables this option.",
-			Flag:  "telemetry-trace",
-			Value: flag.Lookup("test.v") == nil,
-		},
-		TelemetryURL: codersdk.DeploymentConfigField[string]{
-			Name:   "Telemetry URL",
-			Key:    "telemetry.url",
-			Usage:  "URL to send telemetry.",
-			Flag:   "telemetry-url",
-			Hidden: true,
-			Value:  "https://telemetry.coder.com",
-		},
-		TLSEnable: codersdk.DeploymentConfigField[bool]{
-			Name:  "TLS Enable",
-			Key:   "tls.enable",
-			Usage: "Whether TLS will be enabled.",
-			Flag:  "tls-enable",
-		},
-		TLSCertFiles: codersdk.DeploymentConfigField[[]string]{
-			Name:  "TLS Certificate Files",
-			Key:   "tls.cert_file",
-			Usage: "Path to each certificate for TLS. It requires a PEM-encoded file. To configure the listener to use a CA certificate, concatenate the primary certificate and the CA certificate together. The primary certificate should appear first in the combined file.",
-			Flag:  "tls-cert-file",
-		},
-		TLSClientCAFile: codersdk.DeploymentConfigField[string]{
-			Name:  "TLS Client CA Files",
-			Key:   "tls.client_ca_file",
-			Usage: "PEM-encoded Certificate Authority file used for checking the authenticity of client",
-			Flag:  "tls-client-ca-file",
-		},
-		TLSClientAuth: codersdk.DeploymentConfigField[string]{
-			Name:  "TLS Client Auth",
-			Key:   "tls.client_auth",
-			Usage: "Policy the server will follow for TLS Client Authentication. Accepted values are \"none\", \"request\", \"require-any\", \"verify-if-given\", or \"require-and-verify\".",
-			Flag:  "tls-client-auth",
-			Value: "request",
-		},
-		TLSKeyFiles: codersdk.DeploymentConfigField[[]string]{
-			Name:  "TLS Key Files",
-			Key:   "tls.key_file",
-			Usage: "Paths to the private keys for each of the certificates. It requires a PEM-encoded file.",
-			Flag:  "tls-key-file",
-		},
-		TLSMinVersion: codersdk.DeploymentConfigField[string]{
-			Name:  "TLS Minimum Version",
-			Key:   "tls.min_version",
-			Usage: "Minimum supported version of TLS. Accepted values are \"tls10\", \"tls11\", \"tls12\" or \"tls13\"",
-			Flag:  "tls-min-version",
-			Value: "tls12",
-		},
-		TraceEnable: codersdk.DeploymentConfigField[bool]{
+		TraceEnable: &codersdk.DeploymentConfigField[bool]{
 			Name:  "Trace Enable",
-			Key:   "trace",
 			Usage: "Whether application tracing data is collected.",
 			Flag:  "trace",
 		},
-		SecureAuthCookie: codersdk.DeploymentConfigField[bool]{
+		SecureAuthCookie: &codersdk.DeploymentConfigField[bool]{
 			Name:  "Secure Auth Cookie",
-			Key:   "secure_auth_cookie",
 			Usage: "Controls if the 'Secure' property is set on browser session cookies.",
 			Flag:  "secure-auth-cookie",
 		},
-		SSHKeygenAlgorithm: codersdk.DeploymentConfigField[string]{
-			Name:  "SSH Keygen Algorithm",
-			Key:   "ssh_keygen_algorithm",
-			Usage: "The algorithm to use for generating ssh keys. Accepted values are \"ed25519\", \"ecdsa\", or \"rsa4096\".",
-			Flag:  "ssh-keygen-algorithm",
-			Value: "ed25519",
+		SSHKeygenAlgorithm: &codersdk.DeploymentConfigField[string]{
+			Name:    "SSH Keygen Algorithm",
+			Usage:   "The algorithm to use for generating ssh keys. Accepted values are \"ed25519\", \"ecdsa\", or \"rsa4096\".",
+			Flag:    "ssh-keygen-algorithm",
+			Default: "ed25519",
 		},
-		AutoImportTemplates: codersdk.DeploymentConfigField[[]string]{
+		AutoImportTemplates: &codersdk.DeploymentConfigField[[]string]{
 			Name:   "Auto Import Templates",
-			Key:    "auto_import_templates",
 			Usage:  "Templates to auto-import. Available auto-importable templates are: kubernetes",
 			Flag:   "auto-import-template",
 			Hidden: true,
 		},
-		MetricsCacheRefreshInterval: codersdk.DeploymentConfigField[time.Duration]{
-			Name:   "Metrics Cache Refresh Interval",
-			Key:    "metrics_cache_refresh_interval",
-			Usage:  "How frequently metrics are refreshed",
-			Flag:   "metrics-cache-refresh-interval",
-			Hidden: true,
-			Value:  time.Hour,
+		MetricsCacheRefreshInterval: &codersdk.DeploymentConfigField[time.Duration]{
+			Name:    "Metrics Cache Refresh Interval",
+			Usage:   "How frequently metrics are refreshed",
+			Flag:    "metrics-cache-refresh-interval",
+			Hidden:  true,
+			Default: time.Hour,
 		},
-		AgentStatRefreshInterval: codersdk.DeploymentConfigField[time.Duration]{
-			Name:   "Agent Stat Refresh Interval",
-			Key:    "agent_stat_refresh_interval",
-			Usage:  "How frequently agent stats are recorded",
-			Flag:   "agent-stats-refresh-interval",
-			Hidden: true,
-			Value:  10 * time.Minute,
+		AgentStatRefreshInterval: &codersdk.DeploymentConfigField[time.Duration]{
+			Name:    "Agent Stat Refresh Interval",
+			Usage:   "How frequently agent stats are recorded",
+			Flag:    "agent-stats-refresh-interval",
+			Hidden:  true,
+			Default: 10 * time.Minute,
 		},
-		AuditLogging: codersdk.DeploymentConfigField[bool]{
+		AuditLogging: &codersdk.DeploymentConfigField[bool]{
 			Name:       "Audit Logging",
-			Key:        "audit_logging",
 			Usage:      "Specifies whether audit logging is enabled.",
 			Flag:       "audit-logging",
-			Value:      true,
+			Default:    true,
 			Enterprise: true,
 		},
-		BrowserOnly: codersdk.DeploymentConfigField[bool]{
+		BrowserOnly: &codersdk.DeploymentConfigField[bool]{
 			Name:       "Browser Only",
-			Key:        "browser_only",
 			Usage:      "Whether Coder only allows connections to workspaces via the browser.",
 			Flag:       "browser-only",
 			Enterprise: true,
 		},
-		SCIMAPIKey: codersdk.DeploymentConfigField[string]{
+		SCIMAPIKey: &codersdk.DeploymentConfigField[string]{
 			Name:       "SCIM API Key",
-			Key:        "scim_api_key",
 			Usage:      "Enables SCIM and sets the authentication header for the built-in SCIM server. New users are automatically created with OIDC authentication.",
 			Flag:       "scim-auth-header",
 			Enterprise: true,
+			Secret:     true,
 		},
-		UserWorkspaceQuota: codersdk.DeploymentConfigField[int]{
+		UserWorkspaceQuota: &codersdk.DeploymentConfigField[int]{
 			Name:       "User Workspace Quota",
-			Key:        "user_workspace_quota",
 			Usage:      "Enables and sets a limit on how many workspaces each user can create.",
 			Flag:       "user-workspace-quota",
 			Enterprise: true,
@@ -377,11 +349,11 @@ func newConfig() codersdk.DeploymentConfig {
 }
 
 //nolint:revive
-func Config(flagset *pflag.FlagSet, vip *viper.Viper) (codersdk.DeploymentConfig, error) {
+func Config(flagset *pflag.FlagSet, vip *viper.Viper) (*codersdk.DeploymentConfig, error) {
 	dc := newConfig()
 	flg, err := flagset.GetString(config.FlagName)
 	if err != nil {
-		return dc, xerrors.Errorf("get global config from flag: %w", err)
+		return nil, xerrors.Errorf("get global config from flag: %w", err)
 	}
 	vip.SetEnvPrefix("coder")
 	vip.AutomaticEnv()
@@ -394,104 +366,189 @@ func Config(flagset *pflag.FlagSet, vip *viper.Viper) (codersdk.DeploymentConfig
 		}
 	}
 
-	dcv := reflect.ValueOf(&dc).Elem()
-	t := dcv.Type()
-	for i := 0; i < t.NumField(); i++ {
-		fve := dcv.Field(i)
-		key := fve.FieldByName("Key").String()
-		value := fve.FieldByName("Value").Interface()
+	setConfig("", vip, &dc)
 
+	return dc, nil
+}
+
+func setConfig(prefix string, vip *viper.Viper, target interface{}) {
+	val := reflect.Indirect(reflect.ValueOf(target))
+	typ := val.Type()
+	if typ.Kind() != reflect.Struct {
+		val = val.Elem()
+		typ = val.Type()
+	}
+
+	// Manually bind to env to support CODER_$INDEX_$FIELD format for structured slices.
+	_ = vip.BindEnv(prefix, formatEnv(prefix))
+
+	if strings.HasPrefix(typ.Name(), "DeploymentConfigField[") {
+		value := val.FieldByName("Value").Interface()
 		switch value.(type) {
 		case string:
-			fve.FieldByName("Value").SetString(vip.GetString(key))
+			val.FieldByName("Value").SetString(vip.GetString(prefix))
 		case bool:
-			fve.FieldByName("Value").SetBool(vip.GetBool(key))
+			val.FieldByName("Value").SetBool(vip.GetBool(prefix))
 		case int:
-			fve.FieldByName("Value").SetInt(int64(vip.GetInt(key)))
+			val.FieldByName("Value").SetInt(int64(vip.GetInt(prefix)))
 		case time.Duration:
-			fve.FieldByName("Value").SetInt(int64(vip.GetDuration(key)))
+			val.FieldByName("Value").SetInt(int64(vip.GetDuration(prefix)))
 		case []string:
 			// As of October 21st, 2022 we supported delimiting a string
 			// with a comma, but Viper only supports with a space. This
 			// is a small hack around it!
-			rawSlice := reflect.ValueOf(vip.GetStringSlice(key)).Interface()
+			rawSlice := reflect.ValueOf(vip.GetStringSlice(prefix)).Interface()
 			slice, ok := rawSlice.([]string)
 			if !ok {
-				return dc, xerrors.Errorf("string slice is of type %T", rawSlice)
+				panic(fmt.Sprintf("string slice is of type %T", rawSlice))
 			}
 			value := make([]string, 0, len(slice))
 			for _, entry := range slice {
 				value = append(value, strings.Split(entry, ",")...)
 			}
-			fve.FieldByName("Value").Set(reflect.ValueOf(value))
+			val.FieldByName("Value").Set(reflect.ValueOf(value))
 		default:
-			return dc, xerrors.Errorf("unsupported type %T", value)
+			panic(fmt.Sprintf("unsupported type %T", value))
 		}
+		return
 	}
 
-	return dc, nil
+	for i := 0; i < typ.NumField(); i++ {
+		fv := val.Field(i)
+		ft := fv.Type()
+		tag := typ.Field(i).Tag.Get("json")
+		var key string
+		if prefix == "" {
+			key = tag
+		} else {
+			key = fmt.Sprintf("%s.%s", prefix, tag)
+		}
+		switch ft.Kind() {
+		case reflect.Ptr:
+			setConfig(key, vip, fv.Interface())
+		case reflect.Slice:
+			for j := 0; j < fv.Len(); j++ {
+				key := fmt.Sprintf("%s.%d", key, j)
+				setConfig(key, vip, fv.Index(j).Interface())
+			}
+		default:
+			panic(fmt.Sprintf("unsupported type %T", ft))
+		}
+	}
 }
 
 func NewViper() *viper.Viper {
 	dc := newConfig()
-	v := viper.New()
-	v.SetEnvPrefix("coder")
-	v.AutomaticEnv()
-	v.SetEnvKeyReplacer(strings.NewReplacer("-", "_", ".", "_"))
+	vip := viper.New()
+	vip.SetEnvPrefix("coder")
+	vip.AutomaticEnv()
+	vip.SetEnvKeyReplacer(strings.NewReplacer("-", "_", ".", "_"))
 
-	dcv := reflect.ValueOf(dc)
-	t := dcv.Type()
-	for i := 0; i < t.NumField(); i++ {
-		fv := dcv.Field(i)
-		key := fv.FieldByName("Key").String()
-		value := fv.FieldByName("Value").Interface()
-		v.SetDefault(key, value)
+	setViperDefaults("", vip, dc)
+
+	return vip
+}
+
+func setViperDefaults(prefix string, vip *viper.Viper, target interface{}) {
+	val := reflect.ValueOf(target).Elem()
+	val = reflect.Indirect(val)
+	typ := val.Type()
+	if strings.HasPrefix(typ.Name(), "DeploymentConfigField") {
+		value := val.FieldByName("Default").Interface()
+		vip.SetDefault(prefix, value)
+		return
 	}
 
-	return v
+	for i := 0; i < typ.NumField(); i++ {
+		fv := val.Field(i)
+		ft := fv.Type()
+		tag := typ.Field(i).Tag.Get("json")
+		var key string
+		if prefix == "" {
+			key = tag
+		} else {
+			key = fmt.Sprintf("%s.%s", prefix, tag)
+		}
+		switch ft.Kind() {
+		case reflect.Ptr:
+			setViperDefaults(key, vip, fv.Interface())
+		case reflect.Slice:
+			// we currently don't support default values on structured slices
+			continue
+		default:
+			panic(fmt.Sprintf("unsupported type %T", ft))
+		}
+	}
 }
 
 //nolint:revive
 func AttachFlags(flagset *pflag.FlagSet, vip *viper.Viper, enterprise bool) {
-	dc := newConfig()
-	dcv := reflect.ValueOf(dc)
-	t := dcv.Type()
-	for i := 0; i < t.NumField(); i++ {
-		fv := dcv.Field(i)
-		isEnt := fv.FieldByName("Enterprise").Bool()
+	setFlags("", flagset, vip, newConfig(), enterprise)
+}
+
+//nolint:revive
+func setFlags(prefix string, flagset *pflag.FlagSet, vip *viper.Viper, target interface{}, enterprise bool) {
+	val := reflect.Indirect(reflect.ValueOf(target))
+	typ := val.Type()
+	if strings.HasPrefix(typ.Name(), "DeploymentConfigField") {
+		isEnt := val.FieldByName("Enterprise").Bool()
 		if enterprise != isEnt {
-			continue
+			return
 		}
-		key := fv.FieldByName("Key").String()
-		flg := fv.FieldByName("Flag").String()
+		flg := val.FieldByName("Flag").String()
 		if flg == "" {
-			continue
+			return
 		}
-		usage := fv.FieldByName("Usage").String()
-		usage = fmt.Sprintf("%s\n%s", usage, cliui.Styles.Placeholder.Render("Consumes $"+formatEnv(key)))
-		shorthand := fv.FieldByName("Shorthand").String()
-		hidden := fv.FieldByName("Hidden").Bool()
-		value := fv.FieldByName("Value").Interface()
+		usage := val.FieldByName("Usage").String()
+		usage = fmt.Sprintf("%s\n%s", usage, cliui.Styles.Placeholder.Render("Consumes $"+formatEnv(prefix)))
+		shorthand := val.FieldByName("Shorthand").String()
+		hidden := val.FieldByName("Hidden").Bool()
+		value := val.FieldByName("Default").Interface()
 
 		switch value.(type) {
 		case string:
-			_ = flagset.StringP(flg, shorthand, vip.GetString(key), usage)
+			_ = flagset.StringP(flg, shorthand, vip.GetString(prefix), usage)
 		case bool:
-			_ = flagset.BoolP(flg, shorthand, vip.GetBool(key), usage)
+			_ = flagset.BoolP(flg, shorthand, vip.GetBool(prefix), usage)
 		case int:
-			_ = flagset.IntP(flg, shorthand, vip.GetInt(key), usage)
+			_ = flagset.IntP(flg, shorthand, vip.GetInt(prefix), usage)
 		case time.Duration:
-			_ = flagset.DurationP(flg, shorthand, vip.GetDuration(key), usage)
+			_ = flagset.DurationP(flg, shorthand, vip.GetDuration(prefix), usage)
 		case []string:
-			_ = flagset.StringSliceP(flg, shorthand, vip.GetStringSlice(key), usage)
+			_ = flagset.StringSliceP(flg, shorthand, vip.GetStringSlice(prefix), usage)
 		default:
-			continue
+			panic(fmt.Sprintf("unsupported type %T", typ))
 		}
 
-		_ = vip.BindPFlag(key, flagset.Lookup(flg))
+		_ = vip.BindPFlag(prefix, flagset.Lookup(flg))
 		if hidden {
 			_ = flagset.MarkHidden(flg)
 		}
+
+		return
+	}
+
+	for i := 0; i < typ.NumField(); i++ {
+		fv := val.Field(i)
+		ft := fv.Type()
+		tag := typ.Field(i).Tag.Get("json")
+		var key string
+		if prefix == "" {
+			key = tag
+		} else {
+			key = fmt.Sprintf("%s.%s", prefix, tag)
+		}
+		switch ft.Kind() {
+		case reflect.Ptr:
+			setFlags(key, flagset, vip, fv.Interface(), enterprise)
+		case reflect.Slice:
+			for j := 0; j < fv.Len(); j++ {
+				key := fmt.Sprintf("%s.%d", key, j)
+				setFlags(key, flagset, vip, fv.Index(j).Interface(), enterprise)
+			}
+		default:
+			panic(fmt.Sprintf("unsupported type %T", ft))
+		}
 	}
 }
 

cli/deployment/config_test.go

@@ -21,7 +21,7 @@ func TestConfig(t *testing.T) {
 	for _, tc := range []struct {
 		Name  string
 		Env   map[string]string
-		Valid func(config codersdk.DeploymentConfig)
+		Valid func(config *codersdk.DeploymentConfig)
 	}{{
 		Name: "Deployment",
 		Env: map[string]string{
@@ -39,19 +39,19 @@ func TestConfig(t *testing.T) {
 			"CODER_TELEMETRY_TRACE":      "false",
 			"CODER_WILDCARD_ACCESS_URL":  "something-wildcard.com",
 		},
-		Valid: func(config codersdk.DeploymentConfig) {
+		Valid: func(config *codersdk.DeploymentConfig) {
 			require.Equal(t, config.Address.Value, "0.0.0.0:8443")
 			require.Equal(t, config.AccessURL.Value, "https://dev.coder.com")
 			require.Equal(t, config.PostgresURL.Value, "some-url")
-			require.Equal(t, config.PprofAddress.Value, "something")
-			require.Equal(t, config.PprofEnable.Value, true)
-			require.Equal(t, config.PrometheusAddress.Value, "hello-world")
-			require.Equal(t, config.PrometheusEnable.Value, true)
+			require.Equal(t, config.Pprof.Address.Value, "something")
+			require.Equal(t, config.Pprof.Enable.Value, true)
+			require.Equal(t, config.Prometheus.Address.Value, "hello-world")
+			require.Equal(t, config.Prometheus.Enable.Value, true)
 			require.Equal(t, config.ProvisionerDaemons.Value, 5)
 			require.Equal(t, config.SecureAuthCookie.Value, true)
 			require.Equal(t, config.SSHKeygenAlgorithm.Value, "potato")
-			require.Equal(t, config.TelemetryEnable.Value, false)
-			require.Equal(t, config.TelemetryTrace.Value, false)
+			require.Equal(t, config.Telemetry.Enable.Value, false)
+			require.Equal(t, config.Telemetry.Trace.Value, false)
 			require.Equal(t, config.WildcardAccessURL.Value, "something-wildcard.com")
 		},
 	}, {
@@ -66,15 +66,15 @@ func TestConfig(t *testing.T) {
 			"CODER_DERP_SERVER_RELAY_URL":      "1.1.1.1",
 			"CODER_DERP_SERVER_STUN_ADDRESSES": "google.org",
 		},
-		Valid: func(config codersdk.DeploymentConfig) {
-			require.Equal(t, config.DERPConfigPath.Value, "/example/path")
-			require.Equal(t, config.DERPConfigURL.Value, "https://google.com")
-			require.Equal(t, config.DERPServerEnable.Value, false)
-			require.Equal(t, config.DERPServerRegionCode.Value, "something")
-			require.Equal(t, config.DERPServerRegionID.Value, 123)
-			require.Equal(t, config.DERPServerRegionName.Value, "Code-Land")
-			require.Equal(t, config.DERPServerRelayURL.Value, "1.1.1.1")
-			require.Equal(t, config.DERPServerSTUNAddresses.Value, []string{"google.org"})
+		Valid: func(config *codersdk.DeploymentConfig) {
+			require.Equal(t, config.DERP.Config.Path.Value, "/example/path")
+			require.Equal(t, config.DERP.Config.URL.Value, "https://google.com")
+			require.Equal(t, config.DERP.Server.Enable.Value, false)
+			require.Equal(t, config.DERP.Server.RegionCode.Value, "something")
+			require.Equal(t, config.DERP.Server.RegionID.Value, 123)
+			require.Equal(t, config.DERP.Server.RegionName.Value, "Code-Land")
+			require.Equal(t, config.DERP.Server.RelayURL.Value, "1.1.1.1")
+			require.Equal(t, config.DERP.Server.STUNAddresses.Value, []string{"google.org"})
 		},
 	}, {
 		Name: "Enterprise",
@@ -84,7 +84,7 @@ func TestConfig(t *testing.T) {
 			"CODER_SCIM_API_KEY":         "some-key",
 			"CODER_USER_WORKSPACE_QUOTA": "10",
 		},
-		Valid: func(config codersdk.DeploymentConfig) {
+		Valid: func(config *codersdk.DeploymentConfig) {
 			require.Equal(t, config.AuditLogging.Value, false)
 			require.Equal(t, config.BrowserOnly.Value, true)
 			require.Equal(t, config.SCIMAPIKey.Value, "some-key")
@@ -100,19 +100,19 @@ func TestConfig(t *testing.T) {
 			"CODER_TLS_ENABLE":         "true",
 			"CODER_TLS_MIN_VERSION":    "tls10",
 		},
-		Valid: func(config codersdk.DeploymentConfig) {
-			require.Len(t, config.TLSCertFiles.Value, 2)
-			require.Equal(t, config.TLSCertFiles.Value[0], "/etc/acme-sh/dev.coder.com")
-			require.Equal(t, config.TLSCertFiles.Value[1], "/etc/acme-sh/*.dev.coder.com")
+		Valid: func(config *codersdk.DeploymentConfig) {
+			require.Len(t, config.TLS.CertFiles.Value, 2)
+			require.Equal(t, config.TLS.CertFiles.Value[0], "/etc/acme-sh/dev.coder.com")
+			require.Equal(t, config.TLS.CertFiles.Value[1], "/etc/acme-sh/*.dev.coder.com")
 
-			require.Len(t, config.TLSKeyFiles.Value, 2)
-			require.Equal(t, config.TLSKeyFiles.Value[0], "/etc/acme-sh/dev.coder.com")
-			require.Equal(t, config.TLSKeyFiles.Value[1], "/etc/acme-sh/*.dev.coder.com")
+			require.Len(t, config.TLS.KeyFiles.Value, 2)
+			require.Equal(t, config.TLS.KeyFiles.Value[0], "/etc/acme-sh/dev.coder.com")
+			require.Equal(t, config.TLS.KeyFiles.Value[1], "/etc/acme-sh/*.dev.coder.com")
 
-			require.Equal(t, config.TLSClientAuth.Value, "/some/path")
-			require.Equal(t, config.TLSClientCAFile.Value, "/some/path")
-			require.Equal(t, config.TLSEnable.Value, true)
-			require.Equal(t, config.TLSMinVersion.Value, "tls10")
+			require.Equal(t, config.TLS.ClientAuth.Value, "/some/path")
+			require.Equal(t, config.TLS.ClientCAFile.Value, "/some/path")
+			require.Equal(t, config.TLS.Enable.Value, true)
+			require.Equal(t, config.TLS.MinVersion.Value, "tls10")
 		},
 	}, {
 		Name: "OIDC",
@@ -124,13 +124,13 @@ func TestConfig(t *testing.T) {
 			"CODER_OIDC_ALLOW_SIGNUPS": "false",
 			"CODER_OIDC_SCOPES":        "something,here",
 		},
-		Valid: func(config codersdk.DeploymentConfig) {
-			require.Equal(t, config.OIDCIssuerURL.Value, "https://accounts.google.com")
-			require.Equal(t, config.OIDCEmailDomain.Value, "coder.com")
-			require.Equal(t, config.OIDCClientID.Value, "client")
-			require.Equal(t, config.OIDCClientSecret.Value, "secret")
-			require.Equal(t, config.OIDCAllowSignups.Value, false)
-			require.Equal(t, config.OIDCScopes.Value, []string{"something", "here"})
+		Valid: func(config *codersdk.DeploymentConfig) {
+			require.Equal(t, config.OIDC.IssuerURL.Value, "https://accounts.google.com")
+			require.Equal(t, config.OIDC.EmailDomain.Value, "coder.com")
+			require.Equal(t, config.OIDC.ClientID.Value, "client")
+			require.Equal(t, config.OIDC.ClientSecret.Value, "secret")
+			require.Equal(t, config.OIDC.AllowSignups.Value, false)
+			require.Equal(t, config.OIDC.Scopes.Value, []string{"something", "here"})
 		},
 	}, {
 		Name: "GitHub",
@@ -141,12 +141,12 @@ func TestConfig(t *testing.T) {
 			"CODER_OAUTH2_GITHUB_ALLOWED_TEAMS": "coder",
 			"CODER_OAUTH2_GITHUB_ALLOW_SIGNUPS": "true",
 		},
-		Valid: func(config codersdk.DeploymentConfig) {
-			require.Equal(t, config.OAuth2GithubClientID.Value, "client")
-			require.Equal(t, config.OAuth2GithubClientSecret.Value, "secret")
-			require.Equal(t, []string{"coder"}, config.OAuth2GithubAllowedOrgs.Value)
-			require.Equal(t, []string{"coder"}, config.OAuth2GithubAllowedTeams.Value)
-			require.Equal(t, config.OAuth2GithubAllowSignups.Value, true)
+		Valid: func(config *codersdk.DeploymentConfig) {
+			require.Equal(t, config.OAuth2.Github.ClientID.Value, "client")
+			require.Equal(t, config.OAuth2.Github.ClientSecret.Value, "secret")
+			require.Equal(t, []string{"coder"}, config.OAuth2.Github.AllowedOrgs.Value)
+			require.Equal(t, []string{"coder"}, config.OAuth2.Github.AllowedTeams.Value)
+			require.Equal(t, config.OAuth2.Github.AllowSignups.Value, true)
 		},
 	}} {
 		tc := tc

cli/server.go

@@ -117,11 +117,11 @@ func Server(vip *viper.Viper, newAPI func(context.Context, *coderd.Options) (*co
 
 			// Coder tracing should be disabled if telemetry is disabled unless
 			// --telemetry-trace was explicitly provided.
-			shouldCoderTrace := cfg.TelemetryEnable.Value && !isTest()
+			shouldCoderTrace := cfg.Telemetry.Enable.Value && !isTest()
 			// Only override if telemetryTraceEnable was specifically set.
 			// By default we want it to be controlled by telemetryEnable.
 			if cmd.Flags().Changed("telemetry-trace") {
-				shouldCoderTrace = cfg.TelemetryTrace.Value
+				shouldCoderTrace = cfg.Telemetry.Trace.Value
 			}
 
 			if cfg.TraceEnable.Value || shouldCoderTrace {
@@ -174,13 +174,13 @@ func Server(vip *viper.Viper, newAPI func(context.Context, *coderd.Options) (*co
 			defer listener.Close()
 
 			var tlsConfig *tls.Config
-			if cfg.TLSEnable.Value {
+			if cfg.TLS.Enable.Value {
 				tlsConfig, err = configureTLS(
-					cfg.TLSMinVersion.Value,
-					cfg.TLSClientAuth.Value,
-					cfg.TLSCertFiles.Value,
-					cfg.TLSKeyFiles.Value,
-					cfg.TLSClientCAFile.Value,
+					cfg.TLS.MinVersion.Value,
+					cfg.TLS.ClientAuth.Value,
+					cfg.TLS.CertFiles.Value,
+					cfg.TLS.KeyFiles.Value,
+					cfg.TLS.ClientCAFile.Value,
 				)
 				if err != nil {
 					return xerrors.Errorf("configure tls: %w", err)
@@ -202,7 +202,7 @@ func Server(vip *viper.Viper, newAPI func(context.Context, *coderd.Options) (*co
 				Scheme: "http",
 				Host:   tcpAddr.String(),
 			}
-			if cfg.TLSEnable.Value {
+			if cfg.TLS.Enable.Value {
 				localURL.Scheme = "https"
 			}
 
@@ -297,22 +297,22 @@ func Server(vip *viper.Viper, newAPI func(context.Context, *coderd.Options) (*co
 
 			defaultRegion := &tailcfg.DERPRegion{
 				EmbeddedRelay: true,
-				RegionID:      cfg.DERPServerRegionID.Value,
-				RegionCode:    cfg.DERPServerRegionCode.Value,
-				RegionName:    cfg.DERPServerRegionName.Value,
+				RegionID:      cfg.DERP.Server.RegionID.Value,
+				RegionCode:    cfg.DERP.Server.RegionCode.Value,
+				RegionName:    cfg.DERP.Server.RegionName.Value,
 				Nodes: []*tailcfg.DERPNode{{
-					Name:      fmt.Sprintf("%db", cfg.DERPServerRegionID.Value),
-					RegionID:  cfg.DERPServerRegionID.Value,
+					Name:      fmt.Sprintf("%db", cfg.DERP.Server.RegionID.Value),
+					RegionID:  cfg.DERP.Server.RegionID.Value,
 					HostName:  accessURLParsed.Hostname(),
 					DERPPort:  accessURLPort,
 					STUNPort:  -1,
 					ForceHTTP: accessURLParsed.Scheme == "http",
 				}},
 			}
-			if !cfg.DERPServerEnable.Value {
+			if !cfg.DERP.Server.Enable.Value {
 				defaultRegion = nil
 			}
-			derpMap, err := tailnet.NewDERPMap(ctx, defaultRegion, cfg.DERPServerSTUNAddresses.Value, cfg.DERPConfigURL.Value, cfg.DERPConfigPath.Value)
+			derpMap, err := tailnet.NewDERPMap(ctx, defaultRegion, cfg.DERP.Server.STUNAddresses.Value, cfg.DERP.Config.URL.Value, cfg.DERP.Config.Path.Value)
 			if err != nil {
 				return xerrors.Errorf("create derp map: %w", err)
 			}
@@ -350,35 +350,35 @@ func Server(vip *viper.Viper, newAPI func(context.Context, *coderd.Options) (*co
 				MetricsCacheRefreshInterval: cfg.MetricsCacheRefreshInterval.Value,
 				AgentStatsRefreshInterval:   cfg.AgentStatRefreshInterval.Value,
 				Experimental:                ExperimentalEnabled(cmd),
-				DeploymentConfig:            &cfg,
+				DeploymentConfig:            cfg,
 			}
 			if tlsConfig != nil {
 				options.TLSCertificates = tlsConfig.Certificates
 			}
 
-			if cfg.OAuth2GithubClientSecret.Value != "" {
+			if cfg.OAuth2.Github.ClientSecret.Value != "" {
 				options.GithubOAuth2Config, err = configureGithubOAuth2(accessURLParsed,
-					cfg.OAuth2GithubClientID.Value,
-					cfg.OAuth2GithubClientSecret.Value,
-					cfg.OAuth2GithubAllowSignups.Value,
-					cfg.OAuth2GithubAllowedOrgs.Value,
-					cfg.OAuth2GithubAllowedTeams.Value,
-					cfg.OAuth2GithubEnterpriseBaseURL.Value,
+					cfg.OAuth2.Github.ClientID.Value,
+					cfg.OAuth2.Github.ClientSecret.Value,
+					cfg.OAuth2.Github.AllowSignups.Value,
+					cfg.OAuth2.Github.AllowedOrgs.Value,
+					cfg.OAuth2.Github.AllowedTeams.Value,
+					cfg.OAuth2.Github.EnterpriseBaseURL.Value,
 				)
 				if err != nil {
 					return xerrors.Errorf("configure github oauth2: %w", err)
 				}
 			}
 
-			if cfg.OIDCClientSecret.Value != "" {
-				if cfg.OIDCClientID.Value == "" {
+			if cfg.OIDC.ClientSecret.Value != "" {
+				if cfg.OIDC.ClientID.Value == "" {
 					return xerrors.Errorf("OIDC client ID be set!")
 				}
-				if cfg.OIDCIssuerURL.Value == "" {
+				if cfg.OIDC.IssuerURL.Value == "" {
 					return xerrors.Errorf("OIDC issuer URL must be set!")
 				}
 
-				oidcProvider, err := oidc.NewProvider(ctx, cfg.OIDCIssuerURL.Value)
+				oidcProvider, err := oidc.NewProvider(ctx, cfg.OIDC.IssuerURL.Value)
 				if err != nil {
 					return xerrors.Errorf("configure oidc provider: %w", err)
 				}
@@ -388,17 +388,17 @@ func Server(vip *viper.Viper, newAPI func(context.Context, *coderd.Options) (*co
 				}
 				options.OIDCConfig = &coderd.OIDCConfig{
 					OAuth2Config: &oauth2.Config{
-						ClientID:     cfg.OIDCClientID.Value,
-						ClientSecret: cfg.OIDCClientSecret.Value,
+						ClientID:     cfg.OIDC.ClientID.Value,
+						ClientSecret: cfg.OIDC.ClientSecret.Value,
 						RedirectURL:  redirectURL.String(),
 						Endpoint:     oidcProvider.Endpoint(),
-						Scopes:       cfg.OIDCScopes.Value,
+						Scopes:       cfg.OIDC.Scopes.Value,
 					},
 					Verifier: oidcProvider.Verifier(&oidc.Config{
-						ClientID: cfg.OIDCClientID.Value,
+						ClientID: cfg.OIDC.ClientID.Value,
 					}),
-					EmailDomain:  cfg.OIDCEmailDomain.Value,
-					AllowSignups: cfg.OIDCAllowSignups.Value,
+					EmailDomain:  cfg.OIDC.EmailDomain.Value,
+					AllowSignups: cfg.OIDC.AllowSignups.Value,
 				}
 			}
 
@@ -461,26 +461,26 @@ func Server(vip *viper.Viper, newAPI func(context.Context, *coderd.Options) (*co
 			}
 
 			// Parse the raw telemetry URL!
-			telemetryURL, err := parseURL(ctx, cfg.TelemetryURL.Value)
+			telemetryURL, err := parseURL(ctx, cfg.Telemetry.URL.Value)
 			if err != nil {
 				return xerrors.Errorf("parse telemetry url: %w", err)
 			}
 			// Disable telemetry if the in-memory database is used unless explicitly defined!
-			if cfg.InMemoryDatabase.Value && !cmd.Flags().Changed(cfg.TelemetryEnable.Flag) {
-				cfg.TelemetryEnable.Value = false
+			if cfg.InMemoryDatabase.Value && !cmd.Flags().Changed(cfg.Telemetry.Enable.Flag) {
+				cfg.Telemetry.Enable.Value = false
 			}
-			if cfg.TelemetryEnable.Value {
+			if cfg.Telemetry.Enable.Value {
 				options.Telemetry, err = telemetry.New(telemetry.Options{
 					BuiltinPostgres: builtinPostgres,
 					DeploymentID:    deploymentID,
 					Database:        options.Database,
 					Logger:          logger.Named("telemetry"),
 					URL:             telemetryURL,
-					GitHubOAuth:     cfg.OAuth2GithubClientID.Value != "",
-					OIDCAuth:        cfg.OIDCClientID.Value != "",
-					OIDCIssuerURL:   cfg.OIDCIssuerURL.Value,
-					Prometheus:      cfg.PrometheusEnable.Value,
-					STUN:            len(cfg.DERPServerSTUNAddresses.Value) != 0,
+					GitHubOAuth:     cfg.OAuth2.Github.ClientID.Value != "",
+					OIDCAuth:        cfg.OIDC.ClientID.Value != "",
+					OIDCIssuerURL:   cfg.OIDC.IssuerURL.Value,
+					Prometheus:      cfg.Prometheus.Enable.Value,
+					STUN:            len(cfg.DERP.Server.STUNAddresses.Value) != 0,
 					Tunnel:          tunnel != nil,
 				})
 				if err != nil {
@@ -491,11 +491,11 @@ func Server(vip *viper.Viper, newAPI func(context.Context, *coderd.Options) (*co
 
 			// This prevents the pprof import from being accidentally deleted.
 			_ = pprof.Handler
-			if cfg.PprofEnable.Value {
+			if cfg.Pprof.Enable.Value {
 				//nolint:revive
-				defer serveHandler(ctx, logger, nil, cfg.PprofAddress.Value, "pprof")()
+				defer serveHandler(ctx, logger, nil, cfg.Pprof.Address.Value, "pprof")()
 			}
-			if cfg.PrometheusEnable.Value {
+			if cfg.Prometheus.Enable.Value {
 				options.PrometheusRegistry = prometheus.NewRegistry()
 				closeUsersFunc, err := prometheusmetrics.ActiveUsers(ctx, options.PrometheusRegistry, options.Database, 0)
 				if err != nil {
@@ -512,7 +512,7 @@ func Server(vip *viper.Viper, newAPI func(context.Context, *coderd.Options) (*co
 				//nolint:revive
 				defer serveHandler(ctx, logger, promhttp.InstrumentMetricHandler(
 					options.PrometheusRegistry, promhttp.HandlerFor(options.PrometheusRegistry, promhttp.HandlerOpts{}),
-				), cfg.PrometheusAddress.Value, "prometheus")()
+				), cfg.Prometheus.Address.Value, "prometheus")()
 			}
 
 			// We use a separate coderAPICloser so the Enterprise API
@@ -524,7 +524,7 @@ func Server(vip *viper.Viper, newAPI func(context.Context, *coderd.Options) (*co
 			}
 
 			client := codersdk.New(localURL)
-			if cfg.TLSEnable.Value {
+			if cfg.TLS.Enable.Value {
 				// Secure transport isn't needed for locally communicating!
 				client.HTTPClient.Transport = &http.Transport{
 					TLSClientConfig: &tls.Config{