server:
  listen: "0.0.0.0:4000"
  workers: 32

cors:
  allow_origins: ["*"]

subgraphs:
  - name: "users"
    url: "http://localhost:4002/graphql"
    headers:
      X-Gateway-Secret: "protocol-lattice-secret-v1"
  - name: "products"
    url: "http://localhost:4003/graphql"
    headers:
      X-Gateway-Secret: "protocol-lattice-secret-v1"
  - name: "reviews"
    url: "http://localhost:4004/graphql"
    headers:
      X-Gateway-Secret: "protocol-lattice-secret-v1"


rate_limit:
  global_rps: 50000
  per_ip_rps: 1000
  per_ip_burst: 2000

# Security Configuration
waf:
  enabled: true
  block_sqli: true
  block_xss: true
  block_nosqli: true
  block_cmdi: true
  block_traversal: true
  block_ldap: true
  block_ssti: true

query_cost:
  max_cost_per_query: 1000
  base_cost_per_field: 1
  expensive_percentile: 0.95
  adaptive_costs: true

disable_introspection: false # Set to true in production
