server:
  listen: "0.0.0.0:4000"
  workers: 32

cors:
  allow_origins: ["*"]

subgraphs:
  - name: "users"
    url: "http://localhost:4002/graphql"
    headers:
      X-Gateway-Secret: "${GATEWAY_SECRET}"
  - name: "products"
    url: "http://localhost:4003/graphql"
    headers:
      X-Gateway-Secret: "${GATEWAY_SECRET}"
  - name: "reviews"
    url: "http://localhost:4004/graphql"
    headers:
      X-Gateway-Secret: "${GATEWAY_SECRET}"


rate_limit:
  global_rps: 50000
  per_ip_rps: 1000
  per_ip_burst: 2000

# Security Configuration
waf:
  enabled: true
  block_sqli: true
  block_xss: true
  block_nosqli: true
  block_cmdi: true
  block_traversal: true
  block_ldap: true
  block_ssti: true

query_cost:
  max_cost_per_query: 1000
  base_cost_per_field: 1
  expensive_percentile: 0.95
  adaptive_costs: true

disable_introspection: false # Set to true in production

# ────────────────────────────────────────────────────────────────────
# Zero-Trust Mutual TLS (mTLS)
# ────────────────────────────────────────────────────────────────────
# When enabled, the gateway and subgraphs cryptographically authenticate
# each other using short-lived SPIFFE SVIDs. This replaces the shared
# GATEWAY_SECRET with a zero-trust model where identities are verified
# via X.509 certificates.
mtls:
  enabled: true
  trust_domain: "cluster.local"
  service_name: "router"
  namespace: "default"
  cert_ttl_secs: 3600
  verify_hostname: true
  allow_fallback: false
  # trust_bundle_path: "/etc/certs/ca.pem"
  # ca_cert_path: "/etc/certs/ca.pem"
  # ca_key_path: "/etc/certs/ca-key.pem"

# ────────────────────────────────────────────────────────────────────
# WebAssembly (WASM) Plugin Sandboxing
# ────────────────────────────────────────────────────────────────────
# Extend the gateway with custom logic written in any language that
# compiles to WASM (Rust, Go, AssemblyScript, C/C++, etc.).
# Each plugin runs in a strictly sandboxed environment with its own
# memory and CPU budget, so a faulty plugin cannot crash the router.
#
# Enable with: cargo build --features wasm
wasm_plugins:
  # Directory to auto-discover .wasm plugins from
  # plugin_dir: "./plugins"

  # Explicit plugin definitions with per-plugin configuration
  plugins:
    - name: "auth-handler"
      path: "plugins/auth.wasm"
      max_memory_bytes: 16777216   # 16 MB
      max_fuel: 1000000            # CPU instruction budget per invocation
      config:
        api_key_header: "X-API-Key"
        allowed_origins: ["https://app.example.com"]

    - name: "rate-limiter"
      path: "plugins/rate_limiter.wasm"
      max_memory_bytes: 8388608    # 8 MB
      max_fuel: 500000
      config:
        window_seconds: 60
        max_requests: 100

    # - name: "custom-routing"
    #   path: "plugins/routing.wasm"
    #   max_memory_bytes: 33554432 # 32 MB
    #   max_fuel: 2000000
    #   config:
    #     routing_rules_url: "https://config.example.com/rules"
