# Example nbox configuration.
#
# Real config lives at ~/.config/nbox/config.toml (Linux/macOS) or
# %APPDATA%\nbox\config.toml (Windows) — create it with `nbox config init`.
# Tokens can be stored here as `token = "..."` for the normal desktop/TUI flow,
# or kept outside the file with `token_env` / NBOX_TOKEN. Env vars override saved
# config/keyring tokens.

config_version = 1
active_profile = "work"

# Logging (optional). Default: stderr at `warn`. stdout is never used for logs.
# log_file  = "/var/log/nbox.log"  # also write logs here (and stderr); literal path
# log_level = "info"               # warn | info | debug | trace | nbox=debug

[ui]
theme = "default"          # see `nbox` then `t` to cycle; 12 built-in themes
confirm_writes = true      # reserved for v0.2 writes
# refresh_secs = 30          # TUI auto-refresh interval in seconds (omit/0 = off)
# open_browser_command = ""  # custom browser-open command (empty = OS default)

# Local read cache (in-memory, on by default). A short de-dupe window so repeated
# reads (TUI back-nav, a chatty MCP agent) don't re-hit NetBox. Nothing on disk.
[cache]
enabled = true             # master switch
ttl_secs = 30              # reuse window in seconds (clamped to 5–300)

[profiles.work]
url = "https://netbox.example.com"
# token = "nbt_..."              # default TUI paste path; redacted by config show
token_env = "NETBOX_TOKEN"   # nbox reads the token from this env var
# token_store = "keyring"     # optional: opt into OS keyring instead of token
auth_scheme = "auto"         # auto | bearer | token (auto-detects v2 nbt_ tokens)
verify_tls = true
timeout_secs = 15
page_size = 100
exclude_config_context = true   # drop the large config_context on devices/VMs

# Per-surface backend. REST is canonical; opt a read surface into GraphQL here
# (falls back to REST if the instance's GraphQL schema can't support it). Omit
# the table for all-REST. `nbox status` shows the configured vs effective backend.
# The VRF and route-target views can use GraphQL today — search is always REST
# (NetBox GraphQL has no equivalent to REST's full-text `q`).
[profiles.work.api]
vrf = "graphql"              # rest | graphql
# route_target = "graphql"   # rest | graphql — the route target's importing/exporting VRFs

[profiles.lab]
url = "https://netbox.lab.example.com"
token_env = "NETBOX_LAB_TOKEN"
verify_tls = false           # labs with self-signed certs; never use in prod

# MCP server defaults for `nbox serve` (optional; absent = stdio, no HTTP).
# CLI flags (--http, --http-token, --oidc-issuer, …) override these. See docs/MCP.md.
# [serve]
# http = "127.0.0.1:8080"        # loopback HTTP transport; absent = stdio
# http_token is a SECRET — prefer the NBOX_SERVE_TOKEN env var over the file.
# http_token = ""                # static bearer required on /mcp
# OIDC resource-server mode (routable deployments):
# oidc_issuer   = "https://idp.example.com"
# audience      = "https://nbox.example.com"   # required with oidc_issuer
# jwks_url      = "https://idp.example.com/keys"  # absent = discover from issuer
# allowed_hosts = ["nbox.example.com"]         # extra DNS-rebinding allow-list hosts
# rate_limit    = 120                          # per-caller requests/min (0/absent = off)
