# OmniStream configuration template.
# Place at $XDG_CONFIG_HOME/omni-stream/config.toml,
# or set OMNI_CONFIG=/path/to/config.toml.

[server]
# Use host = "0.0.0.0" to allow external access. Default is "127.0.0.1", which
# only allows access from localhost.
host = "127.0.0.1"
port = 28080

# Optional bearer-token gate on /api/*. When disabled (default), the API is
# open to anyone who can reach the port. Enable for internal-tool deployment.
# The token can also be supplied via the OMNI_AUTH_TOKEN environment variable.
[auth]
enabled = false
# token = "replace-with-a-long-random-string"

# Define one or more storage backends. The entry with `active = true` is used;
# if none is active, the first entry is the default.
#
# Common fields:
#   name      Display name shown in the UI / used in /api?storage=<name>.
#   type      "s3" or "local".
#   active    Exactly one entry should be true; that one is served by default.

# ---- S3-compatible backend ----------------------------------------------
# Talks to AWS S3 or any S3-compatible gateway (MinIO, Ceph, AOSS, OSS, COS).
#
# s3 fields:
#   endpoint          Optional override. Omit for real AWS; set for self-hosted
#                     gateways. Use the *-internal variant when running inside
#                     the same VPC to avoid public-endpoint quotas / throttling.
#   bucket            Optional. When set, the storage pins to that bucket
#                     (bucket name only — no scheme, no slashes). When omitted
#                     or set to "*", the storage enters multi-bucket mode: the
#                     root listing performs ListBuckets and each bucket the
#                     credentials can see appears as a top-level directory.
#                     Multi-bucket mode requires the `s3:ListAllMyBuckets`
#                     IAM permission.
#   access_key,
#   secret_key        Static credentials. Prefer env-injected values over
#                     committing plaintext here.
#   region            Optional. Defaults to "us-east-1". Set this when:
#                     (1) the target AWS bucket lives outside us-east-1 —
#                         SigV4 has to match the bucket's actual region or
#                         AWS returns AuthorizationHeaderMalformed; or
#                     (2) an S3-compatible gateway validates the region
#                         strictly (most don't — MinIO / LocalStack accept
#                         any value, and the us-east-1 default is enough).
#   force_path_style  Default true. Path-style URL = `endpoint/bucket/key`,
#                     used by MinIO / LocalStack / Ceph. Set false to switch to
#                     virtual-host style (`bucket.endpoint/key`), required by
#                     some gateways such as AOSS-internal that only resolve
#                     `*.bucket-host` and reject path-style.
[[storages]]
name = "production-s3"
type = "s3"
active = true
s3 = { endpoint = "http://localhost:9000", bucket = "my-bucket", access_key = "minioadmin", secret_key = "minioadmin", force_path_style = true }

# Multi-bucket variant: `bucket` is omitted, so the storage root performs
# ListBuckets and each bucket shows up as a top-level folder in the UI.
# Useful when the credentials grant access to many buckets and you don't
# want a separate [[storages]] entry per bucket.
# [[storages]]
# name = "all-prod-s3"
# type = "s3"
# s3 = { endpoint = "http://localhost:9000", access_key = "minioadmin", secret_key = "minioadmin", force_path_style = true }

# ---- Local filesystem backend -------------------------------------------
# Serves files under a directory on the host.
#
# local fields:
#   root_path         Required. Absolute path or `~` / `~/sub/dir` — a leading
#                     tilde is expanded to $HOME at config-load time. Path
#                     traversal (`..`) outside this root is rejected.
#   follow_symlinks   Default true. When true, symlinks under root are followed
#                     transparently (a symlinked directory shows as a directory
#                     in listings). When false, symlinks are surfaced as their
#                     own entries and reading them returns Forbidden — useful
#                     when root contains untrusted user-controlled paths.
[[storages]]
name = "local-data"
type = "local"
active = false
local = { root_path = "/var/lib/omni-stream", follow_symlinks = true }

# Environment overrides (prefix OMNI_, separator _):
#   OMNI_SERVER_HOST, OMNI_SERVER_PORT
