# Insecure development configuration - DO NOT USE IN PRODUCTION.
#
# Takes precedence over values in default.yaml.

server:
  cookie_secure: false
  cookie_domain: ".rise.local"
  jwt_signing_secret: "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=" # Generate with: openssl rand -base64 32

encryption:
  type: "aes-gcm-256"
  key: "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=" # Generate with: openssl rand -base64 32

auth:
  issuer: "http://localhost:5556/dex"
  client_id: "rise-backend"
  client_secret: rise-backend-secret
  admin_users:
    - "admin@example.com"

registry:
  type: "oci-client-auth"
  registry_url: "rise-registry:5000"      # Internal URL for deployment controllers
  namespace: "rise-apps"
  client_registry_url: "localhost:5000"   # Client-facing URL for CLI push operations

deployment_controller:
  auth_backend_url: "http://host.minikube.internal:3000"  # URL for Nginx auth subrequests (Docker bridge IP for Minikube to reach host)
  auth_signin_url: "http://rise.local:3000"  # Domain for user-facing OAuth redirects
  ingress_annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
  ingress_port: 8080 # `mise minikube:launch` port-forwards the ingress controller to this port
  ingress_schema: "http" # Use http for local development (defaults to https in production)
