# Rise Backend Configuration
#
# This configuration file supports environment variable substitution using the syntax:
#   ${VAR_NAME}              - Use environment variable, error if not set
#   ${VAR_NAME:-default}     - Use environment variable, or default if not set
#
# Examples:
#   client_secret: "${RISE_AUTH_CLIENT_SECRET:-rise-backend-secret}"
#   public_url: "${PUBLIC_URL:-http://localhost:3000}"
#
# Configuration precedence (highest to lowest):
#   1. Environment variables directly referenced with ${VAR} in config
#   2. local.yaml (not checked into git, for local overrides)
#   3. {RISE_CONFIG_RUN_MODE}.yaml (development.yaml, production.yaml, etc.)
#   4. default.yaml (this file)
#
# Special cases:
#   - DATABASE_URL environment variable is always read directly (no ${} needed)
#

server:
  host: "0.0.0.0"
  port: 3000
  public_url: "http://localhost:3000"
  cookie_domain: ""  # Empty = current host only (good for localhost)
  cookie_secure: true
  jwt_signing_secret: "${RISE_JWT_SIGNING_SECRET}" # Generate with openssl rand -base64 32
  jwt_claims: ["sub", "email", "name"]

database:
  # DATABASE_URL environment variable is always used if set
  # No ${} substitution needed - this is a special case for compatibility
  url: ""

# encryption:
#   type: "aws-kms"
#   region: "us-east-1"
#   key_id: "arn:aws:kms:us-east-1:123456789012:key/abcd-1234-5678-90ef-ghij"
#   # Backend uses its existing IAM identity (IRSA/instance profile)
#   # Ensure the backend role has kms:Encrypt and kms:Decrypt permissions
#   # Optional: static credentials (development only)
#   # access_key_id: "AKIAIOSFODNN7EXAMPLE"
#   # secret_access_key: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"

# auth:
#   issuer: "http://localhost:5556/dex"
#   client_id: "rise-backend"
#   client_secret: "${RISE_AUTH_CLIENT_SECRET}"
#   admin_users:
#     - "admin@example.com"
#   # Optional: Custom OAuth2 endpoints (if not set, will be discovered from issuer/.well-known/openid-configuration)
#   # For Entra ID/Azure AD, use:
#   authorize_url: "https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/authorize"
#   token_url: "https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token"

# Controller loop intervals (in seconds) - optional, all have defaults
controller: {}
  # How often to check for deployments to reconcile (default: 5)
  # reconcile_interval_secs: 5
  # How often to perform health checks on active deployments (default: 5)
  # health_check_interval_secs: 5
  # How often to process terminating deployments (default: 5)
  # termination_interval_secs: 5
  # How often to process cancelling deployments (default: 5)
  # cancellation_interval_secs: 5
  # How often to check for expired deployments (default: 60)
  # expiration_interval_secs: 60
  # How often to refresh Kubernetes image pull secrets (default: 3600)
  # secret_refresh_interval_secs: 3600

# registry:
#   type: "ecr"
#   region: "us-east-1"
#   account_id: "123456789012"
#   access_key_id: "AKIAIOSFODNN7EXAMPLE"  # Optional: static credentials (use IAM role in production)
#   secret_access_key: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
#   repo_prefix: "rise/"
#   role_arn: "arn:aws:iam::123456789012:policy/rise-backend"
#   push_role_arn: "arn:aws:iam::123456789012:role/rise-backend-ecr-push"
#   auto_remove: true

# Deployment controller configuration
# Default configuration is set up for local Minikube development
# For local development with Minikube, run: mise minikube:launch
deployment_controller:
  type: "kubernetes"
  ingress_class: "nginx"
  production_ingress_url_template: "{project_name}.rise.local"
  staging_ingress_url_template: "{project_name}-{deployment_group}.preview.rise.local"
  namespace_format: "rise-{project_name}"

  # Example for Kubernetes deployment of Rise in production:
  # auth_backend_url: "http://rise-backend.default.svc.cluster.local:3000"  # Internal cluster URL
  # auth_signin_url: "https://rise.example.com"  # Public API URL

  # Optional: Labels to apply to all managed namespaces
  # namespace_labels:
  #   environment: "production"
  #   team: "platform"

  # Optional: Annotations to apply to all managed namespaces
  # namespace_annotations:
  #   company.com/team: "platform"
  #   cost-center: "engineering"

  # Optional: Ingress annotations (e.g., for cert-manager TLS certificates)
  # ingress_annotations:
  #   cert-manager.io/cluster-issuer: "letsencrypt-prod"

  # Optional: TLS secret name for ingress certificates
  # ingress_tls_secret_name: "rise-apps-tls"

  # Optional: TLS mode for custom domains (default: "per-domain")
  # - "shared": All hosts (primary + custom domains) use ingress_tls_secret_name
  # - "per-domain": Each custom domain uses tls-{domain} secret (for cert-manager)
  # custom_domain_tls_mode: "per-domain"

  # Optional: Node selector for pod placement
  # node_selector:
  #   kubernetes.io/arch: "amd64"

  # Optional: Name of an existing imagePullSecret to use for deployments
  # If not specified:
  #   - With a registry provider (e.g., ECR): Controller creates and manages the secret
  #   - Without a registry provider: No image pull secret is used
  # If specified:
  #   - The named secret must exist in each project namespace
  #   - Controller will NOT create or manage this secret
  #   - Useful for static registries with externally-managed credentials
  # image_pull_secret_name: "my-registry-secret"
  #
  # To create the secret in each project namespace:
  #   kubectl create secret docker-registry my-registry-secret \
  #     --docker-server=registry.example.com \
  #     --docker-username=myuser \
  #     --docker-password=mypassword \
  #     -n rise-my-project

  # Access classes define ingress authentication levels
  # Each project must be assigned to one of these access classes
  access_classes:
    public:
      display_name: "Public"
      description: "Fully public - no authentication required."
      ingress_class: "nginx"
      access_requirement: None
    authenticated:
      display_name: "Authenticated"
      description: "Requires authentication but not project membership."
      ingress_class: "nginx"
      access_requirement: Authenticated
    private:
      display_name: "Private"
      description: "Requires authentication and project membership."
      ingress_class: "nginx"
      access_requirement: Member
