# yaml-language-server: $schema=../docs/schemas/backend-settings.schema.json
# Production configuration example.
#
# This file is intentionally complete (not layered on a base config).
# Copy to local.yaml if you need machine-specific overrides.

server:
  host: "0.0.0.0"
  port: 3000
  public_url: "${PUBLIC_URL}"
  cookie_domain: "${COOKIE_DOMAIN:-}"
  cookie_secure: true
  jwt_signing_secret: "${RISE_JWT_SIGNING_SECRET}" # Generate with: openssl rand -base64 32
  jwt_claims: ["sub", "email", "name"]

database:
  url: "${DATABASE_URL}"

auth:
  issuer: "${OIDC_ISSUER}"
  client_id: "${OIDC_CLIENT_ID:-rise-backend}"
  client_secret: "${OIDC_CLIENT_SECRET}"
  admin_users:
    - "${ADMIN_EMAIL:-admin@example.com}"
  # Optional: enable active sync to pull users/groups from Entra ID.
  # Requires Microsoft Graph API permissions: Application.Read.All, GroupMember.Read.All, User.Read.All
  # active_sync_source: Entra
  # active_sync_interval_secs: 300

controller: {}

registry:
  type: "ecr"
  region: "${AWS_REGION:-us-east-1}"
  account_id: "${AWS_ACCOUNT_ID}"
  repo_prefix: "${ECR_REPO_PREFIX:-rise/}"
  role_arn: "${ECR_CONTROLLER_ROLE_ARN}"
  push_role_arn: "${ECR_PUSH_ROLE_ARN}"
  auto_remove: false

encryption:
  type: "aws-kms"
  region: "${AWS_REGION:-us-east-1}"
  key_id: "${KMS_KEY_ID}"

deployment_controller:
  type: "kubernetes"
  production_ingress_url_template: "${RISE_PRODUCTION_INGRESS_URL_TEMPLATE:-{project_name}.apps.rise.dev}"
  staging_ingress_url_template: "${RISE_STAGING_INGRESS_URL_TEMPLATE:-{project_name}-{deployment_group}.preview.rise.dev}"
  namespace_format: "${RISE_NAMESPACE_FORMAT:-rise-{project_name}}"
  auth_backend_url: "${RISE_AUTH_BACKEND_URL}"
  auth_signin_url: "${PUBLIC_URL}"
  # Optional extra projected service account tokens mounted in every app pod at
  # /var/run/secrets/rise/tokens/<name>
  # extra_service_token_audiences:
  #   vault: "https://vault.example.com"
  network_policy:
    ingress:
      # Allow traffic from ingress-nginx
      - from:
          - namespaceSelector:
              matchLabels:
                kubernetes.io/metadata.name: ingress-nginx
            podSelector:
              matchLabels:
                app.kubernetes.io/name: ingress-nginx
      # Allow intra-namespace traffic
      - from:
          - podSelector:
              matchLabels: {}
    # null = no egress restrictions (all outbound traffic allowed)
    egress: null
  access_classes:
    public:
      display_name: "Public"
      description: "Fully public - no authentication required."
      ingress_class: "${RISE_INGRESS_CLASS_PUBLIC:-nginx}"
      access_requirement: None
    authenticated:
      display_name: "Authenticated"
      description: "Requires authentication but not project membership."
      ingress_class: "${RISE_INGRESS_CLASS_AUTHENTICATED:-nginx}"
      access_requirement: Authenticated
    private:
      display_name: "Private"
      description: "Requires authentication and project membership."
      ingress_class: "${RISE_INGRESS_CLASS_PRIVATE:-nginx}"
      access_requirement: Member
