# yaml-language-server: $schema=../docs/schemas/backend-settings.schema.json
# Insecure development configuration - DO NOT USE IN PRODUCTION.

server:
  host: "0.0.0.0"
  port: 3000
  public_url: "http://rise.local:3000"
  frontend_dev_proxy_url: "http://localhost:5173"
  cookie_domain: "" # Empty = current host only (for localhost:3000 access)
  cookie_secure: false
  jwt_signing_secret: "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=" # Generate with: openssl rand -base64 32
  jwt_claims: ["sub", "email", "name"]
  static_dir: "${RISE_STATIC_DIR:-static}" # In-container: /var/lib/rise/static; local dev: static/
  docs_dir: "${RISE_DOCS_DIR:-docs}" # In-container: /var/rise/docs; local dev: docs/
  allow_private_networks: true # Allow HTTP and private IPs for local OIDC (Dex at localhost)

database:
  url: "${DATABASE_URL}"

encryption:
  type: "aes-gcm-256"
  key: "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=" # Generate with: openssl rand -base64 32

auth:
  issuer: "http://localhost:5556/dex"
  client_id: "rise-backend"
  client_secret: "rise-backend-secret"
  admin_users:
    - "admin@example.com"
  # Allow all users to create teams (default: true). Set to false to restrict team creation to admins only.
  allow_team_creation: true
  # Allow all users to list all teams (default: true). Set to false so non-admins only see their own teams.
  allow_list_all_teams: true
  platform_access:
    policy: restrictive
    allowed_user_emails:
      - "admin@example.com"
      - "dev@example.com"

controller: {}

registry:
  type: "oci-client-auth"
  registry_url: "rise-registry:5000" # Internal URL for deployment controllers
  namespace: "rise-apps"
  client_registry_url: "rise-registry:5000" # Client-facing URL for CLI push operations

deployment_controller:
  type: "kubernetes"
  production_ingress_url_template: "{project_name}.rise.local"
  staging_ingress_url_template: "{project_name}-{deployment_group}.preview.rise.local"
  namespace_format: "rise-{project_name}"
  auth_backend_url: "http://host.minikube.internal:3000" # URL for Nginx auth subrequests (Docker bridge IP for Minikube to reach host), must be resolvable by Nginx pod
  auth_signin_url: "http://rise.local:3000" # Domain for user-facing OAuth redirects, must be resolvable by users' browsers
  ingress_annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
  ingress_port: 8080 # `mise minikube:up` port-forwards ingress to this port
  ingress_schema: "http" # Use http for local development
  host_aliases:
    rise.local: "192.168.49.1" # Minikube host IP, allowing app pods to access Rise backend
  # Extra projected service account tokens mounted in every app pod at
  # /var/run/secrets/rise/tokens/<name>
  # extra_service_token_audiences:
  #   vault: "https://vault.example.com"
  network_policy:
    ingress:
      # Allow traffic from ingress-nginx
      - from:
          - namespaceSelector:
              matchLabels:
                kubernetes.io/metadata.name: ingress-nginx
            podSelector:
              matchLabels:
                app.kubernetes.io/name: ingress-nginx
      # Allow intra-namespace traffic
      - from:
          - podSelector:
              matchLabels: {}
    # null = no egress restrictions (all outbound traffic allowed)
    egress: null
  access_classes:
    public:
      display_name: "Public"
      description: "Fully public - no authentication required."
      ingress_class: "nginx"
      access_requirement: None
    authenticated:
      display_name: "Authenticated"
      description: "Requires authentication but not project membership."
      ingress_class: "nginx"
      access_requirement: Authenticated
    private:
      display_name: "Private"
      description: "Requires authentication and project membership."
      ingress_class: "nginx"
      access_requirement: Member
