# yaml-language-server: $schema=../docs/engineering/public/schemas/backend-settings.schema.json
# Insecure development configuration - DO NOT USE IN PRODUCTION.

server:
  host: "0.0.0.0"
  port: 3000
  public_url: "http://rise.local:3000"
  frontend_dev_proxy_url: "http://localhost:5173"
  cookie_secure: false
  jwt_signing_secret: "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=" # Generate with: openssl rand -base64 32
  jwt_claims: ["sub", "email", "name"]
  static_dir: "${RISE_STATIC_DIR:-static}" # In-container: /var/lib/rise/static; local dev: static/
  docs_dir: "${RISE_DOCS_DIR:-docs/user/dist}" # In-container: /var/rise/docs; local dev: build with `mise docs:build`
  ssrf:
    allow_private_networks: true # Allow private IPs for local OIDC (Dex at localhost)
    allow_http: true # Allow HTTP for local development

database:
  url: "${DATABASE_URL}"

# Default Organization bootstrapped on startup. Setting
# `kubernetes_namespace_prefix: "rise-"` explicitly so dev namespaces keep
# the historic `rise-{project}` naming; otherwise the controller would fall
# back to `org-{discriminator}-{project}` and orphan any existing namespaces.
default_organization:
  kubernetes_namespace_prefix: "rise-"

encryption:
  type: "aes-gcm-256"
  key: "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=" # Generate with: openssl rand -base64 32

auth:
  issuer: "http://localhost:5556/dex"
  client_id: "rise-backend"
  client_secret: "rise-backend-secret"
  admin_users:
    - "admin@example.com"
  # Operator role allowlist. Separate from admin_users — an Operator must
  # also be listed in admin_users or platform_access.allowed_user_emails to
  # use the typed CLI/UI (e.g. to log in via the frontend).
  operator_users:
    - "ops@example.com"
  # Allow all users to create teams (default: true). Set to false to restrict team creation to admins only.
  allow_team_creation: true
  # Allow all users to list all teams (default: true). Set to false so non-admins only see their own teams.
  allow_list_all_teams: true
  platform_access:
    policy: restrictive
    allowed_user_emails:
      - "admin@example.com"
      - "dev@example.com"
      - "ops@example.com"

registry:
  type: "oci-client-auth"
  registry_url: "rise-registry:5000" # Internal URL for deployment controllers
  namespace: "rise-apps"
  client_registry_url: "rise-registry:5000" # Client-facing URL for CLI push operations

deployment_logs:
  type: "loki"
  url: "${RISE_LOKI_URL:-http://localhost:3100}"
  retention_hint: "168h"

# JFrog Artifactory registry (via Vault):
# registry:
#   type: "jfrog"
#   registry_host: "rise-jfrog:8082"
#   client_registry_url: "localhost:3082"
#   docker_repo_key: "rise-docker-local"
#   token_provider:
#     type: "vault"
#     vault_mount_path: "artifactory"
#     vault_role: "rise"
#     # scope_override: true       # default; requires the Rise Vault plugin fork with allowed_scopes
#   # push_permissions: "r,w"     # default (ignored when scope_override=false)
#   # pull_permissions: "r"       # default (ignored when scope_override=false)
#   # push_token_ttl: 600         # push token TTL in seconds (default: 600)
#   # pull_token_ttl: 86400       # pull token TTL in seconds (default: 86400 = 24h)

# JFrog Artifactory registry (via Direct token):
# registry:
#   type: "jfrog"
#   registry_host: "rise-jfrog:8082"
#   client_registry_url: "localhost:3082"
#   docker_repo_key: "rise-docker-local"
#   token_provider:
#     type: "direct"
#     jfrog_url: "http://localhost:3082"
#     admin_token: "${JFROG_ADMIN_TOKEN}"

deployment_controller:
  type: "kubernetes"
  pod_security_enabled: false
  metacontroller_webhook_port: 3001
  # Must match `metacontroller.controllerClass` in the helm chart; otherwise
  # RiseProject CR labels and the CompositeController labelSelector drift and
  # Metacontroller stops reconciling. Default value of the field is the same,
  # set here explicitly so the alignment is visible.
  controller_class_name: "default"
  # metacontroller_pod_namespace is intentionally absent in development:
  # Rise runs on the host (outside the cluster), so source-IP validation is skipped.
  production_ingress_url_template: "{project_name}.rise.local"
  staging_ingress_url_template: "{deployment_group}--{project_name}.preview.rise.local"
  environment_ingress_url_template: "{environment}--{project_name}.env.rise.local"
  auth_backend_url: "${RISE_AUTH_BACKEND_URL:-http://host.minikube.internal:3000}" # URL for Nginx auth subrequests, must be reachable from ingress-nginx pods
  auth_signin_url: "http://rise.local:3000" # Domain for user-facing OAuth redirects, must be resolvable by users' browsers
  ingress_annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
  ingress_port: 8080 # `mise setup minikube` (or `mise setup pf`) port-forwards ingress to this port
  ingress_schema: "http" # Use http for local development
  # Empty selector: pods schedule on whatever node arch the local cluster has
  # (minikube typically has one node, matching the host). With no
  # `kubernetes.io/arch` pin, the backend omits the platform hint to the CLI,
  # which then falls back to host architecture. Net effect: `rise deploy` from
  # an ARM Mac builds linux/arm64, from Intel builds linux/amd64 — no per-machine
  # config tweak needed.
  node_selector: {}
  host_aliases:
    rise.local: "${RISE_K8S_HOST_IP:-192.168.49.1}" # Host IP reachable from Kubernetes pods
  # Extra projected service account tokens mounted in every app pod at
  # /var/run/secrets/rise/tokens/<name>
  # extra_service_token_audiences:
  #   vault: "https://vault.example.com"
  network_policy:
    ingress:
      # Allow traffic from ingress-nginx
      - from:
          - namespaceSelector:
              matchLabels:
                kubernetes.io/metadata.name: ingress-nginx
            podSelector:
              matchLabels:
                app.kubernetes.io/name: ingress-nginx
      # Allow intra-namespace traffic
      - from:
          - podSelector:
              matchLabels: {}
    # null = no egress restrictions (all outbound traffic allowed)
    egress: null
  access_classes:
    public:
      display_name: "Public"
      description: "Fully public - no authentication required."
      ingress_class: "nginx"
      access_requirement: None
    authenticated:
      display_name: "Authenticated"
      description: "Requires authentication but not project membership."
      ingress_class: "nginx"
      access_requirement: Authenticated
    private:
      display_name: "Private"
      description: "Requires authentication and project membership."
      ingress_class: "nginx"
      access_requirement: Member
