# Garage UI Backend Configuration

# Server configuration
server:
  host: "::" # IPv6 wildcard; dual-stack behavior depends on OS/runtime socket settings
  port: 8080
  environment: "development" # development, production
  domain: "localhost" # Domain name for the application
  protocol: "http" # Protocol for internal communication (http/https)
  root_url: "http://localhost:8080" # Full external URL for OAuth2 redirects (adjust for production)

  # Request size limits (in bytes)
  max_body_size: 314572800 # 300MB - Maximum request body size (increase for large file uploads)
  max_header_size: 1048576 # 1MB - Maximum request header size
  read_buffer_size: 4096 # 4KB - Read buffer size
  write_buffer_size: 4096 # 4KB - Write buffer size

# Garage S3 Configuration
garage:
  endpoint: "http://localhost:3900" # Garage S3 API endpoint
  region: "eu-west-1" # S3 region (ensure it matches Garage S3 configuration)

  # Garage Admin API configuration
  admin_endpoint: "http://localhost:3903" # Garage Admin API endpoint
  admin_token: "changeme" # Admin API bearer token

# Authentication Configuration
# You can enable one or both authentication methods
auth:
  # JWT Configuration
  # Ed25519 private key in PEM format for JWT token signing
  # If not specified, a new key will be generated on each startup (tokens won't persist across restarts)
  # Generate with: openssl genpkey -algorithm ED25519 -out jwt-key.pem
  # The key is a 64-byte Ed25519 private key
  jwt_private_key: "" # Leave empty to auto-generate, or provide PEM-encoded Ed25519 private key

  # Expose Prometheus metrics at top-level /metrics WITHOUT authentication.
  # Needed for Prometheus to scrape when auth (admin/token/oidc) is enabled.
  # WARNING: exposes operational cluster telemetry (no object data or secrets)
  # to anyone who can reach the port. Restrict with a NetworkPolicy / firewall.
  metrics_public: false # Set to true to serve /metrics unauthenticated

  # Admin Authentication (username/password)
  admin:
    enabled: false # Set to true to enable admin login
    username: "admin"
    password: "changeme"

  # Admin Token Authentication
  # When enabled, users can log in using the Garage admin token
  # Auto-enabled when no other auth method is configured (zero-config fallback)
  token:
    enabled: false # Set to true to explicitly enable, or leave all auth disabled for auto-enable

  # OIDC Configuration
  # NOTE: When OIDC is enabled, server.root_url is required for OAuth2 redirects
  # The redirect URL will be automatically constructed as: {root_url}/auth/oidc/callback
  oidc:
    enabled: false # Set to true to enable OIDC login
    provider_name: "Keycloak"
    client_id: "garage-ui"
    client_secret: "your-client-secret"

    # OIDC scopes to request
    scopes:
      - openid
      - email
      - profile

    # OIDC Provider URLs
    issuer_url: "https://keycloak.example.com/realms/master"

    # Token validation
    skip_issuer_check: false
    skip_expiry_check: false

    # Attribute mappings
    email_attribute: "email"
    username_attribute: "preferred_username"
    name_attribute: "name"

    # Role-based access (optional)
    role_attribute_path: "resource_access.garage-ui.roles"
    # Team-based access control (optional, see access_control below).
    # team_attribute_path: "groups"
    # Single admin role (backward-compatible).
    admin_role: "admin"
    # Multiple admin roles: a user is granted admin if ANY of their roles
    # matches ANY entry below. Values from admin_role and admin_roles are
    # merged, so you can set either, both, or only admin_roles.
    # admin_roles:
    #   - "garage-admins"
    #   - "platform-team"

    # TLS configuration
    tls_skip_verify: false # Only set to true for testing, not recommended for production

    # Session configuration
    session_max_age: 86400 # 24 hours in seconds
    cookie_name: "garage_session"
    cookie_secure: false # Set to true in production with HTTPS
    cookie_http_only: true
    cookie_same_site: "lax" # lax, strict, none

# Optional: team-based access control (see docs/access-control.md).
# Absent  -> every authenticated user has full access.
# Present -> default-deny: OIDC users get only what their teams grant; users
#            matching no team get 403 everywhere. admin_role users, admin
#            password logins, and token logins are always full-admin.
# NOTE: this is UI-layer policy, NOT a security boundary. Anyone holding the
# Garage admin token or S3 keys bypasses it entirely.
#
# access_control:
#   presets:
#     bucket_readonly: [bucket.list, bucket.read, object.list, object.read]
#     bucket_owner: ["preset:bucket_readonly", bucket.create, bucket.update,
#                    bucket.delete, object.write, object.delete]
#   teams:
#     - name: backend
#       claim_values: ["garage-team-backend"]   # matched against team_attribute_path claim
#       bindings:
#         - bucket_prefixes: ["backend-"]
#           permissions: ["preset:bucket_owner"]
#         - bucket_prefixes: ["shared-"]
#           permissions: ["preset:bucket_readonly"]
#       cluster_permissions: [cluster.status, cluster.health]

# CORS Configuration (for frontend)
cors:
  enabled: true
  allowed_origins:
    - "*" # Vite default
  allowed_methods:
    - GET
    - POST
    - PUT
    - DELETE
    - OPTIONS
  allowed_headers:
    - Origin
    - Content-Type
    - Accept
    - Authorization
  allow_credentials: false
  max_age: 3600

# Logging Configuration
# The application uses zerolog for structured logging
logging:
  level: "info" # Options: debug, info, warn, error
  format: "text" or "json"