# Charybdis Configuration File
# =============================
# This file uses TOML format and supports environment variable substitution
# using ${VAR_NAME} syntax to avoid storing secrets in the config file.
#
# Copy this file to 'config.toml' and customize for your environment.

# Server Configuration
# ====================
[server]
# gRPC server bind address
# Default: "[::1]" (IPv6 localhost)
# Use "0.0.0.0" to listen on all interfaces
grpc_host = "[::1]"

# gRPC server port
# Default: 50051
grpc_port = 50051

# YAML Adapter for Backstage Integration
[server.yaml_adapter]
# Enable YAML adapter (for Backstage catalog integration)
enabled = true

# YAML adapter bind address
host = "0.0.0.0"

# YAML adapter port
port = 8080


# Database Configuration
# ======================
[database]
# PostgreSQL connection URL
# Use environment variable substitution to avoid storing credentials
# Example: postgresql://user:password@localhost:5432/dbname
url = "${DATABASE_URL}"

# Maximum number of connections in the pool
# Default: 10
max_connections = 10

# Connection timeout in seconds
# Default: 30
connection_timeout_secs = 30


# Security Configuration
# ======================
[security.mtls]
# Enable mutual TLS authentication
# When enabled, all clients must present valid certificates
# Default: false
enabled = false

# Server certificate (PEM format)
# Example: "./certs/server-cert.pem"
server_cert = "./certs/server-cert.pem"

# Server private key (PEM format)
# Example: "./certs/server-key.pem"
server_key = "./certs/server-key.pem"

# Client CA certificate for verification (PEM format)
# Example: "./certs/ca.pem"
client_ca_cert = "./certs/ca.pem"

# Require client certificate (recommended: true)
# Default: true
require_client_cert = true

# Optional: Certificate Revocation List (CRL) file
# crl_file = "./certs/crl.pem"

[security.rbac]
# Enable role-based access control
# Default: false
enabled = false

# Audit logging configuration
[security.rbac.audit]
# Enable audit logging for security events
# Default: true
enabled = true

# Log all requests (including successful ones)
# Default: true
log_all_requests = true

# Log denied requests
# Default: true
log_denied_requests = true

# Role mappings: Certificate attributes -> RBAC roles
# Note: Default roles are configured in code if this section is empty
# Uncomment to customize role mappings
#
# [[security.rbac.role_mappings]]
# role = "admin"
# [[security.rbac.role_mappings.rules]]
# [security.rbac.role_mappings.rules.subject]
# ou = "administrators"
#
# [[security.rbac.role_mappings]]
# role = "developer"
# [[security.rbac.role_mappings.rules]]
# [security.rbac.role_mappings.rules.subject]
# ou = "engineering"

# Role permissions: role -> list of permissions
# Uncomment to customize permissions
#
# [security.rbac.permissions]
# admin = ["entity:create", "entity:read", "entity:update", "entity:delete", "entity:list"]
# developer = ["entity:create", "entity:read", "entity:update", "entity:list"]
# viewer = ["entity:read", "entity:list"]


# OpenTelemetry Configuration
# ============================
[telemetry]
# Service name for telemetry
# Default: "charybdis"
service_name = "charybdis"

# Service version
# Default: "0.1.0"
service_version = "0.1.0"

# Environment name (development, staging, production)
# Default: "development"
environment = "development"

# Console output for traces/metrics (useful for development)
# Default: true
# Set to false in production
enable_console = true

# OTLP exporter configuration (for production)
[telemetry.otlp]
# Enable OTLP exporter (sends telemetry to collector)
# Default: false
enabled = false

# OTLP endpoint (without protocol prefix)
# Example: "localhost:4317"
# endpoint = "localhost:4317"

# Traces configuration
[telemetry.traces]
# Sampling ratio (0.0 to 1.0)
# 1.0 = sample all traces (development)
# 0.1 = sample 10% of traces (production)
# Default: 1.0
sampler_ratio = 1.0

# Metrics configuration
[telemetry.metrics]
# Export interval in seconds
# Default: 60
export_interval_secs = 60

# Logs configuration
[telemetry.logs]
# Log level filter
# Options: trace, debug, info, warn, error
# Default: "info"
level = "info"

# Enable JSON formatting
# Default: false
json_format = false


# Plugin Configuration
# ====================
# Plugins extend Charybdis functionality by reacting to entity lifecycle events

# DefectDojo Integration Plugin
[plugins.defectdojo]
# Enable DefectDojo plugin
enabled = false

# DefectDojo API URL
# api_url = "https://defectdojo.company.com"

# DefectDojo API key (use environment variable)
# api_key = "${DEFECTDOJO_API_KEY}"

# Request timeout in seconds
# timeout_secs = 30

# Event handlers
# [[plugins.defectdojo.on_entity_created]]
# kind = "Service"
# action = "create_product"
# auto_create_engagement = true
#
# [[plugins.defectdojo.on_entity_updated]]
# kind = "Service"
# action = "update_product"
# sync_metadata = true

# Dependency-Track Integration Plugin
[plugins.dependencytrack]
# Enable Dependency-Track plugin
enabled = false

# Dependency-Track API URL
# base_url = "https://dependencytrack.company.com"

# Dependency-Track API key (use environment variable)
# api_key = "${DEPENDENCYTRACK_API_KEY}"

# Request timeout in seconds
# timeout_secs = 30

# Auto-create projects for new Component entities
# auto_create_project = true

# Default team UUID to assign to new projects (optional)
# default_team_uuid = ""

# Keycloak Identity Provider Sync Plugin
[plugins.keycloak]
# Enable Keycloak plugin
enabled = false

# Keycloak server URL
# base_url = "https://keycloak.company.com"

# Keycloak realm to sync users and groups from
# realm = "master"

# Service account client credentials (use environment variables)
# client_id = "charybdis-sync"
# client_secret = "${KEYCLOAK_CLIENT_SECRET}"

# Sync options
# [plugins.keycloak.sync]
# Cron schedule (e.g., every 5 minutes)
# schedule = "0 */5 * * * *"

# Run sync on Charybdis startup
# on_startup = true

# Allow manual trigger via API
# manual_trigger = true

# Sync users from Keycloak
# sync_users = true

# Sync groups from Keycloak
# sync_groups = true

# Namespace to assign to synced entities
# namespace = "keycloak"

# Max results per API page
# page_size = 100

# Custom Plugin Example
# [plugins.custom_plugin]
# enabled = false
# setting1 = "value1"
# setting2 = "${CUSTOM_PLUGIN_API_KEY}"