server:
  port: 8081

spring:
  servlet:
    multipart:
      max-file-size: 200MB
      max-request-size: 200MB
  datasource:
    url: ${SPRING_DATASOURCE_URL:jdbc:postgresql://localhost:5432/cameleer?currentSchema=tenant_${cameleer.server.tenant.id}&ApplicationName=tenant_${cameleer.server.tenant.id}}
    username: ${SPRING_DATASOURCE_USERNAME:cameleer}
    password: ${SPRING_DATASOURCE_PASSWORD:cameleer_dev}
    driver-class-name: org.postgresql.Driver
  flyway:
    enabled: true
    locations: classpath:db/migration
    create-schemas: true
  mvc:
    async:
      request-timeout: -1
  mustache:
    check-template-location: false
  jackson:
    serialization:
      write-dates-as-timestamps: false
    deserialization:
      fail-on-unknown-properties: false

cameleer:
  server:
    tenant:
      id: ${CAMELEER_SERVER_TENANT_ID:default}
    agentregistry:
      heartbeatintervalms: 30000
      stalethresholdms: 90000
      deadthresholdms: 300000
      pingintervalms: 15000
      commandexpiryms: 60000
      lifecyclecheckintervalms: 10000
    ingestion:
      buffercapacity: 50000
      batchsize: 5000
      flushintervalms: 5000
      bodysizelimit: ${CAMELEER_SERVER_INGESTION_BODYSIZELIMIT:16384}
    runtime:
      enabled: ${CAMELEER_SERVER_RUNTIME_ENABLED:true}
      jarstoragepath: ${CAMELEER_SERVER_RUNTIME_JARSTORAGEPATH:/data/jars}
      baseimage: ${CAMELEER_SERVER_RUNTIME_BASEIMAGE:registry.cameleer.io/cameleer/cameleer-runtime-base:latest}
      dockernetwork: ${CAMELEER_SERVER_RUNTIME_DOCKERNETWORK:cameleer}
      # Container runtime override. Empty (default) auto-detects: uses runsc
      # (gVisor) if the daemon has it registered, otherwise the daemon default
      # (runc). Set to a registered runtime name (e.g. "kata", "runc") to
      # force a specific runtime. See issue #152 for the threat model.
      dockerruntime: ${CAMELEER_SERVER_RUNTIME_DOCKERRUNTIME:}
      agenthealthport: 9464
      healthchecktimeout: 60
      container:
        memorylimit: ${CAMELEER_SERVER_RUNTIME_CONTAINER_MEMORYLIMIT:512m}
        cpushares: ${CAMELEER_SERVER_RUNTIME_CONTAINER_CPUSHARES:512}
      routingmode: ${CAMELEER_SERVER_RUNTIME_ROUTINGMODE:path}
      routingdomain: ${CAMELEER_SERVER_RUNTIME_ROUTINGDOMAIN:localhost}
      serverurl: ${CAMELEER_SERVER_RUNTIME_SERVERURL:}
      certresolver: ${CAMELEER_SERVER_RUNTIME_CERTRESOLVER:}
      # Init-container loader for tenant JAR fetch. The loader runs as a
      # short-lived sidecar that downloads the JAR from a signed URL into a
      # per-replica named volume, which the main container then mounts RO at
      # /app/jars. See issue #152 close-out + .claude/rules/docker-orchestration.md.
      loaderimage: ${CAMELEER_SERVER_RUNTIME_LOADERIMAGE:registry.cameleer.io/cameleer/cameleer-runtime-loader:latest}
      artifacttokenttlseconds: ${CAMELEER_SERVER_RUNTIME_ARTIFACTTOKENTTLSECONDS:600}
      artifactbaseurl: ${CAMELEER_SERVER_RUNTIME_ARTIFACTBASEURL:}
    indexer:
      debouncems: ${CAMELEER_SERVER_INDEXER_DEBOUNCEMS:2000}
      queuesize: ${CAMELEER_SERVER_INDEXER_QUEUESIZE:10000}
    catalog:
      discoveryttldays: ${CAMELEER_SERVER_CATALOG_DISCOVERYTTLDAYS:7}
    license:
      token: ${CAMELEER_SERVER_LICENSE_TOKEN:}
      file: ${CAMELEER_SERVER_LICENSE_FILE:}
      publickey: ${CAMELEER_SERVER_LICENSE_PUBLICKEY:}
    security:
      accesstokenexpiryms: 3600000
      refreshtokenexpiryms: 604800000
      bootstraptoken: ${CAMELEER_SERVER_SECURITY_BOOTSTRAPTOKEN:}
      bootstraptokenprevious: ${CAMELEER_SERVER_SECURITY_BOOTSTRAPTOKENPREVIOUS:}
      uiuser: ${CAMELEER_SERVER_SECURITY_UIUSER:admin}
      uipassword: ${CAMELEER_SERVER_SECURITY_UIPASSWORD:admin}
      uiorigin: ${CAMELEER_SERVER_SECURITY_UIORIGIN:http://localhost:5173}
      jwtsecret: ${CAMELEER_SERVER_SECURITY_JWTSECRET:}
      corsallowedorigins: ${CAMELEER_SERVER_SECURITY_CORSALLOWEDORIGINS:}
      infrastructureendpoints: ${CAMELEER_SERVER_SECURITY_INFRASTRUCTUREENDPOINTS:true}
      oidc:
        issueruri: ${CAMELEER_SERVER_SECURITY_OIDC_ISSUERURI:}
        jwkseturi: ${CAMELEER_SERVER_SECURITY_OIDC_JWKSETURI:}
        audience: ${CAMELEER_SERVER_SECURITY_OIDC_AUDIENCE:}
        tlsskipverify: ${CAMELEER_SERVER_SECURITY_OIDC_TLSSKIPVERIFY:false}
    alerting:
      evaluator-tick-interval-ms: ${CAMELEER_SERVER_ALERTING_EVALUATORTICKINTERNALMS:5000}
      evaluator-batch-size: ${CAMELEER_SERVER_ALERTING_EVALUATORBATCHSIZE:20}
      claim-ttl-seconds: ${CAMELEER_SERVER_ALERTING_CLAIMTTLSECONDS:30}
      notification-tick-interval-ms: ${CAMELEER_SERVER_ALERTING_NOTIFICATIONTICKINTERNALMS:5000}
      notification-batch-size: ${CAMELEER_SERVER_ALERTING_NOTIFICATIONBATCHSIZE:50}
      in-tick-cache-enabled: ${CAMELEER_SERVER_ALERTING_INTICKCACHEENABLED:true}
      circuit-breaker-fail-threshold: ${CAMELEER_SERVER_ALERTING_CIRCUITBREAKERFAILTHRESHOLD:5}
      circuit-breaker-window-seconds: ${CAMELEER_SERVER_ALERTING_CIRCUITBREAKERWINDOWSECONDS:30}
      circuit-breaker-cooldown-seconds: ${CAMELEER_SERVER_ALERTING_CIRCUITBREAKERCOOLDOWNSECONDS:60}
      event-retention-days: ${CAMELEER_SERVER_ALERTING_EVENTRETENTIONDAYS:90}
      notification-retention-days: ${CAMELEER_SERVER_ALERTING_NOTIFICATIONRETENTIONDAYS:30}
      webhook-timeout-ms: ${CAMELEER_SERVER_ALERTING_WEBHOOKTIMEOUTMS:5000}
      webhook-max-attempts: ${CAMELEER_SERVER_ALERTING_WEBHOOKMAXATTEMPTS:3}
      # PER_EXCHANGE first-run cursor clamp: on first tick with no persisted cursor, evaluator
      # scans no further back than (now - this cap). Prevents one-time backlog flood for rules
      # whose createdAt predates a migration. Set to 0 to disable and replay from createdAt.
      per-exchange-deploy-backlog-cap-seconds: ${CAMELEER_SERVER_ALERTING_PEREXCHANGEDEPLOYBACKLOGCAPSECONDS:86400}
    outbound-http:
      trust-all: false
      trusted-ca-pem-paths: []
      default-connect-timeout-ms: 2000
      default-read-timeout-ms: 5000
      # proxy-url:
      # proxy-username:
      # proxy-password:
    clickhouse:
      url: ${CAMELEER_SERVER_CLICKHOUSE_URL:jdbc:clickhouse://localhost:8123/cameleer}
      username: ${CAMELEER_SERVER_CLICKHOUSE_USERNAME:default}
      password: ${CAMELEER_SERVER_CLICKHOUSE_PASSWORD:}
    self-metrics:
      enabled: ${CAMELEER_SERVER_SELFMETRICS_ENABLED:true}
      interval-ms: ${CAMELEER_SERVER_SELFMETRICS_INTERVALMS:60000}
    instance-id: ${CAMELEER_SERVER_INSTANCE_ID:}

springdoc:
  api-docs:
    path: /api/v1/api-docs
  swagger-ui:
    path: /api/v1/swagger-ui

logging:
  level:
    com.clickhouse: INFO
    org.apache.hc.client5: WARN

management:
  endpoints:
    web:
      base-path: /api/v1
      exposure:
        include: health,prometheus
  endpoint:
    health:
      show-details: always
