tr1d1um.yaml

---

########################################
#   Labeling/Tracing via HTTP Headers Configuration
########################################

# The unique fully-qualified-domain-name of the server.  It is provided to 
# the X-Tr1d1um-Server header for showing what server fulfilled the request 
# sent.
# (Optional)
server: "tr1d1um-local-instance-123.example.com"

# Provides this build number to the X-Tr1d1um-Build header for
# showing machine version information.  The build number SHOULD
# match the scheme `version-build` but there is not a strict requirement.
# (Optional)
build: "0.1.3-434"

# Provides the region information to the X-Tr1d1um-Region header
# for showing what region this machine is located in.  The region
# is arbitrary and optional.
# (Optional)
region: "east"

# Provides the flavor information to the X-Tr1d1um-Flavor header
# for showing what flavor this machine is associated with.  The flavor
# is arbitrary and optional.
# (Optional)
flavor: "mint"


##############################################################################
# WebPA Service configuration
##############################################################################

# For a complete view of the service config structure, 
# checkout https://godoc.org/github.com/xmidt-org/webpa-common/server#WebPA

########################################
#   Primary Endpoint Configuration
########################################

# primary provides the configuration for the main server for this application
primary:
  address: ":6100"

########################################
#   Health Endpoint Configuration
########################################

# health defines the details needed for the health check endpoint.  The
# health check endpoint is generally used by services (like AWS Route53
# or consul) to determine if this particular machine is healthy or not.
health:
  address: ":6101"

########################################
#   Debugging/Pprof Configuration
########################################

# pprof defines the details needed for the pprof debug endpoint.
# (Optional)
pprof:
  address: ":6102"

########################################
#   Metrics Configuration
########################################

# metric defines the details needed for the prometheus metrics endpoint
# (Optional)
metric:
  address: ":6103"
  metricsOptions:
    # namespace is the namespace of the metrics provided
    # (Optional)
    namespace: "webpa"

    # subsystem is the subsystem of the metrics provided
    # (Optional)
    subsystem: "tr1d1um"

########################################
#   Logging Related Configuration
########################################

# log configures the logging subsystem details
log:
  # file is the name of the most recent log file.  If set to "stdout" this
  # will log to os.Stdout.
  # (Optional) defaults to os.TempDir()
  file: "stdout"

  # level is the logging level to use - INFO, DEBUG, WARN, ERROR
  # (Optional) defaults to ERROR
  level: "DEBUG"

  # maxsize is the maximum log file size in MB
  # (Optional) defaults to max 100MB
  maxsize: 50

  # maxage is the maximum number of days to retain old log files
  # (Optional) defaults to ignore age limit (0)
  maxage: 30

  # maxbackups is the maximum number of old log files to retain
  # (Optional) defaults to retain all (0)
  maxbackups: 10

  # json is a flag indicating whether JSON logging output should be used.
  # (Optional) defaults to false
  json: true

  # reducedLoggingResponseCodes allows disabling verbose transaction logs for 
  # benign responses from the target server given HTTP status codes.
  # (Optional)
  # reducedLoggingResponseCodes: [200, 504]

##############################################################################
# Webhooks Related Configuration 
##############################################################################
# webhook provides configuration for storing and obtaining webhook
# information using Argus.
# Optional: if key is not supplied, webhooks would be disabled.
webhook:

  # validation provides options for validating the webhook's URL and TTL 
  # related fields. Some validation happens regardless of the configuration: 
  # URLs must be a valid URL structure, the Matcher.DeviceID values must 
  # compile into regular expressions, and the Events field must have at 
  # least one value and all values must compile into regular expressions. 
  validation:

    # url provides options for additional validation of the webhook's 
    # Config.URL, FailureURL, and Config.AlternativeURLs fields.
    url:
      # httpsOnly will allow only URLs with https schemes through if true.
      # (Optional). Defaults to 'false'.
      httpsOnly: false

      # allowLoopback will allow any canonical or IP loopback address if 
      # true. Otherwise, loopback addresses are considered invalid.
      # (Optional). Defaults to 'false'.
      allowLoopback: true

      # allowIP allows the different webhook URLs to have IP hostnames if set to true.
      # (Optional). Defaults to 'false'.
      allowIP: true

      # allowSpecialUseHosts allows URLs that include reserved domains if set to true.  
      # Read more here: https://en.wikipedia.org/wiki/Top-level_domain#Reserved_domains
      # (Optional). Defaults to 'false'.
      allowSpecialUseHosts: true

      # allowSpecialUseIPs, if set to true, allows URLs that contain or route to IPs that have 
      # been marked as reserved through various RFCs: rfc6761, rfc6890, rfc8190.
      # (Optional). Defaults to 'false'.
      allowSpecialUseIPs: true

      # invalidHosts is a slice that contains strings that we do not want 
      # allowed in URLs, providing a way to deny certain domains or hostnames.
      # (Optional). Defaults to an empty slice.
      invalidHosts: []

      # invalidSubnets is a list of IP subnets.  If a URL contains an 
      # IP or resolves to an IP in one of these subnets, the webhook is 
      # considered invalid.
      # (Optional). Defaults to an empty slice.
      invalidSubnets: []

    # ttl provides information for what is considered valid for time-related 
    # fields (Duration and Until) in the webhook.  A webhook set to expire 
    # too far in the future is considered invalid, while a time in the past 
    # is considered equivalent to a request to delete the webhook.  
    # Regardless of this configuration, either Until or Duration must have a 
    # non-zero value.
    ttl:
      # max is the length of time a webhook is allowed to live.  The Duration 
      # cannot be larger than this value, and the Until value cannot be set 
      # later than the current time + max + jitter.
      max: 1m

      # jitter is the buffer time added when checking that the Until value is 
      # valid.  If there is a slight clock skew between servers or some delay 
      # in the http request, jitter should help account for that when ensuring 
      # that Until is not a time too far in the future.
      jitter: 10s

  # JWTParserType establishes which parser type will be used by the JWT token
  # acquirer used by Argus. Options include 'simple' and 'raw'.
  # Simple: parser assumes token payloads have the following structure: https://github.com/xmidt-org/bascule/blob/c011b128d6b95fa8358228535c63d1945347adaa/acquire/bearer.go#L77
  # Raw: parser assumes all of the token payload == JWT token
  # (Optional). Defaults to 'simple'.
  JWTParserType: "raw"
  argus: 
    # listen is the subsection that configures the listening feature of the argus client
    # (Optional)
    listen:
      # pullInterval provides how often the current webhooks list gets refreshed.
      pullInterval: 5s

    # bucket is the partition name where webhooks will be stored.
    bucket: "webhooks"

    # address is Argus' network location.
    address: "http://localhost:6600"

    # auth the authentication method for argus.
    auth:
      # basic configures basic authentication for argus.
      # Must be of form: 'Basic xyz=='
      basic: "Basic dXNlcjpwYXNz"
  #
  #    # jwt configures jwt style authentication for argus.
  #    JWT:
  #      # requestHeaders are added to the request for the token.
  #      # (Optional)
  #      # requestHeaders:
  #      #   "": ""
  #
  #      # authURL is the URL to access the token.
  #      authURL: ""
  #
  #      # timeout is how long the request to get the token will take before
  #      # timing out.
  #      timeout: "1m"
  #
  #      # buffer is the length of time before a token expires to get a new token.
  #      buffer: "2m"

##############################################################################
# Testing Authorization Credentials
##############################################################################

# authHeader is a list of Basic Auth credentials intended to be used for local testing purposes
# WARNING! Be sure to remove this from your production config
authHeader: ["dXNlcjpwYXNz"]

# jwtValidator provides Bearer auth configuration
jwtValidator:
  keys:
    factory:
      uri: "http://localhost:6500/keys/development"
    purpose: 0
    updateInterval: 604800000000000

# capabilityCheck provides the details needed for checking an incoming JWT's
# capabilities.  If the type of check isn't provided, no checking is done.  The 
# type can be "monitor" or "enforce".  If it is empty or a different value, no 
# checking is done.  If "monitor" is provided, the capabilities are checked but 
# the request isn't rejected when there isn't a valid capability for the 
# request. Instead, a message is logged.  When "enforce" is provided, a request 
# that doesn't have the needed capability is rejected.
#
# The capability is expected to have the format:
#
# {prefix}{endpoint}:{method}
#
# The prefix can be a regular expression.  If it's empty, no capability check 
# is done.  The endpoint is a regular expression that should match the endpoint
# the request was sent to. The method is usually the method of the request, such as 
# GET.  The accept all method is a catchall string that indicates the capability 
# is approved for all methods.
# (Optional)
# capabilityCheck:
#   # type provides the mode for capability checking.
#   type: "enforce"
#   # prefix provides the regex to match the capability before the endpoint.
#   prefix: "prefix Here"
#   # acceptAllMethod provides a way to have a capability that allows all 
#   # methods for a specific endpoint.
#   acceptAllMethod: "all"
#   # endpointBuckets provides regular expressions to use against the request 
#   # endpoint in order to group requests for a metric label.
#   endpointBuckets:
#     - "hook\\b"
#     - "hooks\\b"
#     - "device/.*/stat\\b"
#     - "device/.*/config\\b"


##############################################################################
# WRP and XMiDT Cloud configurations
##############################################################################

# targetURL is the base URL of the XMiDT cluster 
targetURL: http://scytale:6300

# WRPSource is used as 'source' field for all outgoing WRP Messages
WRPSource: "dns:tr1d1um.example.com"

# supportedServices is a list of endpoints we support for the WRP producing endpoints 
# we will soon drop this configuration 
supportedServices:
  - "config"


##############################################################################
# HTTP Transaction Configurations
##############################################################################
# timeouts that apply to the Argus HTTP client.
# (Optional) By default, the values below will be used.
argusClientTimeout:
  # clientTimeout is the timeout for requests made through this 
  # HTTP client. This timeout includes connection time, any
  # redirects, and reading the response body.
  clientTimeout: 50s

  # netDialerTimeout is the maximum amount of time the HTTP Client Dialer will
  # wait for a connect to complete.
  netDialerTimeout: 5s

# timeouts that apply to the XMiDT HTTP client.
# (Optional) By default, the values below will be used.
xmidtClientTimeout:
  # clientTimeout is the timeout for the requests made through this 
  # HTTP client. This timeout includes connection time, any
  # redirects, and reading the response body.
  clientTimeout: 135s

  # requestTimeout is the timeout imposed on requests made by this client 
  # through context cancellation.
  # TODO since clientTimeouts are implemented through context cancellations,
  # we might not need this.
  requestTimeout: 129s

  # netDialerTimeout is the maximum amount of time the HTTP Client Dialer will
  # wait for a connect to complete.
  netDialerTimeout: 5s


# requestRetryInterval is the time between HTTP request retries against XMiDT 
requestRetryInterval: "2s"

# requestMaxRetries is the max number of times an HTTP request is retried against XMiDT in 
# case of ephemeral errors
requestMaxRetries: 2

# authAcquirer enables configuring the JWT or Basic auth header value factory for outgoing
# requests to XMiDT. If both types are configured, JWT will be preferred.
# (Optional)
authAcquirer:
  # JWT: 
  #   # requestHeaders are added to the request for the token.
  #   # (Optional)
  #   # requestHeaders:
  #   #   "": ""

  #   # authURL is the URL to access for the token.
  #   authURL: ""

  #   # timeout is how long the request to get the token will take before 
  #   # timing out.
  #   timeout: "1m"

  #   # buffer is the length of time before a token expires to get a new token.
  #   buffer: "2m"  
    
  Basic: "" # Must be of form: 'Basic xyz=='


# tracing provides configuration around traces using OpenTelemetry.
# (Optional). By default, a 'noop' tracer provider is used and tracing is disabled.
tracing:
  # provider is the provider name. Currently, stdout, jaegar and zipkin are supported.
  # 'noop' can also be used as provider to explicitly disable tracing.
  provider: "noop"

  # skipTraceExport only applies when provider is stdout. Set skipTraceExport to true
  # so that trace information is not written to stdout.
  # skipTraceExport: true

  # endpoint is where trace information should be routed. Applies to zipkin and jaegar.
  # endpoint: "http://localhost:9411/api/v2/spans"