application.yaml

logging:
  level:
    org.springframework: INFO
    org.springframework.security: TRACE
    org.opendevstack.apiservice.externalservice: DEBUG

# ──────────────────────────────────────────────────────────────────────────────
# Persistence — PostgreSQL datasource + JPA / Hibernate
#
# Schema is managed externally via Liquibase (database module / Makefile).
# Hibernate is set to `validate` so it only checks that entities match the
# existing schema at boot — it never creates or alters tables.
#
# Required env vars (no defaults — must be explicitly set per environment):
#   DB_HOST, DB_PORT, DB_NAME, DB_USERNAME, DB_PASSWORD
# ──────────────────────────────────────────────────────────────────────────────
spring:
  datasource:
    url: jdbc:postgresql://${DB_HOST:localhost}:${DB_PORT:5432}/${DB_NAME:devstack}
    username: ${DB_USERNAME:devstack}
    password: ${DB_PASSWORD:devstack}
    driver-class-name: org.postgresql.Driver
    hikari:
      # Pool sizing — tune per environment
      maximum-pool-size: ${DB_POOL_MAX_SIZE:10}
      minimum-idle: ${DB_POOL_MIN_IDLE:2}
      connection-timeout: 30000
      idle-timeout: 600000
      max-lifetime: 1800000
  jpa:
    hibernate:
      # NEVER auto-create/alter — Liquibase owns the schema
      ddl-auto: validate
    properties:
      hibernate:
        dialect: org.hibernate.dialect.PostgreSQLDialect
        # Log slow queries (> 500 ms) via Hibernate statistics
        generate_statistics: false
    # Avoid lazy-loading pitfalls: keep Session scoped to Service, not Request
    open-in-view: false
    show-sql: false

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: https://sts.windows.net/${AZURE_TENANT_ID}/

app:
  security:
    public-endpoints:
      - /actuator/health
      - /actuator/health/**

management:
  endpoints:
    web:
      exposure:
        include: openapi, swagger-ui, beans, caches, configprops, env, health, httpexchanges, info, loggers, mappings
  endpoint:
    configprops:
      show-values: always
    env:
      show-values: always
    loggers:
      access: unrestricted
    health:
      show-details: always
      show-components: always
  info:
    git:
      # Show all build-time generated file git.properties info on /actuator/info endpoint
      mode: full
  httpexchanges:
    recording:
      # Show all available info in /actuator/httpexchanges and also in Swagger
      include: request-headers, response-headers, authorization_header, cookie_headers, principal, remote_address, session_id, time_taken
springdoc:
  show-actuator: true
  swagger-ui:
    doc-expansion: none
    try-it-out-enabled: true
    filter: true
    tags-sorter: alpha
    operations-sorter: alpha

openapi:
  servers:
    - url: "https://localhost:8080"
      description: "Development environment"

otel:
    service:
        name: devstack-api-service-dev
        version: 0.0.3
    exporter:
        otlp:
            endpoint: http://opentelemetry.example.com
    traces:
        exporter: logging,otlp
        sampler: parentbased_traceidratio
        sampler_arg: 1.0
    metrics:
        exporter: none
    resource:
        attributes: service.name=devstack-api-service,service.version=0.0.3,deployment.environment=development
    instrumentation:
        jdbc:
            enabled: false
        logback-appender:
            enabled: true

# External Service Configuration
automation:
  platform:
    ansible:
      enabled: true
      base-url: ${ANSIBLE_BASE_URL:http://localhost:8080/api/v2}
      username: ${ANSIBLE_USERNAME:admin}
      password: ${ANSIBLE_PASSWORD:password}
      timeout: ${ANSIBLE_TIMEOUT:30000}
      ssl:
        verify-certificates: ${ANSIBLE_SSL_VERIFY:true}
        trust-store-path: ${ANSIBLE_SSL_TRUSTSTORE_PATH:}
        trust-store-password: ${ANSIBLE_SSL_TRUSTSTORE_PASSWORD:}
        trust-store-type: ${ANSIBLE_SSL_TRUSTSTORE_TYPE:JKS}

    uipath:
      # Base URL of the UIPath Orchestrator instance
      host: ${UIPATH_HOST:https://orchestrator.example.com}
      
      # Authentication credentials
      clientId: ${UIPATH_CLIENT_ID:your-client-id}
      clientSecret: ${UIPATH_CLIENT_SECRET:your-client-secret}
      
      # Tenancy name (default: "default")
      tenancy-name: ${UIPATH_TENANCY_NAME:default}

      # Organization Unit ID for multi-tenant setups
      organization-unit-id: ${UIPATH_ORGANIZATION_UNIT_ID:123456}

      # API endpoints (defaults shown, can be overridden)
      login-endpoint: /api/Account/Authenticate
      queue-items-endpoint: /odata/QueueItems
      
      # Request timeout in milliseconds
      timeout: 30000
      
      # SSL Configuration
      ssl:
        # Set to false to disable certificate verification (DEV ONLY!)
        verify-certificates: ${UIPATH_SSL_VERIFY:true}
        # Optional: path to custom trust store
        trust-store-path: ${UIPATH_SSL_TRUST_STORE_PATH:/path/to/truststore.jks}
        trust-store-password: ${TRUSTSTORE_PASSWORD:changeit}
        trust-store-type: ${UIPATH_SSL_TRUST_STORE_TYPE:JKS}


apis:
  project-users:
    ansible-workflow-name: ${API_PROJECT_USERS_WORKFLOW_NAME:ansible++workflow}
    token:
      secret: ${API_PROJECT_USERS_TOKEN_SECRET:devstack-api-service-jwt-secret-key-256bit-change-in-production}
      expiration-hours: ${API_PROJECT_USERS_TOKEN_EXPIRATION_HOURS:24}


externalservices:
  openshift:
    instances:
      # Development OpenShift instance
      dev:
        api-url: ${OPENSHIFT_US_TEST_API_URL:https://api.dev.ocp.example.com:6443}
        token: ${OPENSHIFT_US_TEST_TOKEN:your-dev-token-here}
        namespace: ${OPENSHIFT_US_TEST_NAMESPACE:devstack-dev}
        connection-timeout: 30000
        read-timeout: 30000
        trust-all-certificates: ${OPENSHIFT_US_TEST_TRUST_ALL:true}

      # Test OpenShift instance
      test:
        api-url: ${OPENSHIFT_EU_DEV_API_URL:https://api.test.ocp.example.com:6443}
        token: ${OPENSHIFT_EU_DEV_TOKEN:your-test-token-here}
        namespace: ${OPENSHIFT_EU_DEV_NAMESPACE:devstack-test}
        connection-timeout: 30000
        read-timeout: 30000
        trust-all-certificates: ${OPENSHIFT_EU_DEV_TRUST_ALL:true}

  bitbucket:
    instances:
      # Development Bitbucket instance
      dev:
        base-url: ${BITBUCKET_DEV_BASE_REST_URL:https://bitbucket.dev.example.com}
        bearer-token: ${BITBUCKET_DEV_BEARER_TOKEN:}
        # OR use basic auth if bearer token is not available:
        # username: ${BITBUCKET_DEV_USERNAME:admin}
        # password: ${BITBUCKET_DEV_PASSWORD:your-dev-password-here}
        connection-timeout: 30000
        read-timeout: 30000
        trust-all-certificates: ${BITBUCKET_DEV_TRUST_ALL:true}
      
      # Production Bitbucket instance
      prod:
        base-url: ${BITBUCKET_PROD_BASE_REST_URL:https://bitbucket.prod.example.com}
        bearer-token: ${BITBUCKET_PROD_BEARER_TOKEN:}
        # OR use basic auth:
        # username: ${BITBUCKET_PROD_USERNAME:admin}
        # password: ${BITBUCKET_PROD_PASSWORD:your-prod-password-here}
        connection-timeout: 30000
        read-timeout: 30000
        trust-all-certificates: ${BITBUCKET_PROD_TRUST_ALL:false}

  webhook-proxy:
    clusters:
      # Test Cluster
      test:
        cluster-base: ${WEBHOOK_PROXY_TEST_CLUSTER_BASE:apps.cluster.ocp.com}
        connection-timeout: ${WEBHOOK_PROXY_TEST_CONNECTION_TIMEOUT:30000}
        read-timeout: ${WEBHOOK_PROXY_TEST_READ_TIMEOUT:30000}
        trust-all-certificates: ${WEBHOOK_PROXY_TEST_TRUST_ALL:false}
        default-jenkinsfile-path: ${WEBHOOK_PROXY_TEST_JENKINSFILE_PATH:Jenkinsfile}

  projects-info-service:
    base-url: ${PROJECTS_INFO_SERVICE_BASE_URL:http://localhost:8081}