spring:
  application:
    name: ordinis-app
  profiles:
    active: ${SPRING_PROFILES_ACTIVE:dev}

server:
  port: 8080
  shutdown: graceful

management:
  endpoints:
    web:
      exposure:
        include: health,info,prometheus,refresh,metrics,env,mappings
      base-path: /actuator
  endpoint:
    health:
      probes:
        enabled: true
      show-details: when-authorized
      group:
        liveness:
          include: livenessState
        readiness:
          include: readinessState,db
  prometheus:
    metrics:
      export:
        enabled: true
  metrics:
    tags:
      application: ${spring.application.name}
      environment: ${ENVIRONMENT:dev}
    distribution:
      # Server-side histogram buckets для http.server.requests — нужны
      # histogram_quantile() в Grafana p50/p95/p99 dashboards.
      percentiles-histogram:
        http.server.requests: true
      slo:
        http.server.requests: 5ms,10ms,25ms,50ms,100ms,250ms,500ms,1s,2s,5s

otel:
  exporter:
    otlp:
      endpoint: ${OTEL_EXPORTER_OTLP_ENDPOINT:http://tempo.monitoring:4318}
      protocol: http/protobuf
  # Tempo (single-process на staging) принимает только traces. Если включить
  # экспорт metrics/logs — каждую секунду 404 в логах ("Failed to export logs").
  # Когда поднимем полный observability stack (Tempo + Mimir + Loki) — снимем
  # эти overrides либо переопределим через ENV.
  metrics:
    exporter: ${OTEL_METRICS_EXPORTER:none}
  logs:
    exporter: ${OTEL_LOGS_EXPORTER:none}
  resource:
    attributes:
      service.name: ${spring.application.name}
      service.namespace: ordinis
      deployment.environment: ${ENVIRONMENT:dev}
  traces:
    sampler: parentbased_traceidratio
    sampler.arg: ${ORDINIS_TRACING_SAMPLING:0.1}

logging:
  level:
    root: INFO
    cloud.nstart.terravault.ordinis: DEBUG

ordinis:
  outbox:
    enabled: ${ORDINIS_OUTBOX_ENABLED:true}
    poll-interval-ms: ${ORDINIS_OUTBOX_POLL_INTERVAL_MS:1000}
    batch-size: ${ORDINIS_OUTBOX_BATCH_SIZE:100}
    # Cap на ретраи: после N попыток событие → DLQ (dlq_at), poller его пропускает.
    # 1000 при poll=1s ≈ ~17 минут активных ошибок (или быстрее на fail-fast топиках).
    attempt-max: ${ORDINIS_OUTBOX_ATTEMPT_MAX:1000}

springdoc:
  # Per env policy:
  #   prod  → swagger UI disabled (real-user environment, не для exploration);
  #           api-docs JSON остаётся для SDK generation / machine consumers
  #   staging/dev → оба enabled (interactive playground для интеграторов)
  # Controlled via ORDINIS_SWAGGER_UI_ENABLED env var (helm values-prod.yaml:
  # springdoc.swaggerUi=false). Default true для backward compat.
  api-docs:
    path: /v3/api-docs
    enabled: ${ORDINIS_SWAGGER_API_DOCS_ENABLED:true}
  swagger-ui:
    path: /swagger-ui.html
    enabled: ${ORDINIS_SWAGGER_UI_ENABLED:true}
    operations-sorter: method
    tags-sorter: alpha
    display-request-duration: true
    # OAuth2 / Keycloak interactive login (PKCE flow). См. OpenApiConfig.
    # Public client `ordinis-swagger` создаётся в Keycloak realm `nstart` с
    # redirect URI = https://<host>/swagger-ui/oauth2-redirect.html
    oauth:
      client-id: ${ORDINIS_SWAGGER_CLIENT_ID:ordinis-swagger}
      use-pkce-with-authorization-code-grant: true
      use-basic-authentication-with-access-code-grant: false
      scope-separator: " "
  show-actuator: false
  packages-to-scan: cloud.nstart.terravault.ordinis.restapi.web

---
# DEV profile: подключается к cluster PG+Kafka через kubectl port-forward.
# Перед запуском: kubectl port-forward -n ordinis-staging svc/ordinis-postgres-rw 5432:5432 &
#                 kubectl port-forward -n ordinis-staging svc/ordinis-kafka-kafka-bootstrap 9092:9092 &
spring:
  config:
    activate:
      on-profile: dev
  cloud:
    config:
      enabled: false
    vault:
      enabled: false
  autoconfigure:
    exclude:
      - org.springframework.cloud.vault.config.VaultAutoConfiguration
      - org.springframework.cloud.vault.config.VaultObservationAutoConfiguration
      - org.springframework.cloud.vault.config.VaultReactiveAutoConfiguration
  datasource:
    url: jdbc:postgresql://${ORDINIS_PG_HOST:localhost}:${ORDINIS_PG_PORT:5432}/${ORDINIS_PG_DB:ordinis}
    username: ${ORDINIS_PG_USER:ordinis_app}
    password: ${ORDINIS_PG_PASSWORD:}
    driver-class-name: org.postgresql.Driver
  jpa:
    hibernate:
      ddl-auto: update
    properties:
      hibernate.dialect: org.hibernate.dialect.PostgreSQLDialect
      hibernate.format_sql: true
      hibernate.jdbc.lob.non_contextual_creation: true
    open-in-view: false
  kafka:
    bootstrap-servers: ${ORDINIS_KAFKA_BOOTSTRAP:localhost:9092}
    properties:
      security.protocol: ${ORDINIS_KAFKA_SECURITY:SASL_PLAINTEXT}
      sasl.mechanism: ${ORDINIS_KAFKA_SASL_MECHANISM:SCRAM-SHA-512}
      sasl.jaas.config: >-
        org.apache.kafka.common.security.scram.ScramLoginModule required
        username="${ORDINIS_KAFKA_USER:ordinis-app}"
        password="${ORDINIS_KAFKA_PASSWORD:}";
    producer:
      acks: all
      key-serializer: org.apache.kafka.common.serialization.StringSerializer
      value-serializer: org.apache.kafka.common.serialization.StringSerializer
      properties:
        enable.idempotence: true
        compression.type: lz4

otel:
  sdk:
    disabled: true

---
# K8s profile: реальная инфра в кластере. Cloud Config + Vault Kubernetes auth.
spring:
  config:
    activate:
      on-profile: k8s
    import:
      - "configserver:${SPRING_CLOUD_CONFIG_URI:http://config-server.ordinis-staging:8888}"
      - "vault://"
  cloud:
    config:
      enabled: true
    vault:
      enabled: true
      uri: ${VAULT_URI:http://vault.config:8200}
      authentication: KUBERNETES
      kubernetes:
        role: ordinis-app
        service-account-token-file: /var/run/secrets/kubernetes.io/serviceaccount/token
      kv:
        enabled: true
        backend: secret
        application-name: ordinis/cuod
  datasource:
    url: jdbc:postgresql://${ORDINIS_PG_HOST}:${ORDINIS_PG_PORT:5432}/${ORDINIS_PG_DB:ordinis}
    username: ${ORDINIS_PG_USER}
    password: ${ORDINIS_PG_PASSWORD}
    driver-class-name: org.postgresql.Driver
  kafka:
    bootstrap-servers: ${ORDINIS_KAFKA_BOOTSTRAP}
    properties:
      security.protocol: ${ORDINIS_KAFKA_SECURITY:SASL_PLAINTEXT}
      sasl.mechanism: ${ORDINIS_KAFKA_SASL_MECHANISM:SCRAM-SHA-512}
      sasl.jaas.config: >-
        org.apache.kafka.common.security.scram.ScramLoginModule required
        username="${ORDINIS_KAFKA_USER}"
        password="${ORDINIS_KAFKA_PASSWORD}";
    producer:
      acks: all
      key-serializer: org.apache.kafka.common.serialization.StringSerializer
      value-serializer: org.apache.kafka.common.serialization.StringSerializer
      properties:
        enable.idempotence: true
        compression.type: lz4
  jpa:
    hibernate:
      ddl-auto: none
    open-in-view: false

# Auth (см. ordinis-auth: SecurityConfig). public-key из Vault.
ordinis:
  auth:
    public-key: ${key:}
    issuer: ${jwt-issuer:}
    require-authentication: ${ORDINIS_AUTH_REQUIRED:false}
    allow-query-scope: ${ORDINIS_AUTH_ALLOW_QUERY_SCOPE:true}
