spring:
  application:
    name: ordinis-read-api
  profiles:
    active: ${SPRING_PROFILES_ACTIVE:dev}

server:
  port: 8081
  shutdown: graceful

management:
  endpoints:
    web:
      exposure:
        include: health,info,prometheus,refresh,metrics,env,mappings
  endpoint:
    health:
      probes:
        enabled: true
      show-details: when-authorized
      group:
        liveness:
          include: livenessState
        readiness:
          include: readinessState,db
  prometheus:
    metrics:
      export:
        enabled: true
  metrics:
    tags:
      application: ${spring.application.name}
      environment: ${ENVIRONMENT:dev}
    distribution:
      # Включаем server-side histogram buckets для http.server.requests —
      # без них histogram_quantile() в Prometheus возвращает empty
      # (только _count/_sum/_max). Используется в Grafana dashboard
      # ordinis-overview для p50/p95/p99 latency.
      percentiles-histogram:
        http.server.requests: true
      # Service-level objectives bucket boundaries (на каких границах
      # эмитить _bucket counters). Покрывают range от 5ms до 5s — типичный
      # для read-api JSON endpoint.
      slo:
        http.server.requests: 5ms,10ms,25ms,50ms,100ms,250ms,500ms,1s,2s,5s

otel:
  exporter:
    otlp:
      endpoint: ${OTEL_EXPORTER_OTLP_ENDPOINT:http://tempo.monitoring:4318}
  resource:
    attributes:
      service.name: ${spring.application.name}
      service.namespace: ordinis
      deployment.environment: ${ENVIRONMENT:dev}
  traces:
    sampler: parentbased_traceidratio
    sampler.arg: ${ORDINIS_TRACING_SAMPLING:0.1}

logging:
  level:
    root: INFO
    cloud.nstart.terravault.ordinis: DEBUG

---
# DEV: подключение к replica через port-forward.
# Для read-api используем `ordinis-postgres-ro` сервис (read-only replica).
# Через port-forward в local dev можно использовать тот же ordinis-postgres-rw
# (single-node cluster, replica = тот же primary), важна только конвенция.
spring:
  config:
    activate:
      on-profile: dev
  cloud:
    config:
      enabled: false
    vault:
      enabled: false
  autoconfigure:
    exclude:
      - org.springframework.cloud.vault.config.VaultAutoConfiguration
      - org.springframework.cloud.vault.config.VaultObservationAutoConfiguration
      - org.springframework.cloud.vault.config.VaultReactiveAutoConfiguration
  datasource:
    url: jdbc:postgresql://${ORDINIS_PG_HOST:localhost}:${ORDINIS_PG_PORT:5433}/${ORDINIS_PG_DB:ordinis}
    username: ${ORDINIS_PG_USER:ordinis_app}
    password: ${ORDINIS_PG_PASSWORD:}
    driver-class-name: org.postgresql.Driver
    hikari:
      read-only: true
  jpa:
    hibernate:
      ddl-auto: none
    properties:
      hibernate.dialect: org.hibernate.dialect.PostgreSQLDialect
    open-in-view: false

otel:
  sdk:
    disabled: true

---
# K8s: подключение к replica + Vault для credentials, Cloud Config для feature flags.
spring:
  config:
    activate:
      on-profile: k8s
    import:
      - "configserver:${SPRING_CLOUD_CONFIG_URI:http://config-server.ordinis-staging:8888}"
      - "vault://"
  cloud:
    config:
      enabled: true
    vault:
      enabled: true
      uri: ${VAULT_URI:http://vault.config:8200}
      authentication: KUBERNETES
      kubernetes:
        role: ordinis-read-api
        service-account-token-file: /var/run/secrets/kubernetes.io/serviceaccount/token
      kv:
        enabled: true
        backend: secret
        application-name: ordinis/cuod
  datasource:
    url: jdbc:postgresql://${ORDINIS_PG_HOST}:${ORDINIS_PG_PORT:5432}/${ORDINIS_PG_DB:ordinis}
    username: ${ORDINIS_PG_USER}
    password: ${ORDINIS_PG_PASSWORD}
    driver-class-name: org.postgresql.Driver
    hikari:
      read-only: true
  jpa:
    hibernate:
      ddl-auto: none
    open-in-view: false

# Auth — JWT public key из Vault (secret/ordinis/cuod/jwt-public-key, key=key).
# Если public-key пуст — резолвер scope падает на anonymous PUBLIC + ?as_scope= legacy.
ordinis:
  auth:
    public-key: ${key:}
    issuer: ${jwt-issuer:}
    require-authentication: ${ORDINIS_AUTH_REQUIRED:false}
    allow-query-scope: ${ORDINIS_AUTH_ALLOW_QUERY_SCOPE:true}
