spring:
  application:
    name: ordinis-projection-writer
  profiles:
    active: ${SPRING_PROFILES_ACTIVE:dev}

# projection-writer — Kafka consumer + Redis writer; полноценного API нет, но
# Tomcat нужен под actuator (probes/metrics/prometheus). server.port = 8082.
server:
  port: 8082
  shutdown: graceful

management:
  endpoints:
    web:
      exposure:
        include: health,info,prometheus,refresh,metrics
  endpoint:
    health:
      probes:
        enabled: true
      show-details: when-authorized
      group:
        liveness:
          include: livenessState
        readiness:
          include: readinessState,redis
  prometheus:
    metrics:
      export:
        enabled: true
  metrics:
    tags:
      application: ${spring.application.name}
      environment: ${ENVIRONMENT:dev}
    distribution:
      percentiles-histogram:
        http.server.requests: true
      slo:
        http.server.requests: 5ms,10ms,25ms,50ms,100ms,250ms,500ms,1s,2s,5s

logging:
  level:
    root: INFO
    cloud.nstart.terravault.ordinis: DEBUG

---
spring:
  config:
    activate:
      on-profile: dev
  cloud:
    config:
      enabled: false
    vault:
      enabled: false
  autoconfigure:
    exclude:
      - org.springframework.cloud.vault.config.VaultAutoConfiguration
      - org.springframework.cloud.vault.config.VaultObservationAutoConfiguration
      - org.springframework.cloud.vault.config.VaultReactiveAutoConfiguration
  datasource:
    url: jdbc:postgresql://${ORDINIS_PG_HOST:localhost}:${ORDINIS_PG_PORT:5433}/${ORDINIS_PG_DB:ordinis}
    username: ${ORDINIS_PG_USER:ordinis_app}
    password: ${ORDINIS_PG_PASSWORD:}
    driver-class-name: org.postgresql.Driver
    hikari:
      read-only: true
  jpa:
    hibernate:
      ddl-auto: none
    open-in-view: false
  data:
    redis:
      host: ${ORDINIS_REDIS_HOST:localhost}
      port: ${ORDINIS_REDIS_PORT:6379}
      password: ${ORDINIS_REDIS_PASSWORD:}
      timeout: 2s
  kafka:
    bootstrap-servers: ${ORDINIS_KAFKA_BOOTSTRAP:localhost:32094}
    properties:
      security.protocol: ${ORDINIS_KAFKA_SECURITY:SASL_PLAINTEXT}
      sasl.mechanism: ${ORDINIS_KAFKA_SASL_MECHANISM:SCRAM-SHA-512}
      sasl.jaas.config: >-
        org.apache.kafka.common.security.scram.ScramLoginModule required
        username="${ORDINIS_KAFKA_USER:ordinis-projection-writer}"
        password="${ORDINIS_KAFKA_PASSWORD:}";
    consumer:
      group-id: ordinis-projection-cuod
      auto-offset-reset: earliest
      enable-auto-commit: false
      key-deserializer: org.apache.kafka.common.serialization.StringDeserializer
      value-deserializer: org.apache.kafka.common.serialization.StringDeserializer
    listener:
      ack-mode: record

otel:
  sdk:
    disabled: true

---
spring:
  config:
    activate:
      on-profile: k8s
    import:
      - "configserver:${SPRING_CLOUD_CONFIG_URI:http://config-server.ordinis-staging:8888}"
  cloud:
    config:
      enabled: true
    # Spring Cloud Vault как config source отключён намеренно: креды (postgres,
    # kafka, redis) приходят через Vault Agent injector в env-переменные ещё
    # до старта JVM. Если включить kv-source с application-name=ordinis/cuod,
    # Spring пытается читать secret/data/ordinis/cuod/k8s — путь для которого
    # ни одна из ролей (ordinis-app/read-api/projection-writer) не имеет
    # capabilities=read, и projection-writer падает на этом 403 в bootstrap.
    # writer/read-api тот же 403 ловят, но молча проглатывают (бin Lifecycle
    # отличается). Чистый путь — не использовать kv-source совсем.
    vault:
      enabled: false
  datasource:
    url: jdbc:postgresql://${ORDINIS_PG_HOST}:${ORDINIS_PG_PORT:5432}/${ORDINIS_PG_DB:ordinis}
    username: ${ORDINIS_PG_USER}
    password: ${ORDINIS_PG_PASSWORD}
    driver-class-name: org.postgresql.Driver
    hikari:
      read-only: true
  data:
    redis:
      host: ${ORDINIS_REDIS_HOST:ordinis-redis}
      port: ${ORDINIS_REDIS_PORT:6379}
      password: ${ORDINIS_REDIS_PASSWORD:}
      timeout: 2s
  kafka:
    bootstrap-servers: ${ORDINIS_KAFKA_BOOTSTRAP}
    properties:
      security.protocol: ${ORDINIS_KAFKA_SECURITY:SASL_PLAINTEXT}
      sasl.mechanism: ${ORDINIS_KAFKA_SASL_MECHANISM:SCRAM-SHA-512}
      sasl.jaas.config: >-
        org.apache.kafka.common.security.scram.ScramLoginModule required
        username="${ORDINIS_KAFKA_USER}"
        password="${ORDINIS_KAFKA_PASSWORD}";
    consumer:
      group-id: ordinis-projection-cuod
      auto-offset-reset: earliest
      enable-auto-commit: false
      key-deserializer: org.apache.kafka.common.serialization.StringDeserializer
      value-deserializer: org.apache.kafka.common.serialization.StringDeserializer
    listener:
      ack-mode: record
  jpa:
    hibernate:
      ddl-auto: none