---
# bosh deploy -d concourse concourse.yml -o ops-files/concourse-bbr.yml -v internal_ip=10.244.0.200 -v external_ip=concourse.example.com --vars-store ./creds-concourse.yml
# bosh deploy -d concourse concourse.yml -o ops-files/concourse-external-lb.yml -o ops-files/concourse-bbr.yml -v internal_ip=10.244.0.200 -v external_ip=concourse.example.com --vars-store ./creds-concourse.yml # HA Proxy
# bosh deploy -d concourse concourse.yml -o ops-files/concourse-external-lb.yml -o ops-files/concourse-bbr.yml -v internal_ip=10.244.0.200 -v external_ip=concourse.ik.am # CredHub
# bosh deploy -d concourse concourse.yml -o ops-files/concourse-external-lb.yml -o ops-files/concourse-bbr.yml -v internal_ip=10.244.0.200 -v external_ip=concourse.ik.am -o ops-files/concourse-vault.yml -v vault_url=https://cf-vault.cfapps.io # Vault
# bosh deploy -d concourse concourse.yml -o ops-files/concourse-external-lb.yml -o ops-files/concourse-aws.yml -o ops-files/concourse-bbr.yml -o ops-files/concourse-aws-cheap.yml -v external_ip=52-198-35-178.sslip.io
# bosh deploy -d concourse concourse.yml -o ops-files/concourse-azure.yml -o ops-files/concourse-bbr.yml -o ops-files/concourse-influxdb.yml -v vip=13.71.130.229 -v external_ip=concourse.ik.am -v influxdb_url=http://10.0.16.9:9122 -v influxdb_database=concourse -v influxdb_username=dummy -v influxdb_password=dummy
# bosh deploy -d concourse concourse.yml -o ops-files/concourse-external-lb.yml -o ops-files/concourse-external-postgres.yml -v internal_ip=10.244.1.120 -v external_ip=concourse.dev.ik.am -v postgres_host=concourse.postgres.database.azure.com --var-file postgres_ca_cert=postgres-cert/root.crt --no-redact
# bosh deploy -d concourse concourse.yml -o ops-files/concourse-external-lb.yml -o ops-files/concourse-external-postgres.yml -v internal_ip=10.244.1.120 -v external_ip=concourse.dev.ik.am -v postgres_host=192.168.220.40 --no-redact

name: concourse

releases:
- name: concourse
  version: 3.8.0
  url: https://bosh.io/d/github.com/concourse/concourse?v=3.8.0
  sha1: 99e134676df72e18c719ccfbd7977bd9449e6fd4
- name: garden-runc
  version: 1.9.0
  url: https://bosh.io/d/github.com/cloudfoundry/garden-runc-release?v=1.9.0
  sha1: 77bfe8bdb2c3daec5b40f5116a6216badabd196c

stemcells:
- alias: trusty
  os: ubuntu-trusty
  version: latest

instance_groups:
- name: web
  instances: 1
  vm_type: default
  stemcell: trusty
  azs: [z1]
  networks:
  - name: default
    static_ips: [((internal_ip))]
  jobs:
  - name: atc
    release: concourse
    properties:
      external_url: &external_url https://((external_ip))
      basic_auth_username: admin
      basic_auth_password: ((ui_password))
      tls_cert: ((atc_ssl.certificate))
      tls_key: ((atc_ssl.private_key))
      bind_port: 8080
      tls_bind_port: 443
      postgresql_database: &atc_db atc
      token_signing_key: ((token_signing_key))
      # encryption_key: ((encryption_key))
      # old_encryption_key: ((old_encryption_key))
  - name: tsa
    release: concourse
    properties:
      host_key: ((tsa_host_key))
      token_signing_key: ((token_signing_key))
      authorized_keys: [((worker_key.public_key))]
- name: db
  instances: 1
  vm_type: default
  persistent_disk_type: default
  stemcell: trusty
  azs: [z1]
  networks:
  - name: default
  jobs:
  - name: postgresql
    release: concourse
    properties:
      databases:
      - name: *atc_db
        role: atc
        password: ((postgres_password))
- name: worker
  instances: 1
  vm_type: default
  stemcell: trusty
  azs: [z1]
  networks:
  - name: default
  jobs:
  - name: groundcrew
    release: concourse
    properties:
      drain_timeout: 10m
      tsa: {worker_key: ((worker_key))}
  - name: baggageclaim
    release: concourse
    properties: {}
  - name: garden
    release: garden-runc
    properties:
      garden:
        listen_network: tcp
        listen_address: 0.0.0.0:7777

update:
  canaries: 1
  max_in_flight: 1
  serial: false
  canary_watch_time: 1000-60000
  update_watch_time: 1000-60000

variables:
- name: default_ca
  type: certificate
  options:
    is_ca: true
    common_name: ca
- name: atc_ssl
  type: certificate
  options:
    ca: default_ca
    common_name: ((external_ip))
    alternative_names: 
    - ((internal_ip))
- name: postgres_password
  type: password
- name: ui_password
  type: password
- name: encryption_key
  type: password
  options:
    length: 16
- name: old_encryption_key
  type: password
  options:
    length: 16
- name: token_signing_key
  type: rsa
- name: tsa_host_key
  type: ssh
- name: worker_key
  type: ssh