# Single-host development cluster.
#
# One s3d process runs every node over the in-process pipe: no network
# socket for rpc, no loopback aliases and no trust anchor. The gate still
# serves HTTPS, so a TLS keypair is required even here.
#
#     ./scripts/start.sh 1host
#
# RS(1,0) is one shard on one node with no parity: redundancy is whatever
# sits under the blob node. It is the only width parity 0 is legal at.

version = 1
region = "ap-southeast-2"

[rs]
data = 1
parity = 0

# Background compactor for the blob store. Omit interval_seconds for the
# store default (300s); compaction itself is never off.
# [compaction]
# interval_seconds = 300

# The S3 gate's HTTP surface. enable_http2 advertises h2 over ALPN and
# defaults on. Only a client that offers h2 is given it, so this is a
# fleet-wide backstop rather than the way to keep one client off h2: a client
# multiplexing large bodies onto one connection should decline h2 itself.
# [s3]
# enable_http2 = true

# data_dir, tls_cert, tls_key and encryption_key are deliberately absent:
# they are host-local, and start.sh passes them as flags so this file stays
# identical on every machine.
#
# admin_port serves /healthz and /readyz on the host's bind address, as plain
# HTTP with no authentication. It is safe here because a dev cluster sits on
# loopback; on a public interface keep it on the private side or leave it out.
[[host]]
id = 1
addr = "127.0.0.1"
admin_port = 9099

  [[host.node]]
  id = 1
  role = "gate"
  port = 8443

  [[host.node]]
  id = 2
  role = "meta"
  port = 6660

  [[host.node]]
  id = 3
  role = "blob"
  port = 9991

# A config-defined service account. These are trusted: the policy table is
# only consulted for IAM accounts, so none is written here.
[[auth]]
access_key_id = "AKIAIOSFODNN7EXAMPLE"
secret_access_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
account_id = "123456789012"

# No buckets defined — tests and benchmarks create their own.