# toolpass configuration. One flat list of connections.
#
# An integration is the product (kubernetes, jira). A connection is one
# configured system of that product. Callers name the connection by id.
#
# Secrets are never written here. Every credential is a reference:
#   env:NAME      read from the environment
#   file:/path    read from a file on every use (rotating tokens keep working)
#
# Every connection also accepts ca_file, tls_server_name, proxy_url and timeout.
# `toolpass catalog <integration>` lists the keys and actions of an integration;
# docs/integrations/<integration>.md explains the credential to create.

api_key: env:TOOLPASS_API_KEY

# listen: ":8080"
# decision_log: /var/log/toolpass/decisions.log   # or stderr (default), stdout, none
# decision_cache_seconds: 30                       # allow/deny answers reused this long; 0 disables
# identity_cache_seconds: 900                      # email -> account lookups reused this long

connections:
  # Smoke-test connection. Talks to nothing. Remove it once real connections work.
  - id: demo
    integration: fake
    users: dana@example.com
    admins: admin@example.com

  # - id: k8s-prod-eu
  #   integration: kubernetes
  #   url: https://10.20.0.5:6443
  #   ca_file: /etc/toolpass/ca/prod-eu.pem
  #   tls_server_name: kubernetes
  #   credential: file:/secrets/k8s-prod-eu-token     # ServiceAccount token, see test/kind/toolpass-rbac.yaml
  #   username_template: "oidc:{email}"
  #   group_prefix: "oidc:"

  # - id: argocd-prod
  #   integration: argocd
  #   kubernetes_connection: k8s-prod-eu
  #   namespace: argocd
  #   user_subject: none                              # or email, when the IdP subject is the email
  #   oidc_issuer: https://sso.example.com            # optional: read the groups from the user's ID token
  #   oidc_audience: argo-cd                          #   (the issuer and client id in Argo CD's oidc.config)
  #   url: https://argocd.example.com                 # optional: the API server, for observed actions

  # - id: gitlab-main
  #   integration: gitlab
  #   url: https://gitlab.example.com
  #   credential: env:GITLAB_TOKEN                    # read_api token of an administrator
  #   identity_mode: admin_search

  # - id: github-acme
  #   integration: github
  #   organization: acme
  #   app_id: Iv1.abcdef0123456789
  #   credential: file:/secrets/github-app.pem        # GitHub App private key
  #   identity_mode: saml

  # - id: snowflake-prod
  #   integration: snowflake
  #   account: myorg-myaccount
  #   user: TOOLPASS
  #   role: SECURITYADMIN                                # or a custom role with MANAGE GRANTS
  #   credential: file:/secrets/snowflake-toolpass.p8    # the user's RSA private key (key-pair auth)
  # - id: vault-prod
  #   integration: vault
  #   url: https://vault.example.com:8200
  #   alias_mount: oidc/                                # the auth method whose aliases are the users' emails
  #   credential: env:VAULT_TOKEN                       # or auth_mode: approle with role_id and the secret_id as credential
  #   # token_policies: developers                      # policies the oidc role attaches at login
  #   # namespace: admin/
  # - id: azure-corp
  #   integration: azure
  #   tenant_id: 11111111-2222-3333-4444-555555555555
  #   client_id: 66666666-7777-8888-9999-000000000000
  #   credential: env:AZURE_CLIENT_SECRET                # app registration with Reader at the root management group
  #   # microsoft365_connection: m365-corp                # resolve users through the microsoft365 connection instead of Graph
  # - id: linear-acme
  #   integration: linear
  #   credential: env:LINEAR_API_KEY                   # personal API key of a workspace admin, or an OAuth token with auth_mode: oauth
  # - id: zendesk-acme
  #   integration: zendesk
  #   url: https://acme.zendesk.com
  #   username: toolpass-bot@acme.com                  # the administrator the API token acts as
  #   credential: env:ZENDESK_API_TOKEN
  #   # auth_mode: oauth                                # credential is then an OAuth access token
  # - id: datadog-acme
  #   integration: datadog
  #   api_key: env:DATADOG_API_KEY
  #   credential: env:DATADOG_APP_KEY                   # application key scoped to user_access_read, teams_read, *_read
  #   # url: https://api.datadoghq.eu                   # EU site
  # - id: pagerduty-acme
  #   integration: pagerduty
  #   credential: env:PAGERDUTY_API_KEY                 # read-only General Access REST API key
  #   # url: https://api.eu.pagerduty.com               # EU service region
  # - id: bitbucket-acme
  #   integration: bitbucket
  #   workspace: acme                                   # Cloud: the workspace slug
  #   credential: env:BITBUCKET_TOKEN                   # workspace access token (read repository, project, account scopes)

  # - id: bitbucket-dc
  #   integration: bitbucket
  #   edition: datacenter
  #   url: https://bitbucket.acme.internal
  #   credential: env:BITBUCKET_DC_TOKEN                # HTTP access token of an administrator

  # - id: jira-main
  #   integration: jira
  #   url: https://acme.atlassian.net
  #   username: toolpass-bot@acme.com
  #   credential: env:JIRA_TOKEN

  # - id: confluence-main
  #   integration: confluence
  #   url: https://acme.atlassian.net
  #   username: toolpass-bot@acme.com
  #   credential: env:JIRA_TOKEN
  #   identity_connection: jira-main                  # Confluence cannot look users up by email itself

  # - id: slack-acme
  #   integration: slack
  #   credential: env:SLACK_BOT_TOKEN                 # xoxb- token of an internal app with read scopes

  # - id: aws-prod
  #   integration: aws
  #   account_id: "123456789012"
  #   region: eu-west-1
  #   role_arn: arn:aws:iam::123456789012:role/toolpass-read   # iam:SimulatePrincipalPolicy, iam:ListRoles
  #   credential: env:TOOLPASS_AWS_CRED               # the literal ambient:auto, or JSON {access_key_id, secret_access_key}
  #   identity_mode: identity_center
  #   identity_center_role_arn: arn:aws:iam::210987654321:role/toolpass-identity-center-read
  #   identity_center_region: eu-west-1
  #   identity_store_id: d-936712345a
  #   sso_instance_arn: arn:aws:sso:::instance/ssoins-1234567890abcdef
  #   implicit_deny_as: deny

  # - id: m365-contoso
  #   integration: microsoft365
  #   tenant_id: contoso.onmicrosoft.com
  #   client_id: 00000000-0000-0000-0000-000000000000
  #   credential: file:/secrets/m365-app.key            # PEM private key, with certificate_file; or the client secret
  #   certificate_file: /etc/toolpass/m365-app.crt

  # - id: google-acme
  #   integration: googleworkspace
  #   credential: file:/secrets/google-sa.json          # service-account key with domain-wide delegation
  #   admin_email: toolpass-admin@acme.com              # custom admin role: Users > Read, Groups > Read

  # - id: databricks-prod
  #   integration: databricks
  #   url: https://adb-1234567890123456.7.azuredatabricks.net
  #   client_id: a1b2c3d4-e5f6-7890-abcd-ef1234567890    # service principal application id
  #   credential: env:DATABRICKS_OAUTH_SECRET             # its OAuth secret; or auth_mode: token with a PAT
  # - id: gcp-acme
  #   integration: googlecloud
  #   scope: organization:123456789012                  # where the service account has roles/iam.securityReviewer
  #   credential: file:/secrets/gcp-toolpass.json       # service-account key; or auth_mode: keyless on GCE/GKE
  #   googleworkspace_connection: google-acme           # optional: user_not_found and suspended accounts

  # - id: salesforce-prod                             # UNVERIFIED integration, see docs/integrations/salesforce.md
  #   integration: salesforce
  #   url: https://acme.my.salesforce.com
  #   client_id: 3MVG9...                              # consumer key of the External Client App
  #   credential: file:/secrets/salesforce.key          # PEM private key of the app certificate
  #   username: toolpass@acme.com
  #   api_version: v66.0