{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "title": "WarpgateConfigStore",
  "type": "object",
  "properties": {
    "database_url": {
      "type": "string",
      "default": "sqlite:data/db"
    },
    "external_host": {
      "type": [
        "string",
        "null"
      ],
      "default": null
    },
    "http": {
      "$ref": "#/$defs/HttpConfig",
      "default": {
        "certificate": "",
        "cookie_max_age": "1day",
        "external_host": null,
        "external_port": null,
        "key": "",
        "listen": "[::]:8888",
        "proxy_protocol": false,
        "session_max_age": "30m",
        "sni_certificates": [],
        "trust_x_forwarded_headers": false
      }
    },
    "kubernetes": {
      "$ref": "#/$defs/KubernetesConfig",
      "default": {
        "certificate": "",
        "enable": false,
        "external_host": null,
        "external_port": null,
        "key": "",
        "listen": "[::]:8443",
        "proxy_protocol": false,
        "session_max_age": "30m"
      }
    },
    "log": {
      "$ref": "#/$defs/LogConfig",
      "default": {
        "audit_retention": "11months 30days 3h 50m 24s",
        "format": "text",
        "retention": "7days",
        "send_to": null
      }
    },
    "mysql": {
      "$ref": "#/$defs/MySqlConfig",
      "default": {
        "advertised_version": "8.0.3-Warpgate",
        "certificate": "",
        "enable": false,
        "external_host": null,
        "external_port": null,
        "key": "",
        "listen": "[::]:33306",
        "proxy_protocol": false
      }
    },
    "postgres": {
      "$ref": "#/$defs/PostgresConfig",
      "default": {
        "certificate": "",
        "enable": false,
        "external_host": null,
        "external_port": null,
        "key": "",
        "listen": "[::]:55432",
        "proxy_protocol": false
      }
    },
    "rdp": {
      "$ref": "#/$defs/RdpConfig",
      "default": {
        "certificate": "",
        "enable": false,
        "external_host": null,
        "external_port": null,
        "key": "",
        "listen": "[::]:3389",
        "proxy_protocol": false
      }
    },
    "recordings": {
      "anyOf": [
        {
          "$ref": "#/$defs/RecordingsConfig"
        },
        {
          "type": "null"
        }
      ]
    },
    "ssh": {
      "$ref": "#/$defs/SshConfig",
      "default": {
        "enable": false,
        "external_host": null,
        "external_port": null,
        "host_key_verification": "prompt",
        "inactivity_timeout": "5m",
        "keepalive_interval": null,
        "listen": "[::]:2222",
        "proxy_protocol": false,
        "target_handshake_timeout": "30s"
      }
    },
    "sso_providers": {
      "type": "array",
      "default": [],
      "items": {
        "$ref": "#/$defs/SsoProviderConfig"
      }
    },
    "vnc": {
      "$ref": "#/$defs/VncConfig",
      "default": {
        "certificate": "",
        "enable": false,
        "enable_ard_auth": false,
        "external_host": null,
        "external_port": null,
        "key": "",
        "listen": "[::]:5900",
        "proxy_protocol": false
      }
    }
  },
  "$defs": {
    "HttpConfig": {
      "type": "object",
      "properties": {
        "certificate": {
          "type": "string",
          "default": ""
        },
        "cookie_max_age": {
          "type": "string",
          "default": "1day"
        },
        "external_host": {
          "type": [
            "string",
            "null"
          ],
          "default": null
        },
        "external_port": {
          "type": [
            "integer",
            "null"
          ],
          "format": "uint16",
          "default": null,
          "maximum": 65535,
          "minimum": 0
        },
        "key": {
          "type": "string",
          "default": ""
        },
        "listen": {
          "$ref": "#/$defs/ListenEndpoint",
          "default": "[::]:8888"
        },
        "proxy_protocol": {
          "description": "Accept HAProxy PROXY protocol v1/v2 headers from the listener's peer.",
          "type": "boolean",
          "default": false
        },
        "session_max_age": {
          "type": "string",
          "default": "30m"
        },
        "sni_certificates": {
          "type": "array",
          "default": [],
          "items": {
            "$ref": "#/$defs/SniCertificateConfig"
          }
        },
        "trust_x_forwarded_headers": {
          "type": "boolean",
          "default": false
        }
      }
    },
    "KubernetesConfig": {
      "type": "object",
      "properties": {
        "certificate": {
          "type": "string",
          "default": ""
        },
        "enable": {
          "type": "boolean",
          "default": false
        },
        "external_host": {
          "type": [
            "string",
            "null"
          ],
          "default": null
        },
        "external_port": {
          "type": [
            "integer",
            "null"
          ],
          "format": "uint16",
          "default": null,
          "maximum": 65535,
          "minimum": 0
        },
        "key": {
          "type": "string",
          "default": ""
        },
        "listen": {
          "$ref": "#/$defs/ListenEndpoint",
          "default": "[::]:8443"
        },
        "proxy_protocol": {
          "description": "Accept HAProxy PROXY protocol v1/v2 headers from the listener's peer.",
          "type": "boolean",
          "default": false
        },
        "session_max_age": {
          "type": "string",
          "default": "30m"
        }
      }
    },
    "ListenEndpoint": {
      "type": "string"
    },
    "LogConfig": {
      "type": "object",
      "properties": {
        "audit_retention": {
          "type": "string",
          "default": "11months 30days 3h 50m 24s"
        },
        "format": {
          "$ref": "#/$defs/LogFormat",
          "default": "text"
        },
        "retention": {
          "type": "string",
          "default": "7days"
        },
        "send_to": {
          "type": [
            "string",
            "null"
          ],
          "default": null
        }
      }
    },
    "LogFormat": {
      "type": "string",
      "enum": [
        "text",
        "json"
      ]
    },
    "MySqlConfig": {
      "type": "object",
      "properties": {
        "advertised_version": {
          "description": "The server version advertised to clients during the handshake.\nWe can't auto-match the target's version since the target is only known\nafter the handshake, but clients use it to pick a protocol dialect.",
          "type": "string",
          "default": "8.0.3-Warpgate"
        },
        "certificate": {
          "type": "string",
          "default": ""
        },
        "enable": {
          "type": "boolean",
          "default": false
        },
        "external_host": {
          "type": [
            "string",
            "null"
          ],
          "default": null
        },
        "external_port": {
          "type": [
            "integer",
            "null"
          ],
          "format": "uint16",
          "default": null,
          "maximum": 65535,
          "minimum": 0
        },
        "key": {
          "type": "string",
          "default": ""
        },
        "listen": {
          "$ref": "#/$defs/ListenEndpoint",
          "default": "[::]:33306"
        },
        "proxy_protocol": {
          "description": "Accept HAProxy PROXY protocol v1/v2 headers from the listener's peer.",
          "type": "boolean",
          "default": false
        }
      }
    },
    "PostgresConfig": {
      "type": "object",
      "properties": {
        "certificate": {
          "type": "string",
          "default": ""
        },
        "enable": {
          "type": "boolean",
          "default": false
        },
        "external_host": {
          "type": [
            "string",
            "null"
          ],
          "default": null
        },
        "external_port": {
          "type": [
            "integer",
            "null"
          ],
          "format": "uint16",
          "default": null,
          "maximum": 65535,
          "minimum": 0
        },
        "key": {
          "type": "string",
          "default": ""
        },
        "listen": {
          "$ref": "#/$defs/ListenEndpoint",
          "default": "[::]:55432"
        },
        "proxy_protocol": {
          "description": "Accept HAProxy PROXY protocol v1/v2 headers from the listener's peer.",
          "type": "boolean",
          "default": false
        }
      }
    },
    "RdpConfig": {
      "type": "object",
      "properties": {
        "certificate": {
          "type": "string",
          "default": ""
        },
        "enable": {
          "type": "boolean",
          "default": false
        },
        "external_host": {
          "type": [
            "string",
            "null"
          ],
          "default": null
        },
        "external_port": {
          "type": [
            "integer",
            "null"
          ],
          "format": "uint16",
          "default": null,
          "maximum": 65535,
          "minimum": 0
        },
        "key": {
          "type": "string",
          "default": ""
        },
        "listen": {
          "$ref": "#/$defs/ListenEndpoint",
          "default": "[::]:3389"
        },
        "proxy_protocol": {
          "description": "Accept HAProxy PROXY protocol v1/v2 headers from the listener's peer.",
          "type": "boolean",
          "default": false
        }
      }
    },
    "RecordingsConfig": {
      "type": "object",
      "properties": {
        "enable": {
          "type": "boolean",
          "default": false
        },
        "path": {
          "type": "string",
          "default": "./data/recordings"
        }
      }
    },
    "RoleMapping": {
      "description": "A role mapping value that accepts either a single role or a list of roles.\nIn YAML config: `\"group\": \"role\"` or `\"group\": [\"role1\", \"role2\"]`",
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      ]
    },
    "SniCertificateConfig": {
      "type": "object",
      "properties": {
        "certificate": {
          "type": "string"
        },
        "key": {
          "type": "string"
        }
      },
      "required": [
        "certificate",
        "key"
      ]
    },
    "SshConfig": {
      "type": "object",
      "properties": {
        "enable": {
          "type": "boolean",
          "default": false
        },
        "external_host": {
          "type": [
            "string",
            "null"
          ],
          "default": null
        },
        "external_port": {
          "type": [
            "integer",
            "null"
          ],
          "format": "uint16",
          "default": null,
          "maximum": 65535,
          "minimum": 0
        },
        "host_key_verification": {
          "description": "Only seeds the `ssh_host_key_verification` parameter when the database\nrow is first created; the admin UI owns the setting afterwards.",
          "$ref": "#/$defs/SshHostKeyVerificationMode",
          "default": "prompt"
        },
        "inactivity_timeout": {
          "type": "string",
          "default": "5m"
        },
        "keepalive_interval": {
          "type": [
            "string",
            "null"
          ],
          "default": null
        },
        "keys": {
          "description": "Legacy directory for the SSH host keys (`host-ed25519`, `host-rsa`).\nIf set, key files are re-imported into the database, after which the option can be removed from the config.",
          "type": [
            "string",
            "null"
          ]
        },
        "listen": {
          "$ref": "#/$defs/ListenEndpoint",
          "default": "[::]:2222"
        },
        "proxy_protocol": {
          "description": "Accept HAProxy PROXY protocol v1/v2 headers from the listener's peer.",
          "type": "boolean",
          "default": false
        },
        "target_handshake_timeout": {
          "description": "Deadline for a target to accept the connection and complete key exchange.\nCovers the TCP connect (or the direct-tcpip hop through a jump host) and the\nSSH handshake, but not authentication. Set to `0s` to wait forever.",
          "type": "string",
          "default": "30s"
        }
      }
    },
    "SshHostKeyVerificationMode": {
      "type": "string",
      "enum": [
        "prompt",
        "auto_accept",
        "auto_reject",
        "ignore"
      ]
    },
    "SsoInternalProviderConfig": {
      "oneOf": [
        {
          "type": "object",
          "properties": {
            "admin_email": {
              "description": "A Google Workspace admin email for domain-wide delegation",
              "type": [
                "string",
                "null"
              ]
            },
            "admin_role_mappings": {
              "type": [
                "object",
                "null"
              ],
              "additionalProperties": {
                "$ref": "#/$defs/RoleMapping"
              }
            },
            "client_id": {
              "type": "string"
            },
            "client_secret": {
              "type": "string"
            },
            "role_mappings": {
              "description": "Maps Google group email addresses to Warpgate role names.\nUse \"*\" as a key to set a default role for any group not explicitly mapped.",
              "type": [
                "object",
                "null"
              ],
              "additionalProperties": {
                "$ref": "#/$defs/RoleMapping"
              }
            },
            "service_account_email": {
              "description": "Service account email for Google Directory API group lookups",
              "type": [
                "string",
                "null"
              ]
            },
            "service_account_key": {
              "description": "PEM private key from the service account JSON key file",
              "type": [
                "string",
                "null"
              ]
            },
            "type": {
              "type": "string",
              "const": "google"
            }
          },
          "required": [
            "type",
            "client_id",
            "client_secret"
          ]
        },
        {
          "type": "object",
          "properties": {
            "client_id": {
              "type": "string"
            },
            "client_secret": {
              "type": "string"
            },
            "key_id": {
              "type": "string"
            },
            "team_id": {
              "type": "string"
            },
            "type": {
              "type": "string",
              "const": "apple"
            }
          },
          "required": [
            "type",
            "client_id",
            "client_secret",
            "key_id",
            "team_id"
          ]
        },
        {
          "type": "object",
          "properties": {
            "client_id": {
              "type": "string"
            },
            "client_secret": {
              "type": "string"
            },
            "tenant": {
              "type": "string"
            },
            "type": {
              "type": "string",
              "const": "azure"
            }
          },
          "required": [
            "type",
            "client_id",
            "client_secret",
            "tenant"
          ]
        },
        {
          "type": "object",
          "properties": {
            "additional_trusted_audiences": {
              "type": [
                "array",
                "null"
              ],
              "items": {
                "type": "string"
              }
            },
            "admin_role_mappings": {
              "type": [
                "object",
                "null"
              ],
              "additionalProperties": {
                "$ref": "#/$defs/RoleMapping"
              }
            },
            "admin_roles_claim": {
              "type": [
                "string",
                "null"
              ]
            },
            "client_id": {
              "type": "string"
            },
            "client_secret": {
              "type": "string"
            },
            "issuer_url": {
              "type": "string"
            },
            "role_mappings": {
              "type": [
                "object",
                "null"
              ],
              "additionalProperties": {
                "$ref": "#/$defs/RoleMapping"
              }
            },
            "roles_claim": {
              "description": "OIDC claim to read group memberships from (e.g. \"groups\").\nIts values are mapped to roles via role_mappings / admin_role_mappings.\nWhen unset, the warpgate_roles / warpgate_admin_roles claims are used.",
              "type": [
                "string",
                "null"
              ]
            },
            "scopes": {
              "type": "array",
              "items": {
                "type": "string"
              }
            },
            "trust_unknown_audiences": {
              "type": "boolean",
              "default": false
            },
            "type": {
              "type": "string",
              "const": "custom"
            }
          },
          "required": [
            "type",
            "client_id",
            "client_secret",
            "issuer_url",
            "scopes"
          ]
        }
      ]
    },
    "SsoProviderConfig": {
      "type": "object",
      "properties": {
        "auto_create_users": {
          "type": "boolean",
          "default": false
        },
        "default_credential_policy": {
          "description": "Default credential policy for auto-created users.\nKeys: \"http\", \"ssh\", \"mysql\", \"postgres\"\nValues: list of credential kinds e.g. [\"sso\"], [\"web\"], []"
        },
        "disable_local_logout": {
          "description": "Disables \"log out from Warpgate\" functionality when the provider supports single logout",
          "type": "boolean",
          "default": false
        },
        "kubernetes": {
          "description": "kubectl OIDC parameters for generating a kubelogin kubeconfig.",
          "anyOf": [
            {
              "$ref": "#/$defs/SsoProviderKubernetesConfig"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        },
        "label": {
          "type": [
            "string",
            "null"
          ]
        },
        "name": {
          "type": "string"
        },
        "provider": {
          "$ref": "#/$defs/SsoInternalProviderConfig"
        },
        "return_domain_whitelist": {
          "type": [
            "array",
            "null"
          ],
          "items": {
            "type": "string"
          }
        },
        "return_url_domain": {
          "$ref": "#/$defs/SsoReturnUrlDomainPreference",
          "default": "external_host"
        },
        "return_url_prefix": {
          "$ref": "#/$defs/SsoProviderReturnUrlPrefix",
          "default": "@"
        }
      },
      "required": [
        "name",
        "provider"
      ]
    },
    "SsoProviderKubernetesConfig": {
      "type": "object",
      "properties": {
        "client_id": {
          "description": "Public OIDC client id used by kubectl (kubelogin). Must be listed in the\nprovider's `additional_trusted_audiences`.",
          "type": "string"
        },
        "client_secret": {
          "description": "Optional client secret (only for confidential kubectl clients).",
          "type": [
            "string",
            "null"
          ]
        },
        "scopes": {
          "description": "Extra scopes for kubelogin. Defaults to openid/email/profile when unset.",
          "type": [
            "array",
            "null"
          ],
          "items": {
            "type": "string"
          }
        }
      },
      "required": [
        "client_id"
      ]
    },
    "SsoProviderReturnUrlPrefix": {
      "type": "string",
      "enum": [
        "@",
        "_"
      ]
    },
    "SsoReturnUrlDomainPreference": {
      "type": "string",
      "enum": [
        "external_host",
        "host_header"
      ]
    },
    "VncConfig": {
      "type": "object",
      "properties": {
        "certificate": {
          "type": "string",
          "default": ""
        },
        "enable": {
          "type": "boolean",
          "default": false
        },
        "enable_ard_auth": {
          "description": "Enable Apple-DH (ARD / type 30) auth. It does not support TLS unlike VeNCrypt",
          "type": "boolean",
          "default": false
        },
        "external_host": {
          "type": [
            "string",
            "null"
          ],
          "default": null
        },
        "external_port": {
          "type": [
            "integer",
            "null"
          ],
          "format": "uint16",
          "default": null,
          "maximum": 65535,
          "minimum": 0
        },
        "key": {
          "type": "string",
          "default": ""
        },
        "listen": {
          "$ref": "#/$defs/ListenEndpoint",
          "default": "[::]:5900"
        },
        "proxy_protocol": {
          "description": "Accept HAProxy PROXY protocol v1/v2 headers from the listener's peer.",
          "type": "boolean",
          "default": false
        }
      }
    }
  }
}