# Notify WebService configuration — air-gapped bootstrap profile
#
# This template ships inside the Bootstrap Pack so operators can stage
# deterministic notifier settings without reaching external services. The
# values align with the docker-compose.airgap.yaml profile and the defaults
# produced by the Offline Kit builder. Update the connection string and
# Authority endpoints if your environment uses different hosts.

storage:
  driver: postgres

postgres:
  notify:
    connectionString: "Host=postgres;Port=5432;Database=stellaops_notify_airgap;Username=stellaops;Password=airgap-password;Pooling=true;Maximum Pool Size=40;Minimum Pool Size=1"
    commandTimeoutSeconds: 45
    schemaName: notify

authority:
  enabled: true
  issuer: "https://authority.airgap.local"
  metadataAddress: "https://authority.airgap.local/.well-known/openid-configuration"
  requireHttpsMetadata: true
  allowAnonymousFallback: false
  backchannelTimeoutSeconds: 30
  tokenClockSkewSeconds: 60
  audiences:
    - notify
  viewerScope: notify.viewer
  operatorScope: notify.operator
  adminScope: notify.admin

api:
  basePath: "/api/v1/notify"
  internalBasePath: "/internal/notify"
  tenantHeader: "X-StellaOps-Tenant"

plugins:
  baseDirectory: "/opt/stellaops"
  directory: "plugins/notify"
  searchPatterns:
    - "StellaOps.Notify.Connectors.*.dll"
  orderedPlugins:
    - StellaOps.Notify.Connectors.Email
    - StellaOps.Notify.Connectors.Webhook

telemetry:
  enableRequestLogging: true
  minimumLogLevel: Information

# In sealed/air-gapped mode, outbound connectors are constrained by the
# shared EgressPolicy facade. Channels that point to loopback services (SMTP
# relay, syslog forwarder, file sink) are permitted; external webhooks are
# denied until the host is unsealed or allow-listed. Review
# docs/modules/notify/bootstrap-pack.md for the full bootstrap workflow.