StellaOps:
  Crypto:
    Registry:
      ActiveProfile: ru-linux-soft
      PreferredProviders:
        - ru.openssl.gost
        - ru.winecsp.http
        - ru.pkcs11
      Profiles:
        ru-linux-soft:
          PreferredProviders:
            - ru.openssl.gost
            - ru.winecsp.http
            - ru.pkcs11
        ru-csp:
          PreferredProviders:
            - ru.cryptopro.csp
            - ru.winecsp.http
            - ru.openssl.gost
            - ru.pkcs11
    CryptoPro:
      Status: pending
      Keys:
        - KeyId: ru-csp-default
          Algorithm: GOST12-256
          ProviderName: "Crypto-Pro GOST R 34.10-2012 Cryptographic Service Provider"
          CertificateThumbprint: "<thumbprint>"
          CertificateStoreLocation: LocalMachine
          CertificateStoreName: My
          ContainerName: CN=RootPack Signing
    Pkcs11:
      Keys:
        - KeyId: ru-token-default
          Algorithm: GOST12-256
          LibraryPath: /usr/local/lib/librutokenecp.so
          SlotId: "0x1"
          Pin: "${PKCS11_PIN}"
          PrivateKeyLabel: rootpack-signing
          CertificateThumbprint: "<thumbprint>"
    WineCsp:
      ServiceUrl: http://localhost:5099
      Keys:
        - KeyId: ru-wine-default
          Algorithm: GOST12-256
          RemoteKeyId: ru-csp-default
          Description: Wine CSP sidecar (CryptoPro via Wine)
    OpenSsl:
      Keys:
        - KeyId: ru-openssl-default
          Algorithm: GOST12-256
          PrivateKeyPath: /opt/stellaops/keys/ru_openssl_priv.pem
          PrivateKeyPassphraseEnvVar: RU_OPENSSL_PRIV_PASS
          CertificatePath: /opt/stellaops/certs/ru_openssl_cert.pem
          SignatureFormat: Der
    Diagnostics:
      Providers:
        Enabled: true
        Metrics:
          LogLevel: Information