app-config.yaml

# Base Backstage Configuration
#
# This file contains the base configuration with environment variable placeholders.
# Environment variables are used in Docker builds and production deployments.
#
# For local development with k3d cluster:
#   1. Copy the example file: cp app-config.local.yaml.example app-config.local.yaml
#   2. Run: yarn start
#   3. The app-config.local.yaml will automatically override values from this file
#
# Note: app-config.local.yaml is gitignored and won't affect Docker builds.
# Docker builds only use app-config.production.yaml.

# Use redirect-based OAuth flow instead of a popup window
# See https://backstage.io/docs/auth/#sign-in-configuration
enableExperimentalRedirectFlow: true

app:
  title: OpenChoreo Portal
  # Environment variable is injected by Helm chart (see https://github.com/openchoreo/openchoreo install/helm/openchoreo/templates/backstage/deployment.yaml)
  # For local k3d: http://openchoreo.localhost (set via https://github.com/openchoreo/openchoreo install/dev/openchoreo-values.yaml)
  # For production: external ingress URL (set via https://github.com/openchoreo/openchoreo install/helm/openchoreo/values.yaml backstage.baseUrl)
  baseUrl: ${BACKSTAGE_BASE_URL}

organization:
  name: OpenChoreo

backend:
  # Used for enabling authentication, secret is shared by all backend plugins
  # See https://backstage.io/docs/auth/service-to-service-auth for
  # information on the format
  # auth:
  #   keys:
  #     - secret: ${BACKEND_SECRET}
  auth:
    # Guest mode only: derived from OPENCHOREO_FEATURES_AUTH_ENABLED=false by
    # packages/backend/src/index.ts. Unset leaves the key out entirely, so the
    # default auth policy stays enforced whenever auth is enabled.
    dangerouslyDisableDefaultAuthPolicy: ${BACKSTAGE_DANGEROUSLY_DISABLE_DEFAULT_AUTH_POLICY}
  # Environment variable is injected by Helm chart (see https://github.com/openchoreo/openchoreo install/helm/openchoreo/templates/backstage/deployment.yaml)
  # For local k3d: http://openchoreo.localhost (set via https://github.com/openchoreo/openchoreo install/dev/openchoreo-values.yaml)
  # For production: external ingress URL (set via https://github.com/openchoreo/openchoreo install/helm/openchoreo/values.yaml backstage.baseUrl)
  baseUrl: ${BACKSTAGE_BASE_URL}
  listen:
    port: 7007
    # Uncomment the following host directive to bind to specific interfaces
    # host: 127.0.0.1
  csp:
    connect-src: ["'self'", 'http:', 'https:']
    # Content-Security-Policy directives follow the Helmet format: https://helmetjs.github.io/#reference
    # Default Helmet Content-Security-Policy values can be removed by setting the key to false
  cors:
    origin: ${BACKSTAGE_BASE_URL}
    methods: [GET, HEAD, PATCH, POST, PUT, DELETE]
    credentials: true
  # This is for local development only, it is not recommended to use this in production
  # The production database configuration is stored in app-config.production.yaml
  database:
    client: better-sqlite3
    # v1.51 config schema rejects bare-string connection; use object form.
    # filename: ':memory:' produces an in-memory SQLite database, identical
    # behavior to the legacy connection: ':memory:' bare-string form.
    connection:
      filename: ':memory:'
  # workingDirectory: /tmp # Use this to configure a working directory for the scaffolder, defaults to the OS temp-dir

integrations:
  github:
    - host: github.com
      # This is a Personal Access Token or PAT from GitHub. You can find out how to generate this token, and more information
      # about setting up the GitHub integration here: https://backstage.io/docs/integrations/github/locations#configuration
      token: ${GITHUB_TOKEN}
    ### Example for how to add your GitHub Enterprise instance using the API:
    # - host: ghe.example.net
    #   apiBaseUrl: https://ghe.example.net/api/v3
    #   token: ${GHE_TOKEN}

  # GitLab Integration (required for GitLab CI plugin)
  # Uncomment and configure in app-config.local.yaml if needed for local development
  # For production, this is configured via app-config.production.yaml with Helm-injected env vars
  # gitlab:
  #   - host: gitlab.com
  #     token: ${GITLAB_TOKEN}

# =====================================================================
# External CI Platform Configuration
# =====================================================================
# External CI integrations are controlled by environment variables.
# For local development, uncomment and configure in app-config.local.yaml.
# For production (Helm), configs are in app-config.production.yaml with env var placeholders.
#
# Entity annotations control which CI platform is shown for each component:
#   - Jenkins:        jenkins.io/job-full-name
#   - GitHub Actions: github.com/project-slug (uses integrations.github token)
#   - GitLab:         gitlab.com/project-slug or gitlab.com/project-id
# =====================================================================

# Jenkins Configuration
# Uncomment and configure in app-config.local.yaml if needed for local development
# jenkins:
#   baseUrl: ${JENKINS_BASE_URL}
#   username: ${JENKINS_USERNAME}
#   apiKey: ${JENKINS_API_KEY}

proxy:
  ### Example for how to add a proxy endpoint for the frontend.
  ### A typical reason to do this is to handle HTTPS and CORS for internal services.
  # endpoints:
  #   '/test':
  #     target: 'https://example.com'
  #     changeOrigin: true

# Reference documentation http://backstage.io/docs/features/techdocs/configuration
# Note: After experimenting with basic setup, use CI/CD to generate docs
# and an external cloud storage when deploying TechDocs for production use-case.
# https://backstage.io/docs/features/techdocs/how-to-guides#how-to-migrate-from-techdocs-basic-to-recommended-deployment-approach
techdocs:
  builder: 'local' # Alternatives - 'external'
  generator:
    runIn: 'docker' # Alternatives - 'local'
  publisher:
    type: 'local' # Alternatives - 'googleGcs' or 'awsS3'. Read documentation for using alternatives.

auth:
  # see https://backstage.io/docs/auth/ to learn about auth providers
  environment: development
  providers:
    # OpenChoreo Auth - Works with any OAuth2/OIDC-compliant identity provider
    # Environment variables are injected by Helm chart (see https://github.com/openchoreo/openchoreo install/helm/openchoreo/templates/backstage/deployment.yaml)
    #
    # Configuration modes:
    # 1. OIDC Discovery (preferred): Set metadataUrl to auto-discover endpoints
    # 2. Explicit URLs: Set authorizationUrl and tokenUrl directly
    # If both are set, explicit URLs take precedence over discovered values
    openchoreo-auth:
      development:
        clientId: ${OPENCHOREO_AUTH_CLIENT_ID}
        clientSecret: ${OPENCHOREO_AUTH_CLIENT_SECRET}
        # OIDC Discovery URL (optional) - auto-discovers authorization/token endpoints
        metadataUrl: ${OPENCHOREO_AUTH_METADATA_URL}
        # Explicit OAuth2 endpoints (used if metadataUrl not set, or as override)
        authorizationUrl: ${OPENCHOREO_AUTH_AUTHORIZATION_URL}
        tokenUrl: ${OPENCHOREO_AUTH_TOKEN_URL}
        scope: 'openid profile email' # Override via OPENCHOREO_AUTH_OIDC_SCOPE in production

    # Guest provider - used when openchoreo.features.auth.enabled is false
    # Allows users to access the portal without authentication (demo/development mode)
    # The guest key itself must stay present even when auth is enabled — the
    # guest module reads it at startup. The dangerous flag below is derived from
    # OPENCHOREO_FEATURES_AUTH_ENABLED=false by packages/backend/src/index.ts;
    # unset drops the key, so guest sign-in is refused outside development.
    # (In local dev, NODE_ENV=development allows guest sign-in regardless.)
    guest:
      dangerouslyAllowOutsideDevelopment: ${BACKSTAGE_GUEST_DANGEROUSLY_ALLOW_OUTSIDE_DEVELOPMENT}

scaffolder:
  # see https://backstage.io/docs/features/software-templates/configuration for software template options

openchoreo:
  # Environment variables are injected by Helm chart (see https://github.com/openchoreo/openchoreo install/helm/openchoreo/templates/backstage/deployment.yaml)
  # For local k3d: defaults to http://openchoreo-api.openchoreo.svc.cluster.local:8080/api/v1
  # For production: set via https://github.com/openchoreo/openchoreo install/helm/openchoreo/values.yaml backstage.openchoreoApi.url
  baseUrl: ${OPENCHOREO_API_URL}

  # Authentication configuration
  # User-initiated requests: Token forwarded from frontend (IDP access token via x-openchoreo-token header)
  # Background tasks (Catalog Provider): Uses a separate service client via client credentials below
  auth:
    # OAuth2 Client Credentials for background tasks (Catalog Entity Provider)
    # Uses a dedicated service client — independent from the user-facing sign-in client (auth.providers.openchoreo-auth)
    # Required for the Catalog Provider to fetch organizations, projects, and components
    clientId: ${OPENCHOREO_SERVICE_CLIENT_ID}
    clientSecret: ${OPENCHOREO_SERVICE_CLIENT_SECRET}
    tokenUrl: ${OPENCHOREO_AUTH_TOKEN_URL}
    scope: ${OPENCHOREO_AUTH_SCOPE} # Optional: space-separated scopes (e.g. 'api://client-id/.default openid')

  # Default owner for built-in Backstage entity kinds (Domain, System, Component, API)
  # Required by Backstage schema validation. Custom OpenChoreo kinds don't use owner.
  defaultOwner: 'openchoreo-users'

  # Upstream URL the openchoreo-portal-assistant-backend plugin forwards
  # to (Portal Assistant). Env-var-gated: when OPENCHOREO_PORTAL_ASSISTANT_URL
  # is unset, Backstage substitutes the placeholder as undefined and the
  # backend plugin self-disables (see plugin.ts — "disabled — openchoreo
  # .portalAssistantUrl is not set"). Set the env var only when the
  # assistant feature is enabled (openchoreo.features.assistant.enabled =
  # true) and the portal-assistant service is deployed.
  #
  # For local k3d via port-forward: http://localhost:8088
  # For in-cluster Backstage: http://portal-assistant.openchoreo-control-plane.svc.cluster.local:8080
  # For external access: configure via OPENCHOREO_PORTAL_ASSISTANT_URL env var.
  portalAssistantUrl: ${OPENCHOREO_PORTAL_ASSISTANT_URL}

  schedule:
    frequency: 300 # seconds between runs (default: 300, the periodic full sync acts as a safety net behind the event-forwarder's real-time deltas)
    timeout: 120 # seconds for timeout (default: 120)

  # Observability tuning (optional).
  # Hard cap (seconds) on a single wirelogs SSE stream before the backend ends
  # it; the UI shows soft warnings at ~1/3 and ~2/3 of this value and a toast
  # when the server stops it. Defaults to 900 (15 minutes) when unset.
  observability:
    wirelogs:
      streamTimeoutSeconds: ${OPENCHOREO_OBSERVABILITY_WIRELOGS_STREAM_TIMEOUT_SECONDS}

  # Feature flags for enabling/disabling OpenChoreo functionality
  # These can be controlled via Helm values: backstage.features.*
  # Environment variables: OPENCHOREO_FEATURES_WORKFLOWS_ENABLED, OPENCHOREO_FEATURES_OBSERVABILITY_ENABLED, OPENCHOREO_FEATURES_AUTH_ENABLED, OPENCHOREO_FEATURES_AUTHZ_ENABLED, OPENCHOREO_FEATURES_SECRET_MANAGEMENT_ENABLED
  features:
    # Workflow plane / Workflows functionality
    # When disabled, hides Workflows tab and WorkflowsOverviewCard from entity pages
    workflows:
      enabled: ${OPENCHOREO_FEATURES_WORKFLOWS_ENABLED}
    # Observability plane features (Metrics, Traces, Runtime Logs)
    # When disabled, hides Metrics, Traces, Runtime Logs tabs and RuntimeHealthCard from entity pages
    observability:
      enabled: ${OPENCHOREO_FEATURES_OBSERVABILITY_ENABLED}
    # Authentication configuration
    # When disabled (false), users are automatically logged in as guests (no OAuth required)
    auth:
      enabled: ${OPENCHOREO_FEATURES_AUTH_ENABLED}
      # Must match auth.providers.openchoreo-auth.development.scope
      scope: 'openid profile email'
    # Authorization configuration (Access Control)
    # When disabled, hides Access Control sidebar item and pages
    authz:
      enabled: ${OPENCHOREO_FEATURES_AUTHZ_ENABLED}
    # Secret Management configuration
    # When disabled, hides the Secrets settings tab and disables secret APIs
    secretManagement:
      enabled: ${OPENCHOREO_FEATURES_SECRET_MANAGEMENT_ENABLED}
    # OpenChoreo Assistant chat agent (FAB, drawer, contextual launchers)
    # Opt-in: defaults to false. Requires the perch-agent service and an
    # LLM API key Secret to be deployed. When disabled, hides the chat tab,
    # FailedBuildSnackbar, and the build / logs / component-create launchers.
    assistant:
      enabled: ${OPENCHOREO_FEATURES_ASSISTANT_ENABLED}

  # Component Type Mappings (optional - defaults provided)
  # Maps OpenChoreo component types to Backstage page variants
  # Custom mappings are evaluated before defaults
  # componentTypes:
  #   mappings:
  #     # Example: All React-based components should use website page variant
  #     - pattern: '^deployment/react-.*'
  #       pageVariant: 'website'
  #
  #     # Example: Anything with 'api' should be a service page variant
  #     - pattern: '^deployment/.*api.*'
  #       pageVariant: 'service'
  #
  #     # Example: Python workers might be scheduled tasks
  #     - pattern: '^deployment/python-worker.*'
  #       pageVariant: 'scheduled-task'
  #
  # Default mappings (applied if no custom mapping matches):
  # - deployment/.*web-app.*     -> website
  # - deployment/.*webapp.*      -> website
  # - deployment/.*frontend.*    -> website
  # - cronjob/.*                 -> scheduled-task
  # - job/.*                     -> scheduled-task
  # - deployment/.*              -> service
  # - statefulset/.*             -> service
  # - (no match)                 -> default (uses defaultEntityPage)

thunder:
  # Environment variables are injected by Helm chart (see https://github.com/openchoreo/openchoreo install/helm/openchoreo/templates/backstage/deployment.yaml)
  # For local k3d: set THUNDER_BASE_URL via https://github.com/openchoreo/openchoreo install/dev/openchoreo-values.yaml (defaults to internal service URL)
  # For production: set via https://github.com/openchoreo/openchoreo install/helm/openchoreo/values.yaml backstage.thunder.baseUrl
  baseUrl: ${THUNDER_BASE_URL} # e.g., http://sts.openchoreo.localhost or https://idp.example.com
  # token: ${THUNDER_TOKEN} # Optional: uncomment if you need Thunder API authentication
  defaultNamespace: 'default' # Default namespace for User and Group entities
  schedule:
    frequency: 600 # seconds between runs (default: 600 = 10 minutes)
    timeout: 300 # seconds for timeout (default: 300 = 5 minutes)

catalog:
  import:
    entityFilename: catalog-info.yaml
    pullRequestBranchName: backstage-integration
  rules:
    - allow:
        [Component, System, API, Resource, Location, User, Group, Environment]
  locations:
    # Placeholder groups for Backstage entity owner references
    - type: file
      target: ../../catalog-entities/org.yaml
      rules:
        - allow: [Group]
    # Per-ProjectType "Create Project" wizards are generated by the
    # OpenChoreoEntityProvider (PtdToTemplateConverter), so no static
    # create-openchoreo-project Location is registered here.
    - type: file
      target: ../../templates/create-openchoreo-componenttype/template.yaml
      rules:
        - allow: [Template]
    - type: file
      target: ../../templates/create-openchoreo-resourcetype/template.yaml
      rules:
        - allow: [Template]
    - type: file
      target: ../../templates/create-openchoreo-projecttype/template.yaml
      rules:
        - allow: [Template]
    - type: file
      target: ../../templates/create-openchoreo-trait/template.yaml
      rules:
        - allow: [Template]
    - type: file
      target: ../../templates/create-openchoreo-workflow/template.yaml
      rules:
        - allow: [Template]
    - type: file
      target: ../../templates/create-openchoreo-environment/template.yaml
      rules:
        - allow: [Template]
    - type: file
      target: ../../templates/create-openchoreo-namespace/template.yaml
      rules:
        - allow: [Template]
    - type: file
      target: ../../templates/create-openchoreo-deploymentpipeline/template.yaml
      rules:
        - allow: [Template]
    - type: file
      target: ../../templates/create-openchoreo-clustercomponenttype/template.yaml
      rules:
        - allow: [Template]
    - type: file
      target: ../../templates/create-openchoreo-clusterresourcetype/template.yaml
      rules:
        - allow: [Template]
    - type: file
      target: ../../templates/create-openchoreo-clusterprojecttype/template.yaml
      rules:
        - allow: [Template]
    - type: file
      target: ../../templates/create-openchoreo-clustertrait/template.yaml
      rules:
        - allow: [Template]
    - type: file
      target: ../../templates/create-openchoreo-clusterworkflow/template.yaml
      rules:
        - allow: [Template]
    - type: file
      target: ../../templates/create-openchoreo-notification-channel/template.yaml
      rules:
        - allow: [Template]
    # - type: file
    #   target: ../../templates/create-openchoreo-component/template.yaml
    #   rules:
    #     - allow: [Template]

    ## Uncomment these lines to add more example data
    # - type: url
    #   target: https://github.com/backstage/backstage/blob/master/packages/catalog-model/examples/all.yaml

    ## Uncomment these lines to add an example org
    # - type: url
    #   target: https://github.com/backstage/backstage/blob/master/packages/catalog-model/examples/acme-corp.yaml
    #   rules:
    #     - allow: [User, Group]
  # Experimental: Always use the search method in UrlReaderProcessor.
  # New adopters are encouraged to enable it as this behavior will be the default in a future release.
  useUrlReadersSearch: true

kubernetes:
  # see https://backstage.io/docs/features/kubernetes/configuration for kubernetes configuration options

# Event-driven catalog sync — accepts webhook POSTs from the OpenChoreo CRD event-forwarder
events:
  http:
    topics:
      - openchoreo

# see https://backstage.io/docs/permissions/getting-started for more on the permission framework
permission:
  # setting this to `false` will disable permissions
  enabled: true