##########################################
# VersityGW standalone IAM configuration #
##########################################

# Copy this file to /etc/versitygw.d/ and rename it to a unique service name.
# For example, /etc/versitygw.d/iam.conf is started with:
# systemctl start versitygw@iam
# systemctl enable versitygw@iam

##############################
# VersityGW Required Options #
##############################

# Run the standalone IAM API server.
VGW_BACKEND=iam

# The IAM API needs one storage backend. Set VGW_IAM_DIR for local file-backed
# storage, or configure VGW_IAM_VAULT_ENDPOINT_URL and its authentication
# options below for HashiCorp Vault storage.
VGW_IAM_DIR=/var/lib/versitygw/iam

# The access and secret options specify the root account credentials. The root
# account has full authorization to IAM API requests after authentication.
ROOT_ACCESS_KEY_ID=
ROOT_SECRET_ACCESS_KEY=

############################
# VersityGW Global Options #
############################

# The IAM API listener address. It accepts the same comma-separated TCP or
# UNIX-socket addresses as the gateway, for example :7076 or /run/vgw/iam.sock.
#VGW_PORT=:7076

# TLS certificate and private key for the IAM API listener.
#VGW_CERT=
#VGW_KEY=

# Maximum concurrent connections and in-flight requests.
#VGW_MAX_CONNECTIONS=250000
#VGW_MAX_REQUESTS=100000

# Region returned by IAM responses. Defaults to us-east-1.
#VGW_REGION=us-east-1

# Silence request logging to stdout.
#VGW_QUIET=false

# Enable HTTP keep-alive connections.
#VGW_KEEP_ALIVE=false

# File-mode permissions for file-backed UNIX sockets, as an octal integer.
#VGW_SOCKET_PERM=

# Configure this when a browser-based WebUI on another origin accesses IAM.
#VGW_CORS_ALLOW_ORIGIN=

# Override the S3 gateway URLs offered by the WebUI. Specify one or more
# comma-separated URLs, for example http://localhost:7070 or
# https://s3.example.com.
#VGW_WEBUI_GATEWAYS=

#################
# Vault Storage #
#################

# Use Vault instead of VGW_IAM_DIR by setting the Vault endpoint and suitable
# credentials.

# Vault server URL for IAM storage.
#VGW_IAM_VAULT_ENDPOINT_URL=

# Fallback Vault namespace for both AppRole authentication and KV v2 storage.
# The more-specific authentication and storage namespace options override it.
#VGW_IAM_VAULT_NAMESPACE=

# KV v2 path prefix used to store IAM users. Defaults to iam.
#VGW_IAM_VAULT_SECRET_STORAGE_PATH=iam

# Vault namespace for the KV v2 IAM storage path. Overrides VGW_IAM_VAULT_NAMESPACE.
#VGW_IAM_VAULT_SECRET_STORAGE_NAMESPACE=

# Vault authentication method mount path. Defaults to approle.
#VGW_IAM_VAULT_AUTH_METHOD=approle

# Vault namespace used for AppRole login. Overrides VGW_IAM_VAULT_NAMESPACE.
#VGW_IAM_VAULT_AUTH_NAMESPACE=

# Vault KV v2 secrets engine mount path. Defaults to kv-v2.
#VGW_IAM_VAULT_MOUNT_PATH=kv-v2

# Vault root token for authentication. Do not set this with the AppRole ID or
# secret options below.
#VGW_IAM_VAULT_ROOT_TOKEN=

# Vault AppRole role ID for authentication. Set with VGW_IAM_VAULT_ROLE_SECRET
# instead of VGW_IAM_VAULT_ROOT_TOKEN.
#VGW_IAM_VAULT_ROLE_ID=

# Vault AppRole secret ID for authentication. Set with VGW_IAM_VAULT_ROLE_ID
# instead of VGW_IAM_VAULT_ROOT_TOKEN.
#VGW_IAM_VAULT_ROLE_SECRET=

# PEM-encoded Vault server TLS certificate used to verify the Vault server.
#VGW_IAM_VAULT_SERVER_CERT=

# PEM-encoded client TLS certificate presented to Vault.
#VGW_IAM_VAULT_CLIENT_CERT=

# PEM-encoded private key for VGW_IAM_VAULT_CLIENT_CERT.
#VGW_IAM_VAULT_CLIENT_CERT_KEY=

############################
# Private IAM API Listener #
############################

# This private endpoint serves the VersityGW protocol used by S3 gateway
# instances to communicate directly with the standalone IAM service.

# Private endpoint listen addresses. Set one or more comma-separated UNIX
# socket paths, or TCP addresses such as :7077 or 127.0.0.1:7077. TCP listeners
# require the three mTLS settings below; UNIX sockets do not.
#VGW_IAM_PRIVATE_PORTS=

# TLS server certificate for TCP private endpoint listeners.
#VGW_IAM_PRIVATE_CERT=

# TLS private key for VGW_IAM_PRIVATE_CERT.
#VGW_IAM_PRIVATE_CERT_KEY=

# PEM-encoded CA bundle used to verify the S3 gateway's client certificate on
# TCP private endpoint listeners.
#VGW_IAM_PRIVATE_CLIENT_CA=

# Octal permissions for file-backed UNIX private sockets, for example 0660.
# This does not affect TCP or Linux abstract-namespace sockets.
#VGW_IAM_PRIVATE_SOCKET_PERM=

#################
# OIDC Settings #
#################

# Reject OIDC provider creation without an explicit certificate thumbprint.
#VGW_IAM_DISABLE_OIDC_THUMBPRINT_AUTOFETCH=false

# Allow OIDC provider URLs that resolve to loopback/private/link-local
# addresses and that carry an explicit port; needed for an identity provider
# that only exists on an internal network, and also re-permits cloud
# metadata endpoints as fetch targets.
#VGW_IAM_OIDC_ALLOW_PRIVATE_ENDPOINTS=false

# Allow plaintext http OIDC provider URLs and skip TLS certificate
# verification (thumbprint pinning included) for https ones; only for an
# identity provider reached over an already-trusted path, such as a
# loopback-bound sidecar.
#VGW_IAM_OIDC_ALLOW_INSECURE_TRANSPORT=false

# Fetch one OIDC provider's discovery document from somewhere other than the
# provider URL itself, as '<provider url>=<discovery url>'. Specify one or
# more comma-separated entries. The discovery URL is fetched exactly as
# given, so include the '/.well-known/openid-configuration' path, and it may
# be a private in-cluster address without VGW_IAM_OIDC_ALLOW_PRIVATE_ENDPOINTS.
# Tokens are still matched against the provider URL, and keys are still read
# from the jwks_uri the fetched document publishes.
#VGW_IAM_OIDC_DISCOVERY_URLS=