# Pulumi.foundation.yaml — stack config for the single `foundation` stack.
#
# THIS FILE CONTAINS NON-SECRET PLACEHOLDERS ONLY (CONTRACT_001 §1.2).
# All keys here are reproducible/derivable and safe to commit in plaintext.
#
# NO secrets are committed yet (CONTRACT_001 §1.3). The secret keys
#   vaultCredentials:rootToken, vaultCredentials:unsealKeys,
#   foundation:cloudflareApiToken, foundation:backup.offsiteAccessKey/SecretKey
# are added by LATER tasks as `secure: v1:…` passphrase-encrypted values
# (T05 Vault init capture, etc.). There is intentionally NO `encryptionsalt`
# line yet because no secret has been encrypted into this stack — committing an
# encryptionsalt (or any secret material) is forbidden by baseline D2.
#
# OPERATOR NOTE: every `pulumi preview/up` under the passphrase provider rewrites
# this file — it appends an `encryptionsalt:` line and quotes scalars ("2222",
# "true"). Before committing, STRIP any `encryptionsalt:` line that Pulumi added
# (no secret depends on it yet; D2 forbids committing it). The loader (config.ts)
# reads scalars via getNumber/getBoolean, so quoted or unquoted both parse.
#
# Image digests are NOT here — they live in foundation/VERSIONS (determinism, D5).
config:
  # --- identity / networking (CONTRACT_001) ---
  foundation:baseDomain: olsitec.de
  foundation:hosts.forge: forge.olsitec.de
  foundation:hosts.vault: vault.olsitec.de
  foundation:hosts.s3: s3.olsitec.de
  foundation:forgeSshPort: 2222

  # --- deployment target (Docker-over-SSH provider; key path comes from ENV) ---
  # Placeholder VM coordinates — replaced with the real foundation VM in Phase 0 / T03+.
  foundation:vm.host: 192.0.2.10
  foundation:vm.user: deploy

  # --- container plane (CONTRACT_003 §3.1) ---
  foundation:network.name: foundation-net
  foundation:network.subnet: 172.30.0.0/24
  foundation:dataRoot: /srv/foundation

  # --- TLS strategy (day-zero starts internal-ca, switch to LE later — CONTRACT_001) ---
  foundation:tls.mode: internal-ca
  foundation:tls.acmeEmail: platform@olsitec.de

  # --- fixed names (derived, non-secret; creds are generated → Vault) ---
  foundation:postgres.db: foundation
  foundation:postgres.forgejoDb: forgejo
  foundation:rustfs.buckets:
    - forgejo-packages
    - forgejo-artifacts
    - forgejo-lfs
    - foundation-backups
  foundation:forgejo.adminUser: platform-admin
  foundation:forgejo.orgName: olsitec
  # PLAN-001 §4a runner labels (docker + dind backends).
  foundation:runner.labels:
    - docker:docker://node:20-bookworm
    - dind:docker://-

  # --- credential feature flags (ADR-002; selects what @pulumi/random generates) ---
  # NOTE: index.ts is a T02 no-op scaffold — these flags create NOTHING yet.
  # They are committed so the typed surface is complete and later tasks read them.
  foundation:features.postgres: true
  foundation:features.rustfs: true
  foundation:features.forgejo: true
  foundation:features.runner: true
  foundation:features.backup: true
  foundation:features.registry: true

  # --- backup (offsite creds are SECRET → seeded later, not here) ---
  foundation:backup.bucket: foundation-backups
  foundation:backup.offsiteEndpoint: https://offsite.example.invalid:9000
  foundation:backup.retentionDaily: 7
  foundation:backup.retentionWeekly: 4