# Quickstart Configuration for MCP Authorization Gateway
#
# This single configuration file generates all required configs:
#   - agentgateway or envoy gateway configuration
#   - authz-bridge configuration
#
# Environment variables can be used with ${VAR_NAME} syntax.
# The only secret that must be provided separately is the Duo secret key
# via the DUO_SKEY_FILE environment variable pointing to a mounted secret.
#
# Usage:
#   1. Copy this file to quickstart.conf and edit as needed
#   2. Generate configurations:
#      authz-bridge -config-gen -gateway-type agentgateway -config-gen-input quickstart.conf -config-gen-output agentgateway.conf
#      authz-bridge -config-gen -gateway-type envoy -config-gen-input quickstart.conf -config-gen-output envoy.conf
#      authz-bridge -config-gen -gateway-type authz-bridge -config-gen-input quickstart.conf -config-gen-output authz-bridge.conf

# Gateway configuration - the endpoint clients connect to
gateway:
  # URL that the gateway listens on internally
  url: "http://localhost:3000/mcp"

  # External URL that clients use to connect (optional)
  # Use this when behind a load balancer where the public URL differs from the internal URL.
  # The OAuth audience and resource metadata will use this URL instead of 'url'.
  # The path must match 'url' (only protocol, host, and port can differ).
  # external_url: "https://api.example.com/mcp"

  # TLS configuration (required when URL uses https)
  # When using docker-compose.tls.yaml:
  #   - Place certificate in ./certs/gateway.crt
  #   - Place private key in ./secrets/gateway_key
  tls:
    # cert_file: "/certs/gateway.crt"
    # key_file: "/run/secrets/gateway_key"

# Upstream MCP servers
# Each server is exposed through the gateway with its name as prefix
upstreams:
  - name: everything
    url: "http://everything-mcp:8080/mcp"

  - name: github
    url: "http://github-mcp:8080/mcp"

  - name: slack
    url: "http://slack-mcp:3000/mcp"

# OAuth/OIDC configuration
oauth:
  # OAuth issuer URL
  # The JWKS URL is automatically fetched from {issuer}/.well-known/openid-configuration
  issuer: "https://accounts.google.com"

  # OAuth client ID for admin panel access
  # Tokens with this audience can list tools but cannot invoke them
  admin_panel_client_id: "admin-panel-client"

# Duo Authorization API configuration
duo:
  # Duo API hostname (from your Duo Admin Panel)
  host: "api-XXXXXXXX.duosecurity.com"

  # Integration key (ikey) - must be one of the Duo MCP Gateway integration
  integration_key: "DIXXXXXXXXXXXXXXXXXX"

  # Path to file containing the secret key (skey)
  # For Docker: mount your secret to this path
  # For Kubernetes: use a secret volume mount
  secret_key_file: "/run/secrets/duo_skey"

  # Request timeout in seconds (default: 30)
  # Note if this is 0 or not specified, the default of 30 is used
  # There is no way to set 'no timeout', a sufficiently long timeout can be used here.
  timeout: 30

  # Skip TLS verification (for testing only - never use in production!)
  insecure_skip_verify: false

# Authz bridge server configuration
authz_bridge:
  # Service hostname for the gateway to connect to (default: "authz-bridge:9001")
  # This is the address the gateway uses to reach the authz-bridge service.
  host: "authz-bridge:9001"

  # Bind address for the authz-bridge server (default: ":9001")
  # This is the address the authz-bridge listens on (e.g., "0.0.0.0:9001", ":9001").
  address: ":9001"

  # Timeout for authorization requests from the gateway (default: "10s")
  timeout: "10s"

  # TLS configuration for the authz-bridge gRPC server
  # When using docker-compose.tls.yaml:
  #   - Place certificate in ./certs/authz-bridge.crt
  #   - Place private key in ./secrets/authz_bridge_key
  tls:
    enabled: false
    # cert_file: "/certs/authz-bridge.crt"
    # key_file: "/run/secrets/authz_bridge_key"

# Global TLS settings
tls:
  # Custom CA certificate file for trusting internal/self-signed certs
  # ca_cert_file: "/certs/ca.crt"
