config.yml.example

# Server configurations
service:
  # Interface or ip to bind to, to bind to all interfaces use * (default: "*")
  host: "*"
  # Port to bind to (default: 8080)
  port: 8080
  api_prefix: "api"

  # Enable development mode (default: false)
  # Warning: Setting this to true will make cookies accessible via JavaScript
  dev_mode: false

  # Json Web Token configuration
  jwt:
    # Valid methods RS256, HS256
    signing_method: RS256

    # The secret to use for JWT (only for required for HS256)
    signing_secret:

    # Path to private PEM file or shared secret as a string
    signing_key: ./jwt.key

    # Path to public PEM file (only required for RS256)
    public_key: ./jwt.pub

    # The secret to use for JWT (only for required for HS256)
    refresh_signing_secret:

    # Path to private PEM file or shared secret as a string
    refresh_signing_key: ./refresh_jwt.key

    # Path to public PEM file (only required for RS256)
    refresh_public_key: ./refresh_jwt.pub

  # TOTP configuration
  totp:
    # TOTP window size (default: 1)
    skew: 1

  # Backup codes configuration for 2FA
  backup_codes:
    # Base64-encoded encryption key for backup codes (32 bytes for AES-256)
    # Generate with: openssl rand -base64 32
    encryption_key: ""

  # Google reCAPTCHA v3 configuration
  recaptcha:
    # Enable/disable reCAPTCHA verification (default: false)
    enabled: false
    # Google reCAPTCHA v3 secret key
    secret_key: ""
    # Minimum score threshold (0.0 to 1.0, default: 0.5)
    min_score: 0.5
    # Field name in JSON payload containing the reCAPTCHA token (default: "recaptcha_token")
    field_name: "recaptcha_token"

  # CORS configuration
  cors:
    # Allowed origins
    allowed_origins:
      - "*"
    allow_methods:
      - "GET"
      - "POST"
      - "PUT"
      - "DELETE"
      - "OPTIONS"
    allow_credentials: true
    max_age: 0

  cookie:
    same_site_none: false

  # Mail configuration
  mail:
    # Enable/disable mail service (default: true)
    enabled: true
    # Number of mail worker goroutines (default: 5)
    workers: 5
    # Directory containing email templates (default: "internal/mail/templates")
    # If empty, embedded templates will be used
    template_dir: ""
    # Default template to use for emails (default: "default")
    default_template: "default"

  # Graceful shutdown timeout in seconds (default: 10)
  shutdown_timeout_seconds: 10

  # HTTP server timeout configurations (in seconds)
  http:
    # Timeout for reading request headers - prevents Slowloris attacks (default: 30)
    read_header_timeout_seconds: 30
    # Timeout for reading the entire request (default: 60)
    read_timeout_seconds: 60
    # Timeout for writing the response (default: 60)
    write_timeout_seconds: 60
    # Timeout for keep-alive connections (default: 90)
    idle_timeout_seconds: 90

  # Password reset token configuration
  password_reset:
    # Length of generated password reset tokens (default: 32)
    token_length: 32
    # How long password reset tokens are valid in minutes (default: 60)
    token_lifetime_minutes: 60
    # How often to clean up expired tokens in hours (default: 24)
    cleanup_interval_hours: 24
    # Maximum number of active tokens per user (default: 3)
    max_tokens_per_user: 3

  # Cron job configuration for scheduled tasks
  cron:
    # Enable/disable cron service (default: false)
    enabled: false
    # Cron expression for password reset token cleanup (default: "0 0 * * *" - daily at midnight)
    # Examples:
    #   "*/5 * * * *"  - Every 5 minutes
    #   "0 */6 * * *"  - Every 6 hours
    #   "0 0 * * *"    - Daily at midnight
    #   "0 0 * * 0"    - Weekly on Sunday at midnight
    password_reset_cleanup: "0 0 * * *"
    # Timezone for cron jobs (default: "UTC")
    timezone: "UTC"

  # Channel registration configuration
  channel_registration:
    # Enable/disable channel registration feature (default: true)
    enabled: true
    # Allow users to register multiple channels (default: false)
    allow_multiple: false
    # Number of supporters required for channel registration (default: 5)
    required_supporters: 5
    # Cooldown period between channel registrations in hours (default: 168 = 7 days)
    cooldown_hours: 168
    # Maximum channels allowed for regular users (default: 1)
    max_channels_regular: 1
    # Maximum channels allowed for supporter users (default: 5)
    max_channels_supporter: 5
    # Maximum channels allowed for admin users (default: 10)
    max_channels_admin: 10
    # Maximum IRC idle time in hours before restricting registration (default: 168 = 7 days)
    irc_idle_hours: 168

  # Rate limiting configuration
  rate_limit:
    # Enable/disable rate limiting (default: false)
    enabled: false
    # Number of requests allowed per minute (default: 10)
    requests_per_minute: 10
    # Burst size for rate limiting (default: 5)
    burst_size: 5
    # Time window for rate limiting in minutes (default: 1)
    window_minutes: 1
    # Rate limiting mode: "global", "endpoints", or "channels" (default: "channels")
    mode: "channels"
    # Endpoint patterns to rate limit (used with mode: "endpoints")
    # Pattern format: "METHOD:/path/pattern" or "/path/pattern" (any method)
    # Supports wildcards: * for any segment, ** for any number of segments
    # NOTE: Patterns must match the full request path including API prefix
    endpoints:
      - "POST:/api/v1/channels"    # Channel registration only
      - "POST:/api/v1/users"       # User registration
      - "GET:/api/v1/users/*"      # Any user endpoint
      - "/api/v1/admin/**"         # All admin endpoints (any method)
      - "POST:**"                  # All POST requests

# SMTP mail configuration
smtp:
  # SMTP server host (default: "localhost")
  host: "localhost"
  # SMTP server port (default: 1025)
  port: 1025
  # SMTP username (optional)
  username: ""
  # SMTP password (optional)
  password: ""
  # Use TLS for SMTP connection (default: false)
  use_tls: false
  # Default from email address
  from_email: "noreply@cservice.undernet.org"
  # Default from name
  from_name: "UnderNET CService"

# Postgres database configuration
database:
  host: "localhost"
  port: 5432
  username: "cservice"
  password: "cservice"
  name: "cservice"
  auto_migration: true

# Redis config
redis:
  host: "localhost"
  port: 6379
  password: ""
  db: 0

# OpenTelemetry configuration
telemetry:
  # Enable/disable OpenTelemetry (default: false)
  enabled: false

  # Service identification
  service_name: "cservice-api"
  service_version: "1.0.0"

  # OTLP (OpenTelemetry Protocol) exporter configuration
  otlp:
    # OTLP endpoint (gRPC or HTTP)
    endpoint: ""
    # Additional headers for OTLP requests
    headers: {}
    # Use insecure connection (default: false)
    insecure: false

  # Prometheus metrics configuration
  prometheus:
    # Enable Prometheus metrics endpoint (default: false)
    enabled: false
    # Metrics endpoint path (default: "/metrics")
    endpoint: "/metrics"

  # Jaeger tracing configuration
  jaeger:
    # Enable Jaeger exporter (default: false)
    enabled: false
    # Jaeger endpoint
    endpoint: ""

  # Tracing configuration
  tracing:
    # Enable distributed tracing (default: true when telemetry is enabled)
    enabled: true
    # Trace sampling rate from 0.0 to 1.0 (default: 0.1)
    sample_rate: 0.1

  # Metrics configuration
  metrics:
    # Enable metrics collection (default: true when telemetry is enabled)
    enabled: true
    # Metrics collection interval in seconds (default: 30)
    interval: 30

  # Resource attributes for telemetry data
  resource:
    # Additional resource attributes as key-value pairs
    attributes: {}