# Kererū Forms configuration (YAML)
# Pass with: kereru-forms --conf ./config.yaml

logLevel: info
logFormat: console
environment: development

listenAddr: 0.0.0.0
listenAddr6: ""
port: "8080"

dbDriver: sqlite
dbDsn: "file:kereru.db?_pragma=busy_timeout(5000)&_pragma=foreign_keys(1)"

# Optional: directory with the built SPA (served with history fallback)
staticDir: ""

telemetryEnabled: false
otlpEndpoint: "localhost:4318"

corsOrigins:
  - "http://localhost:5173"

# Authentication. If oidc.issuerUrl is empty, the local password is used and
# grants both admin and view roles. If an OIDC issuer is configured, local
# password login is disabled and the SPA uses authorization-code flow + PKCE.
auth:
  localPassword: "admin"
  requireSubmissionAuth: false
  # Empty generates a random secret per process. Set a stable value to keep
  # local-password tokens valid across restarts or multiple replicas.
  localTokenSecret: ""
  localTokenTtlHours: 8
  oidc:
    issuerUrl: ""
    clientId: ""
    scopes:
      - openid
      - profile
      - email
    # Dot-separated claim path. Examples: "roles", "groups",
    # "realm_access.roles" (Keycloak).
    roleClaim: "roles"
    adminRole: "admin"
    viewRole: "view"