server:
  listen: "0.0.0.0:18000"
  wire_listen: "0.0.0.0:19080"
  edge_wire_listen: "0.0.0.0:19081"
  edge_wire_tls:
    enabled: false
    cert: "/run/secrets/iop/control-plane.crt"
    key: "/run/secrets/iop/control-plane.key"
    ca: "/run/secrets/iop/credential-plane-ca.crt"
    peer_role: "edge"

database:
  url: ""

# Provider secret at-rest encryption. Leave all three fields empty/zero to run
# with encryption disabled (provider-secret mutations fail closed). To enable,
# a deployment secret manager mounts the key manifest as a 0600 file at
# key_file; only the id/version placeholders below are tracked, never key bytes.
credential_encryption:
  key_file: ""
  active_key_id: ""
  active_key_version: 0

# Enable only with the complete HTTPS, mTLS, issuer, database, and at-rest
# encryption composition. Tracked files contain paths and key ids, never keys.
credential_plane:
  enabled: false
  https:
    enabled: false
    cert: "/run/secrets/iop/control-plane-https.crt"
    key: "/run/secrets/iop/control-plane-https.key"
  issuer_key_id: "credential-issuer-v1"
  issuer_private_key: "/run/secrets/iop/credential-issuer.ed25519"
  lease_ttl_seconds: 30
  lease_cache_size: 256

redis:
  url: ""
  key_prefix: "iop:control-plane:"

tls:
  enabled: false

logging:
  level: "info"
  pretty: true

metrics:
  port: 9093