---
# logarchiver non-secret config. Secrets (NATS/S3/ClickHouse creds) and the
# subject filter come from env; everything else uses the binary's built-in
# defaults, which already target this stack. ack_wait MUST exceed batch.max_age
# so unacked messages in an open batch are not redelivered mid-batch.
apiVersion: v1
kind: ConfigMap
metadata:
  name: logarchiver-config
  namespace: logging
data:
  config.yaml: |
    nats:
      ack_wait: 5m
      fetch_batch: 512
    batch:
      max_bytes: 67108864
      max_events: 200000
      max_age: 2m
    # Pin the proven RGW endpoint/bucket; ignore the secret's S3_ENDPOINT/BUCKET_NAME
    # (AWS creds still come from the secret env). endpoint_env/bucket_env off.
    s3:
      endpoint: "https://s3.ceph.unkin.net"
      bucket: "logs-archive"
      region: "us-east-1"
      path_style: true
      ca_file: /etc/vault-ca/ca.crt
      endpoint_env: ""
      bucket_env: ""
    crypto:
      key_name: logarchive
      pubkey_source: vault
      vault:
        address: "https://vault.service.consul:8200"
        mount: gpg
        auth_method: kubernetes
        k8s_mount: k8s/au/syd1
        k8s_role: logging_logarchiver
        k8s_jwt_path: /var/run/secrets/vault/token
        ca_file: /etc/vault-ca/ca.crt