# logarchiver configuration example.
#
# Every field below shows its built-in default (the defaults are tuned for the
# centralized logging stack in argocd-apps #296). In k8s you typically deploy
# with NO config file and let the defaults + secret env vars drive everything;
# this file documents the knobs and is handy for local/dev runs.
#
# Precedence: built-in defaults < this file < environment variables.

nats:
  url: "nats://nats.logging.svc.cluster.local:4222"
  stream: "LOGS"
  # Durable pull-consumer name. Reusing "archiver" takes over the leg the Vector
  # archiver currently owns; use a distinct name (e.g. "archiver-canary") to run
  # alongside it during migration.
  durable: "archiver"
  # Server-side subject filter(s). Overridable via env ARCHIVE_SUBJECTS
  # (space-separated). Default archives Vault audit logs only.
  subjects:
    - "logs.k8s.vault.>"
  user: "log-consumer"
  # Password comes from the nats-auth secret via NATS_CONSUMER_PASSWORD.
  password: ""
  password_env: "NATS_CONSUMER_PASSWORD"
  ca_file: ""            # in-cluster NATS is plaintext
  fetch_batch: 512
  ack_wait: "2m"

batch:
  # A per-subject batch becomes one object when any bound is hit.
  max_bytes: 67108864    # 64 MiB raw NDJSON
  max_events: 200000
  max_age: "5m"

s3:
  endpoint: "https://s3.ceph.unkin.net"
  bucket: "logs-archive"
  region: "us-east-1"
  path_style: true
  # Object key template. Fields: {{.Subject}} {{.Year}} {{.Month}} {{.Day}}.
  key_prefix: "archive/{{.Subject}}/{{.Year}}/{{.Month}}/{{.Day}}/"
  ca_file: "/etc/vault-ca/ca.crt"
  # Credentials come from the cephrgw BucketAccess secret logs-archive-s3 via the
  # standard AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY env vars. Endpoint/bucket
  # can also be sourced from that secret's S3_ENDPOINT / BUCKET_NAME keys:
  endpoint_env: "S3_ENDPOINT"
  bucket_env: "BUCKET_NAME"

crypto:
  # Vault GPG engine key used to encrypt objects (public key) and decrypt on
  # retrieval (private key, server-side in Vault).
  key_name: "logarchive"
  # Where the service gets the PUBLIC key: "file" (mounted armored key, no Vault
  # dependency for the service) or "vault" (read gpg/keys/<name>).
  pubkey_source: "file"
  pubkey_file: "/etc/logarchiver/pubkey.asc"
  refresh_interval: "1h"
  frame_size: 1048576    # 1 MiB AES-GCM frames (streaming decrypt granularity)
  vault:
    address: ""          # falls back to VAULT_ADDR
    mount: "gpg"
    auth_method: "kubernetes"   # service: kubernetes; CLI always uses token
    k8s_role: "default"
    k8s_mount: "k8s/au/syd1"
    k8s_jwt_path: "/var/run/secrets/kubernetes.io/serviceaccount/token"
    ca_file: ""

index:
  enabled: true
  address: "clickhouse-logs.logging.svc.cluster.local:9000"  # native protocol
  database: "logs"
  table: "archive_index"
  username: "vector"
  password: ""
  password_env: "CLICKHOUSE_PASSWORD"
  tls: false             # in-cluster ClickHouse is plaintext

metrics:
  enabled: true
  address: ":9090"       # /metrics and /healthz

log:
  level: "info"          # debug|info|warn|error
  format: "json"         # json|text