apiVersion: v1
data:
  nelson.cfg: |
    nelson {
      # generic default timeout for all http requests that
      # nelson is going to make to other systems (e.g. Github, Nomad)
      timeout = 4 seconds

      # how frequently should the reconciliation background process
      # execute? depending on how many tasks you are dealing with on
      # your datacenter schedulers, you might want to run this more or
      # less frequently as the calls are fairly expensive.
      reconciliation-cadence = 2 hours

      # how frequently should we run the readiness check to see if a
      # deployment is ready to take active traffic (based on the consul
      # health checks).
      readiness-delay = 3 minutes

      # how frequently should nelson write out the discovery information
      # to consul. this should not be set too high as it will affect the
      # frequency and choppiness of updates in the runtime.
      discovery-delay = 2 minutes

      # when nelson goes to fetch the users manifest from their github
      # repo, where should nelson expect to find the manifest file. By
      # default, the expectation is that this config is a path from the
      # root of the repository.
      manifest-filename = ".nelson.yml"

      # allowed list or ports that a loadbalancer can expose
      proxy-port-whitelist = [ 80, 443, 8080 ]

      # upon receiving a github release event, where should Nelson assume the
      # application should get deployed too. This can either be a root namespace,
      # or a subordinate namespace, e.g. `stage/unstable`... its arbitrary, but the
      # namespace must exist (otherwise Nelson will attempt to create it on boot)
      default-namespace = "default"

      network {
        # represents the domain that users will call nelson on.
        # separating these two concerns as nelson is typically run behind
        # a reverse proxy that handles SSL termination
        external-host = "nelson.local"
        # if external-port is not supplied, then we assume port 443 (https)
        external-port = 443

        # will we be using HTTPS to present the nelson API to the world
        enable-tls = true

        monitoring-port = 5775
      }

      security {
        expire-login-after = 14 days
        # needs to be a static long which is used to salt the key derivation,
        # but as we do not need rotating keys for use within nelson, we just
        # fix this value.
        key-id = 468513861

        # IMPORTANT: you must specify a value for this
        # entropy used for the creation of encryption hmac and encryption
        # blob = "be-sure-to-change-this"

        # for development sometimes we want to not have to actually log in
        # with github. when set to `true` this will force the system to "auto-auth"
        # the system based on local environment variables. This really is for
        # development use only!
        use-environment-session = false

        # Both of these keys can be generated by bin/generate-keys
        #
        # IMPORTANT: you must specify a value for this
        # Required: The key used to encrypt session tokens, in base64.
        # DO NOT SHARE
        encryption-key = "unknown"
        #
        # IMPORTANT: you must specify a value for this
        # The private key used to sign session tokens, in base64.
        # DO NOT SHARE
        signature-key = "unknown"
      }

      # How will Nelson talk to Github. Please refer to the Github documentation
      # for more information: http://bit.ly/2r5pYVO
      #
      # In addition to the Github application, Nelson also requires its own user-level
      # account on github (this will be fixed in future versions so that its not required).
      github {
        client-id = "xxxxxxxxxxx"
        client-secret = "yyyyy"
        redirect-uri = "http://nelson.local/auth/exchange"
        scope  = "repo"
        access-token = "replaceme"
        system-username = "nelson"
      }

      # Nelson is expecting to be able to talk to the docker socket in
      # order to push, pull and execute docker containers. Typically the
      # `connection` field will take the form of either `tcp://127.0.0.1:1234`
      # or a unix socket location like `unix:///var/run/docker.sock` etc.
      docker {
        connection = "unix:///var/run/docker.sock"
        verify-tls = true
      }

      database {
        # at the time of writing, Nelson only supports H2 as its database.
        driver     = "org.h2.Driver"
        connection = "jdbc:h2:file:/opt/application/db/nelson;DATABASE_TO_UPPER=FALSE;AUTO_SERVER=TRUE;"
        # username = ""
        # password = ""
      }

      ui {
        # should nelson serve a user interface, or not?
        enabled = true

        # where are the assets located on disk, that Nelson
        # will serve as its UI contents; this is for local development purposes
        # only and should not be used in production.
        # file-path = "/path/to/nelson/ui"
      }

      cleanup {
        # initial time to live for deployments
        # this is basically the grace period
        # given to all deployment
        initial-deployment-time-to-live = 30 minutes

        # extended time to live for deployments
        # the amount a deployment expiration is bumped
        extend-deployment-time-to-live = 30 minutes

        # delay between cleanup process runs, i.e. every 30 minutes
        cleanup-delay = 10 minutes

        # delay between long-term cleanup process
        sweeper-delay = 24 hours
      }

      pipeline {
        # the maximum number of pipeline workflows nelson will handle
        # at the same time. This limit is typically bound by the hardware
        # that the service runs on. A general rule of thumb would be to
        # set this value to the same number of processors that are available
        # to nelson.
        concurrency-limit = 4

        # what is the absolutely limit for the number of deployments
        # that we'll queue before we start to drop them to preserve
        # the well-being of the rest of the system.
        inbound-buffer-limit = 50
      }

      audit {
        concurrency-limit = 4
        inbound-buffer-limit = 50
      }

      # these are the settings for the consul-template linter.
      # with the exception of the templating image, it is expected
      # that these defaults will not need to be changed and should
      # suffice in most use cases.
      template {
        temp-dir = "/tmp"
        memory-mb = 8
        cpu-period = 100000
        cpu-quota = 50000
        timeout = 10 seconds
        consul-template-image = "verizon/nelson-template-linter:1.0.1"
      }

      workflow-logger {
        # Every workflow logs progress information to a namespaced file.
        # The logging is run as a separate processes, hence the bufferLimit
        # for the queue.
        inbound-buffer-limit = 50

        # The base directory where the workflow logging files are stored.
        # Ensure when deploying Nelson as a container that this location is
        # bind-mounted to a host volume, or uses a docker-volume container.
        file-path = "/var/nelson/log"
      }

      ######## datacenter configuration.
      # no defaults are assumed here, as this must be provided by the implementor.
      # this section included here for documentation purposes only.
      # datacenters {
      #   texas {
      #     domain = "your.company.com"
      #     docker-registry = "registry.service.texas.your.company.com/whatever"
      #
      #     infrastructure {
      #       scheduler {
      #         scheduler = "nomad"
      #         nomad {
      #           endpoint = "http://nomad.service.texas.your.company.com:1234/"
      #           timeout = 1 second
      #           docker {
      #             host = "registry.service.texas.your.company.com"
      #             user = "someuser"
      #             password = "dummypwd"
      #             splunk-url = "https://forwarder.your.company.com:1234"
      #             splunk-token = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
      #             # see https://www.nomadproject.io/docs/operating-a-job/accessing-logs.html#log-shipper-pattern
      #             logging-sidecar = "registry.service.texas.your.company.com/whatever/logging-sidecar:1.0.1"
      #           }
      #         }
      #       }
      #
      #       consul {
      #         endpoint  = "http://consul.service.texas.your.company.com"
      #         timeout   = 1 second
      #         acl-token = "XXXXXXXXX"
      #         username  = "XXXXXXXXX"
      #         password  = "XXXXXXXXX"
      #       }
      #
      #       vault {
      #         endpoint   = "https://vault.service.texas.your.company.com:1234"
      #         auth-token = "XXXXXXXXX"
      #       }
      #
      #       loadbalancer {
      #         aws {
      #            access-key-id = "XXXXXXXXX"
      #            secret-access-key = "XXXXXXXXX"
      #            region = "texas"
      #            launch-configuration-name = "nelson-lb-1-LaunchConfig-XXXXXXXXXXXXXXXXXX"
      #            image = "registry.service.texas.your.company.com/whatever/infra-lb:1.2.3"
      #            elb-security-group-names = [ "sg-AAAAAAAA", "sg-BBBBBBB" ]
      #            availability-zones {
      #              texas-a {
      #                private-subnet = "subnet-AAAAAAAA"
      #                public-subnet = "subnet-BBBBBBB"
      #              }
      #            }
      #         }
      #       }
      #     }
      #     policy {
      #       # Path under which credentials are stored for
      #       # resources.  Units will get read capability on each resource.
      #       # Supported variables: %env%, %resource%, %unit%
      #       resource-creds-path = "nelson/%env%/%resource%/creds/%unit%"
      #
      #       # Path to your PKI backend. Optional. If specified, unit will get
      #       # create and update capabilities on ${pki-path}/issue
      #       # Supported variables: %env%
      #       # pki-path = "pki"
      #     }
      #   }
      # }
    }
kind: ConfigMap
metadata:
  name: nelson
  namespace: nelson-system
