sam.conf

akka {
  http {
    server {
      idle-timeout = 180 s
      request-timeout = 60 s
      parsing {
        # Supresses akka http header warnings such as Illegal header: Illegal 'x-forwarded-host'
        # These warnings can sometimes come from apache and akka disagreeing on web standards
        # Takes an array that can be set with seperate env vars in the format: IGNORE_ILLEGAL_HEADERS.0, IGNORE_ILLEGAL_HEADERS.1, etc.
        ignore-illegal-header-for = ${?IGNORE_ILLEGAL_HEADERS}
      }
    }
    host-connection-pool {
      max-open-requests = 16384
      max-connections = 2000
    }
  }
}

emailDomain = ${?EMAIL_DOMAIN}

petServiceAccount {
  googleProject = ${?GOOGLE_PROJECT}
  serviceAccountUsers = [${?LEONARDO_PET_SERVICE_ACCOUNT}]
}

liquibase {
  # Changes to this value should be reflected in liquibase.properties
  changelog = "org/broadinstitute/dsde/sam/liquibase/changelog.xml"
  initWithLiquibase = ${?INIT_WITH_LIQUIBASE}
}

opencensus-scala {
  trace {
    sampling-probability = ${?OPENCENSUS_SAMPLING_PROBABILITY}
    exporters {
      stackdriver {
        enabled = ${?OPENCENSUS_STACKDRIVER_ENABLED}
        project-id = ${?GOOGLE_PROJECT}
      }
    }
  }
}

termsOfService {
  enabled = ${?TOS_ENABLED}
  isGracePeriodEnabled = ${?TOS_GRACE_PERIOD_ENABLED}
  version = ${?TOS_VERSION}
  url = ${?TOS_URL}
}

oidc {
  authorityEndpoint = ${?OIDC_AUTHORITY_ENDPOINT}
  oidcClientId = ${?OIDC_CLIENT_ID}
  oidcClientSecret = ${?OIDC_CLIENT_SECRET}
  legacyGoogleClientId = ${?LEGACY_GOOGLE_CLIENT_ID}
}

schemaLock {
  lockSchemaOnBoot = true
  recheckTimeInterval = 5
  maxTimeToWait = 60
  instanceId = ${?SCHEMA_LOCK_INSTANCE_ID}
}

googleServices {
  appName = "firecloud:sam"
  appsDomain = ${?GOOGLE_APPS_SUBDOMAIN}
  environment = ${?ENVIRONMENT}
  pathToPem = ${?SAM_PEM_PATH}
  pathToDefaultCredentialJson = ${?SAM_SA_PATH}
  serviceAccountClientId = ${?SERVICE_ACCOUNT_CLIENT_ID}
  serviceAccountClientEmail = ${?SERVICE_ACCOUNT_CLIENT_EMAIL}
  serviceAccountClientProject = ${?SERVICE_ACCOUNT_CLIENT_PROJECT_ID}
  subEmail = ${?GOOGLE_SUBDOMAIN_EMAIL}
  directoryApiAccounts = [
    ${?GOOGLE_DIRECTORY_API_EMAIL_1}
    ${?GOOGLE_DIRECTORY_API_EMAIL_2}
  ]
  projectServiceAccount = ${?GOOGLE_PROJECT_SERVICE_ACCOUNT}
  terraGoogleOrgNumber = ${?TERRA_GOOGLE_ORG_NUMBER}
  groupSync {
    pubSubProject = ${?GOOGLE_PROJECT}
    pubSubTopic = ${?GOOGLE_PUB_SUB_TOPIC}
    pubSubSubscription = ${?GOOGLE_PUB_SUB_SUBSCRIPTION}
    workerCount = 5
  }
  disableUsers {
    pubSubProject = ${?GOOGLE_PROJECT}
    pubSubTopic = "terra-cryptomining"
    pubSubSubscription = "sam-disable-users-subscription"
    workerCount = 5
  }
  googleKeyCache {
    bucketName = ${?GOOGLE_KEY_CACHE_BUCKET_NAME}
    activeKeyMaxAge = 12
    retiredKeyMaxAge = 60
    monitor {
      pubSubProject = ${?GOOGLE_PROJECT}
      # Historically, there was a single bucket per google project, so a single pub/sub topic
      #      for that bucket works. In k8s, we want multiple environments per google project, so we
      #      want multiple buckets in a project and a pub/sub topic per bucket.
      pubSubTopic = sam-google-key-cache
      pubSubSubscription = sam-google-key-cache-sub
      workerCount = 1
    }
  }
  kms {
    project = ${?GOOGLE_PROJECT}
    location = "global"
    keyRingId = ${?GOOGLE_KMS_KEY_RING_ID}
    keyId = "dockerhub-key"
    rotationPeriod = "90 days"
  }
  notifications {
    project = ${?GOOGLE_PROJECT}
    topicName = ${?GOOGLE_NOTIFICATIONS_TOPIC_NAME}
  }

  adminSdkServiceAccountPaths = [
    ${?ADMIN_SERVICE_ACCOUNT_0}
    ${?ADMIN_SERVICE_ACCOUNT_1}
    ${?ADMIN_SERVICE_ACCOUNT_2}
    ${?ADMIN_SERVICE_ACCOUNT_3}
    ${?ADMIN_SERVICE_ACCOUNT_4}
  ]
}

db {
  # sam_read used for all read-only api calls
  sam_read {
    poolName = "sam_read"
    poolInitialSize = 8
    poolMaxSize = 8
    poolConnectionTimeoutMillis = 5000
    driver = "org.postgresql.Driver"
    url = ${?POSTGRES_URL}
    user = ${?POSTGRES_USERNAME}
    password = ${?POSTGRES_PASSWORD}
  }

  # sam_write used for all write api calls, most of these use serializable transaction isolation so a low pool size is important to limit retries due to serialization failures
  # a high volume of writes (with possible contention and retries) should not crowd out read
  sam_write {
    poolName = "sam_write"
    poolInitialSize = 2
    poolMaxSize = 2
    poolConnectionTimeoutMillis = 5000
    # Changes to this value should be reflected in liquibase.properties
    driver = "org.postgresql.Driver"
    # Changes to this value should be reflected in liquibase.properties
    url = ${?POSTGRES_URL}
    user = ${?POSTGRES_USERNAME}
    password = ${?POSTGRES_PASSWORD}
  }

  # sam_background used by all background functions
  # a high volume of background process should not crowd out api reads and writes
  sam_background {
    poolName = "sam_background"
    poolInitialSize = 5
    poolMaxSize = 5
    poolConnectionTimeoutMillis = 5000
    driver = "org.postgresql.Driver"
    url = ${?POSTGRES_URL}
    user = ${?POSTGRES_USERNAME}
    password = ${?POSTGRES_PASSWORD}
  }
}

admin {
  superAdminsGroup = ${?SUPER_ADMINS_GROUP}
  allowedAdminEmailDomains =
    [ ${?GOOGLE_APPS_DOMAIN}
      ,${?GOOGLE_SERVICE_ACCOUNT_DOMAIN}
      , "developer.gserviceaccount.com"
    ]
}

azureServices {
  azureEnabled = ${?AZURE_ENABLED}
  managedAppClientId = ${?AZURE_MANAGED_APP_CLIENT_ID}
  managedAppClientSecret = ${?AZURE_MANAGED_APP_CLIENT_SECRET}
  managedAppTenantId = ${?AZURE_MANAGED_APP_TENANT_ID}
  managedAppPlans = [
    {
        name = "terra-prod"
        publisher = "thebroadinstituteinc1615909626976"
        authorizedUserKey = authorizedTerraUser
    }
    {
        name = "terra-dev"
        publisher = "thebroadinstituteinc1615909626976"
        authorizedUserKey = authorizedTerraUser
    }
    {
        name = "terra-workspace-dev-plan"
        publisher = "thebroadinstituteinc1615909626976"
        authorizedUserKey = authorizedTerraUser
    }
  ]
}