sam.conf

akka {
  http {
    server {
      idle-timeout = 180 s
      request-timeout = 60 s
    }
    host-connection-pool {
      max-open-requests = 16384
      max-connections = 2000
    }
  }
}

emailDomain = ${?EMAIL_DOMAIN}

petServiceAccount {
  googleProject = ${?GOOGLE_PROJECT}
  serviceAccountUsers = [${?LEONARDO_PET_SERVICE_ACCOUNT}]
}

liquibase {
  # Changes to this value should be reflected in liquibase.properties
  changelog = "org/broadinstitute/dsde/sam/liquibase/changelog.xml"
  initWithLiquibase = ${?INIT_WITH_LIQUIBASE}
}

termsOfService {
  isTosEnabled = ${?TOS_ENABLED}
  isGracePeriodEnabled = ${?TOS_GRACE_PERIOD_ENABLED}
  version = ${?TOS_VERSION}
  baseUrl = ${?TOS_BASE_URL}
  rollingAcceptanceWindowExpirationDatetime = ${?TOS_ROLLING_ACCEPTANCE_WINDOW_EXPIRATION_DATETIME}
  previousVersion = ${?TOS_PREVIOUS_VERSION}
  acceptanceUrl = ${?TOS_ACCEPTANCE_URL}
}

oidc {
  authorityEndpoint = ${?OIDC_AUTHORITY_ENDPOINT}
  oidcClientId = ${?OIDC_CLIENT_ID}
}

schemaLock {
  lockSchemaOnBoot = true
  recheckTimeInterval = 5
  maxTimeToWait = 60
  instanceId = ${?SCHEMA_LOCK_INSTANCE_ID}
}

googleServices {
  googleEnabled = ${?GOOGLE_ENABLED}
  appName = "firecloud:sam"
  appsDomain = ${?GOOGLE_APPS_SUBDOMAIN}
  environment = ${?ENVIRONMENT}
  pathToPem = ${?SAM_PEM_PATH}
  pathToDefaultCredentialJson = ${?SAM_SA_PATH}
  serviceAccountClientId = ${?SERVICE_ACCOUNT_CLIENT_ID}
  serviceAccountClientEmail = ${?SERVICE_ACCOUNT_CLIENT_EMAIL}
  serviceAccountClientProject = ${?SERVICE_ACCOUNT_CLIENT_PROJECT_ID}
  subEmail = ${?GOOGLE_SUBDOMAIN_EMAIL}
  directoryApiAccounts = [
    ${?GOOGLE_DIRECTORY_API_EMAIL_1}
    ${?GOOGLE_DIRECTORY_API_EMAIL_2}
  ]
  projectServiceAccount = ${?GOOGLE_PROJECT_SERVICE_ACCOUNT}
  terraGoogleOrgNumber = ${?TERRA_GOOGLE_ORG_NUMBER}
  groupSync {
    pubSubProject = ${?GOOGLE_PROJECT}
    pubSubTopic = ${?GOOGLE_PUB_SUB_TOPIC}
    pubSubSubscription = ${?GOOGLE_PUB_SUB_SUBSCRIPTION}
    workerCount = 5
    workerCount = ${?GOOGLE_GROUP_SYNC_WORKER_COUNT}
  }
  disableUsers {
    pubSubProject = ${?GOOGLE_PROJECT}
    pubSubTopic = "terra-cryptomining"
    pubSubSubscription = "sam-disable-users-subscription"
    workerCount = 5
  }
  googleKeyCache {
    bucketName = ${?GOOGLE_KEY_CACHE_BUCKET_NAME}
    activeKeyMaxAge = 12
    retiredKeyMaxAge = 60
    monitor {
      pubSubProject = ${?GOOGLE_PROJECT}
      # Historically, there was a single bucket per google project, so a single pub/sub topic
      #      for that bucket works. In k8s, we want multiple environments per google project, so we
      #      want multiple buckets in a project and a pub/sub topic per bucket.
      pubSubTopic = sam-google-key-cache
      pubSubSubscription = sam-google-key-cache-sub
      workerCount = 1
    }
  }
  kms {
    project = ${?GOOGLE_PROJECT}
    location = "global"
    keyRingId = ${?GOOGLE_KMS_KEY_RING_ID}
    keyId = "dockerhub-key"
    rotationPeriod = "90 days"
  }
  notifications {
    project = ${?GOOGLE_PROJECT}
    topicName = ${?GOOGLE_NOTIFICATIONS_TOPIC_NAME}
  }

  adminSdkServiceAccountPaths = [
    ${?ADMIN_SERVICE_ACCOUNT_0}
    ${?ADMIN_SERVICE_ACCOUNT_1}
    ${?ADMIN_SERVICE_ACCOUNT_2}
    ${?ADMIN_SERVICE_ACCOUNT_3}
    ${?ADMIN_SERVICE_ACCOUNT_4}
  ]

  traceExporter {
    enabled = ${?OPENCENSUS_STACKDRIVER_ENABLED} # for backwards compatibility
    enabled = ${?GOOGLE_TRACE_ENABLED}
    projectId = ${?GOOGLE_PROJECT}
    samplingProbability = ${?OPENCENSUS_SAMPLING_PROBABILITY} # for backwards compatibility
    samplingProbability = ${?GOOGLE_TRACE_SAMPLING_PROBABILITY}
  }
  petSigningAccountsEnabled = ${?PET_SIGNING_ACCOUNTS_ENABLED}
}

db {
  # sam_read used for all read-only api calls
  sam_read {
    poolName = "sam_read"
    poolInitialSize = 8
    poolMaxSize = 8
    poolConnectionTimeoutMillis = 5000
    driver = "org.postgresql.Driver"
    url = ${?POSTGRES_WRITE_URL}
    user = ${?POSTGRES_USERNAME}
    password = ${?POSTGRES_PASSWORD}
  }

  # sam_write used for all write api calls, most of these use serializable transaction isolation so a low pool size is important to limit retries due to serialization failures
  # a high volume of writes (with possible contention and retries) should not crowd out read
  sam_write {
    poolName = "sam_write"
    poolInitialSize = 2
    poolMaxSize = 2
    poolConnectionTimeoutMillis = 5000
    # Changes to this value should be reflected in liquibase.properties
    driver = "org.postgresql.Driver"
    # Changes to this value should be reflected in liquibase.properties
    url = ${?POSTGRES_WRITE_URL}
    user = ${?POSTGRES_USERNAME}
    password = ${?POSTGRES_PASSWORD}
  }

  # sam_background used by all background functions
  # a high volume of background process should not crowd out api reads and writes
  sam_background {
    poolName = "sam_background"
    poolInitialSize = 5
    poolMaxSize = 5
    poolConnectionTimeoutMillis = 5000
    driver = "org.postgresql.Driver"
    url = ${?POSTGRES_WRITE_URL}
    user = ${?POSTGRES_USERNAME}
    password = ${?POSTGRES_PASSWORD}
  }

  sam_read_replica {
    poolName = "sam_read_replica"
    poolInitialSize = 8
    poolMaxSize = 8
    poolConnectionTimeoutMillis = 5000
    driver = "org.postgresql.Driver"
    url = ${?POSTGRES_READ_URL}
    user = ${?POSTGRES_USERNAME}
    password = ${?POSTGRES_PASSWORD}
  }
}

admin {
  superAdminsGroup = ${?SUPER_ADMINS_GROUP}
  allowedAdminEmailDomains =
    [ ${?GOOGLE_APPS_DOMAIN}
      ,${?GOOGLE_SERVICE_ACCOUNT_DOMAIN}
      , "developer.gserviceaccount.com"
    ]
  serviceAccountAdmins = ${?SERVICE_ACCOUNT_ADMINS}
}

azureServices {
  azureEnabled = ${?AZURE_ENABLED}
  allowManagedIdentityUserCreation = ${?AZURE_ALLOW_MANAGED_IDENTITY_USER_CREATION}
  managedAppServicePrincipal {
    clientId = ${?AZURE_MANAGED_APP_CLIENT_ID}
    clientSecret = ${?AZURE_MANAGED_APP_CLIENT_SECRET}
    tenantId = ${?AZURE_MANAGED_APP_TENANT_ID}
  }
  managedAppWorkloadClientId = ${?AZURE_MANAGED_APP_WORKLOAD_CLIENT_ID}

  azureServiceCatalog {
    enabled = ${?AZURE_SERVICE_CATALOG_ENABLED} # defaults to false
    authorizedUserKey = "authorizedTerraUser";
    managedAppTypeServiceCatalog = "ServiceCatalog";
  }

  azureMarketPlace {
    enabled = ${?AZURE_MARKET_PLACE_ENABLED} # defaults to true
    managedAppPlans = [
      {
        name = "terra-prod"
        publisher = "thebroadinstituteinc1615909626976"
        authorizedUserKey = authorizedTerraUser
      }
      {
        name = "terra-dev"
        publisher = "thebroadinstituteinc1615909626976"
        authorizedUserKey = authorizedTerraUser
      }
      {
        name = "terra-workspace-dev-plan"
        publisher = "thebroadinstituteinc1615909626976"
        authorizedUserKey = authorizedTerraUser
      }
      {
        name = "terra-aster-prod"
        publisher = "thebroadinstituteinc1615909626976"
        authorizedUserKey = "authorizedTerraUser"
      }
      {
        name = "tdr-dev"
        publisher = "thebroadinstituteinc1615909626976"
        authorizedUserKey = "authorizedTDRUser"
      }
      {
        name = "tdr-prod"
        publisher = "thebroadinstituteinc1615909626976"
        authorizedUserKey = "authorizedTDRUser"
      }
    ]
  }
}


janitor {
  enabled = ${?JANITOR_ENABLED}
  clientCredentialFilePath = ${?JANITOR_CLIENT_CREDENTIAL_FILE_PATH}
  trackResourceProjectId = ${?JANITOR_TRACK_RESOURCE_PROJECT_ID}
  trackResourceTopicId = ${?JANITOR_TRACK_RESOURCE_TOPIC_ID}
}

terra.support.emails = [
  // dynamically configuring lists is hard, so 10 slots are provided for support emails
  // add more if more than 10 are ever needed
  ${?TERRA_SUPPORT_EMAIL_0}
  ${?TERRA_SUPPORT_EMAIL_1}
  ${?TERRA_SUPPORT_EMAIL_2}
  ${?TERRA_SUPPORT_EMAIL_3}
  ${?TERRA_SUPPORT_EMAIL_4}
  ${?TERRA_SUPPORT_EMAIL_5}
  ${?TERRA_SUPPORT_EMAIL_6}
  ${?TERRA_SUPPORT_EMAIL_7}
  ${?TERRA_SUPPORT_EMAIL_8}
  ${?TERRA_SUPPORT_EMAIL_9}
]

resourceAccessPolicies {
  resource_type_admin {
    workspace {
      support {
        memberEmails = ${terra.support.emails}
        roles = ["support"]
      }
      rawls {
        memberEmails = [
          ${?RAWLS_SERVICE_ACCOUNT}
        ]
        descendantPermissions = [
          {
            resourceTypeName = "workspace",
            roles = [
              "rawls"
              # WSM requires one of the roles in its hierarchy, discoverer is the lowest but reader is the lowest that leo understands
              "reader"
            ]
          }
        ]
      }
    }
    managed-group {
      support {
        memberEmails = ${terra.support.emails}
        roles = ["support"]
      }
    }
    billing-project {
      support {
        memberEmails = ${terra.support.emails}
        roles = ["support"]
      }
      rawls {
        memberEmails = [
          ${?RAWLS_SERVICE_ACCOUNT}
        ]
        descendantPermissions = [
          {
            resourceTypeName = "billing-project",
            roles = ["rawls"]
          }
        ]
      }
    }
    dataset {
      support {
        memberEmails = ${terra.support.emails}
        roles = ["support"]
      }
    }
    datasnapshot {
      support {
        memberEmails = ${terra.support.emails}
        roles = ["support"]
      }
    }
    spend-profile {
      system {
        memberEmails = [
          ${?LEONARDO_PET_SERVICE_ACCOUNT}
          ${?WSM_PET_SERVICE_ACCOUNT}
        ]
        descendantPermissions = [
          {
            resourceTypeName = "spend-profile",
            roles = ["system"]
          }
        ]
      }
      rawls {
        memberEmails = [
          ${?RAWLS_SERVICE_ACCOUNT}
        ]
        descendantPermissions = [
          {
            resourceTypeName = "spend-profile",
            roles = ["rawls"]
          }
        ]
      }
    }
    landing-zone {
      rawls {
        memberEmails = [
          ${?RAWLS_SERVICE_ACCOUNT}
        ]
        descendantPermissions = [
          {
            resourceTypeName = "landing-zone",
            roles = ["rawls"]
          }
        ]
      }
    }
    controlled-application-shared-workspace-resource {
      rawls {
        memberEmails = [
          ${?RAWLS_SERVICE_ACCOUNT}
        ]
        descendantPermissions = [
          {
            resourceTypeName = "controlled-application-shared-workspace-resource",
            roles = ["rawls"]
          }
        ]
      }
    }
    controlled-user-shared-workspace-resource {
      rawls {
        memberEmails = [
          ${?RAWLS_SERVICE_ACCOUNT}
        ]
        descendantPermissions = [
          {
            resourceTypeName = "controlled-user-shared-workspace-resource",
            roles = ["rawls"]
          }
        ]
      }
    }
    kubernetes-app {
      rawls {
        memberEmails = [
          ${?RAWLS_SERVICE_ACCOUNT}
        ]
        descendantPermissions = [
          {
            resourceTypeName = "kubernetes-app",
            roles = [
              # leo checks for creator or manager role, rawls really only needs delete and status actions
              "manager"
            ]
          }
        ]
      }
    }
    kubernetes-app-shared {
      rawls {
        memberEmails = [
          ${?RAWLS_SERVICE_ACCOUNT}
        ]
        descendantPermissions = [
          {
            resourceTypeName = "kubernetes-app-shared",
            roles = [
              # leo checks for user or owner role, rawls really only needs delete and status actions
              "owner"
            ]
          }
        ]
      }
    }
  }
}