helm-values.yaml

# Helm values.yaml for Openlane
# This file is auto-generated from the core config structure
# Manual changes may be overwritten when regenerated
#
# Domain Inheritance:
# Set 'domain' to enable automatic domain inheritance for fields tagged with domain:"inherit"
# Fields with domainPrefix will be prefixed (e.g., "https://api" becomes "https://api.yourdomain.com")
# Fields with domainSuffix will be suffixed (e.g., "/.well-known/jwks.json" becomes "yourdomain.com/.well-known/jwks.json")
# Individual fields can still be overridden by setting them explicitly

coreConfiguration:
  # -- Domain provides a global domain value for other modules to inherit
  domain: ""  # @schema type:string
  # -- RefreshInterval determines how often to reload the config
  refreshinterval: "10m0s"  # @schema type:integer; default:10m
  # -- Server contains the echo server settings
  server:
    # -- Dev enables echo's dev mode options
    dev: false  # @schema type:boolean; default:false
    # -- Listen sets the listen address to serve the echo server on
    listen: ":17608"  # @schema type:string; default::17608
    # -- MetricsPort sets the port for the metrics endpoint
    metricsport: ":17609"  # @schema type:string; default::17609
    # -- ShutdownGracePeriod sets the grace period for in flight requests before shutting down
    shutdowngraceperiod: "10s"  # @schema type:integer; default:10s
    # -- ReadTimeout sets the maximum duration for reading the entire request including the body
    readtimeout: "15s"  # @schema type:integer; default:15s
    # -- WriteTimeout sets the maximum duration before timing out writes of the response
    writetimeout: "15s"  # @schema type:integer; default:15s
    # -- IdleTimeout sets the maximum amount of time to wait for the next request when keep-alives are enabled
    idletimeout: "30s"  # @schema type:integer; default:30s
    # -- ReadHeaderTimeout sets the amount of time allowed to read request headers
    readheadertimeout: "2s"  # @schema type:integer; default:2s
    # -- TLS contains the tls configuration settings
    tls:
      # -- Enabled turns on TLS settings for the server
      enabled: false  # @schema type:boolean; default:false
      # -- CertFile location for the TLS server
      certfile: "server.crt"  # @schema type:string; default:server.crt
      # -- CertKey file location for the TLS server
      certkey: "server.key"  # @schema type:string; default:server.key
      # -- AutoCert generates the cert with letsencrypt, this does not work on localhost
      autocert: false  # @schema type:boolean; default:false
    # -- CORS contains settings to allow cross origin settings and insecure cookies
    cors:
      # -- Enable or disable the CORS middleware
      enabled: true  # @schema type:boolean; default:true
      # -- Prefixes is a map of prefixes to allowed origins
      prefixes: {}
      # -- AllowOrigins is a list of allowed origins
      alloworigins: []
      # -- CookieInsecure sets the cookie to be insecure
      cookieinsecure: false  # @schema type:boolean
    # -- Secure contains settings for the secure middleware
    secure:
      # -- Enabled indicates if the secure middleware should be enabled
      enabled: true  # @schema type:boolean; default:true
      # -- XSSProtection is the value to set the X-XSS-Protection header to - default is 1; mode=block
      xssprotection: "1; mode=block"  # @schema type:string; default:1; mode=block
      # -- ContentTypeNosniff is the value to set the X-Content-Type-Options header to - default is nosniff
      contenttypenosniff: "nosniff"  # @schema type:string; default:nosniff
      # -- XFrameOptions is the value to set the X-Frame-Options header to - default is SAMEORIGIN
      xframeoptions: "SAMEORIGIN"  # @schema type:string; default:SAMEORIGIN
      # -- HSTSPreloadEnabled is a boolean to enable HSTS preloading - default is false
      hstspreloadenabled: false  # @schema type:boolean; default:false
      # -- HSTSMaxAge is the max age to set the HSTS header to - default is 31536000
      hstsmaxage: 31536000  # @schema type:integer; default:31536000
      # -- ContentSecurityPolicy is the value to set the Content-Security-Policy header to - default is default-src 'self'
      contentsecuritypolicy: "default-src 'self'"  # @schema type:string; default:default-src 'self'
      # -- ReferrerPolicy is the value to set the Referrer-Policy header to - default is same-origin
      referrerpolicy: "same-origin"  # @schema type:string; default:same-origin
      # -- CSPReportOnly is a boolean to enable the Content-Security-Policy-Report-Only header - default is false
      cspreportonly: false  # @schema type:boolean; default:false
    # -- CacheControl contains settings for the cache control middleware
    cachecontrol:
      enabled: true  # @schema type:boolean; default:true
      # -- noCacheHeaders is the header <-> match map pair to match in http for entity headers to remove
      nocacheheaders: {}
      # -- etagHeaders is the string of entity headers to remove
      etagheaders: []
    # -- Mime contains settings for the mime middleware
    mime:
      # -- Enabled indicates if the mime middleware should be enabled
      enabled: true  # @schema type:boolean; default:true
      # -- MimeTypesFile is the file to load mime types from
      mimetypesfile: ""  # @schema type:string
      # -- DefaultContentType is the default content type to set if no mime type is found
      defaultcontenttype: "application/data"  # @schema type:string; default:application/data
    # -- GraphPool contains settings for the goroutine pool used by the graph resolvers
    graphpool:
      # -- MaxWorkers is the maximum number of workers in the pool
      maxworkers: 100  # @schema type:integer; default:100
    # -- EnableGraphExtensions enables the graph extensions for the graph resolvers
    enablegraphextensions: true  # @schema type:boolean; default:true
    # -- EnableGraphSubscriptions enables graphql subscriptions to the server using websockets or sse
    enablegraphsubscriptions: false  # @schema type:boolean; default:false
    # -- ComplexityLimit sets the maximum complexity allowed for a query
    complexitylimit: 100  # @schema type:integer; default:100
    # -- MaxResultLimit sets the maximum number of results allowed for a query
    maxresultlimit: 100  # @schema type:integer; default:100
    # -- CSRFProtection enables CSRF protection for the server
    csrfprotection:
      # -- Enabled indicates whether CSRF protection is enabled.
      enabled: false  # @schema type:boolean; default:false
      # -- Header specifies the header name to look for the CSRF token.
      header: "X-CSRF-Token"  # @schema type:string; default:X-CSRF-Token
      # -- Cookie specifies the cookie name used to store the CSRF token.
      cookie: "ol.csrf-token"  # @schema type:string; default:ol.csrf-token
      # -- Secure sets the Secure flag on the CSRF cookie.
      secure: true  # @schema type:boolean; default:true
      # -- SameSite configures the SameSite attribute on the CSRF cookie. Valid
      # values are "Lax", "Strict", "None" and "Default".
      samesite: "Lax"  # @schema type:string; default:Lax
      # -- CookieHTTPOnly indicates whether the CSRF cookie is HTTP only.
      cookiehttponly: false  # @schema type:boolean; default:false
      # -- CookieDomain specifies the domain for the CSRF cookie, default to no domain
      cookiedomain: ""  # @schema type:string
      # -- CookiePath specifies the path for the CSRF cookie, default to "/"
      cookiepath: "/"  # @schema type:string; default:/
    # -- DefaultTrustCenterDomain is the default domain to use for the trust center if no custom domain is set
    defaulttrustcenterdomain: "trust.theopenlane.net"  # @schema type:string; default:trust.theopenlane.net
    # -- TrustCenterCnameTarget is the cname target for the trust center
    # Used for mapping the vanity domains to the trust centers
    trustcentercnametarget: ""  # @schema type:string
    # -- TrustCenterPreviewZoneID is the cloudflare zone id for the trust center preview domain
    trustcenterpreviewzoneid: ""  # @schema type:string
    # -- NotificationLookbackDays is the number of days of read notifications to pull when starting a notification subscription
    # Unread notifications are always pulled regardless of this setting
    notificationlookbackdays: 30  # @schema type:integer; default:30
  # -- EntConfig contains the ent configuration used by the ent middleware
  entconfig:
    # -- EntityTypes is the list of entity types to create by default for the organization
    entitytypes: []
    # -- Summarizer contains configuration for text summarization
    summarizer:
      # -- Type specifies the summarization algorithm to use
      type: lexrank  # @schema type:string; default:lexrank
      # -- LLM contains configuration for large language model based summarization
      llm:
        # -- Provider specifies which LLM service to use
        provider: none  # @schema type:string; default:none
        # -- Anthropic contains configuration for Anthropic's API
        anthropic:
          # -- BetaHeader specifies the beta API features to enable
          betaheader: ""  # @schema type:string
          # -- LegacyTextCompletion enables legacy text completion API
          legacytextcompletion: false  # @schema type:boolean
          # -- BaseURL specifies the API endpoint
          baseurl: ""  # @schema type:string
        # -- Cloudflare contains configuration for Cloudflare's API
        cloudflare:
          # -- AccountID specifies the Cloudflare account ID
          accountid: ""  # @schema type:string
          # -- ServerURL specifies the API endpoint
          serverurl: ""  # @schema type:string
        # -- OpenAI contains configuration for OpenAI's API
        openai:
          # -- URL specifies the API endpoint
          url: ""  # @schema type:string
          # -- OrganizationID specifies the OpenAI organization ID
          organizationid: ""  # @schema type:string
      # -- MaximumSentences specifies the maximum number of sentences in the summary
      maximumsentences: 10  # @schema type:integer; default:10
    # -- MaxPoolSize is the max worker pool size that can be used by the ent client
    maxpoolsize: 200  # @schema type:integer; default:200
    # -- Modules contains the configuration for the module system
    modules:
      # -- Enabled indicates whether to check and verify module access
      enabled: true  # @schema type:boolean; default:true
      # -- UseSandbox indicates whether to use the sandbox catalog for module access checks
      usesandbox: false  # @schema type:boolean; default:false
      # -- DevMode enables all modules for local development regardless of trial status
      devmode: false  # @schema type:boolean; default:false
    # -- MaxSchemaImportSize is the maximum size allowed for schema imports in bytes
    maxschemaimportsize: 262144  # @schema type:integer; default:262144
    # -- EmailValidation contains configuration for email validation
    emailvalidation:
      # -- Enabled indicates whether email verification is enabled
      enabled: false  # @schema type:boolean; default:false
      # -- EnableAutoUpdateDisposable indicates whether to automatically update disposable email addresses
      enableautoupdatedisposable: true  # @schema type:boolean; default:true
      # -- EnableGravatarCheck indicates whether to check for Gravatar existence
      enablegravatarcheck: true  # @schema type:boolean; default:true
      # -- EnableSMTPCheck indicates whether to check email by smtp
      enablesmtpcheck: false  # @schema type:boolean; default:false
      # -- AllowedEmailTypes defines the allowed email types for verification
      allowedemailtypes:
        # -- Disposable indicates whether disposable email addresses are allowed
        disposable: false  # @schema type:boolean; default:false
        # -- Free indicates whether free email addresses are allowed
        free: false  # @schema type:boolean; default:false
        # -- Role indicates whether role-based email addresses are allowed
        role: false  # @schema type:boolean; default:false
    # -- Billing contains configuration for billing related features
    billing:
      # -- RequirePaymentMethod indicates whether to check if a payment method
      # exists for orgs before they can access some resource
      requirepaymentmethod: false  # @schema type:boolean
      # -- BypassEmailDomains is a list of domains that should be allowed to bypass
      # the checks if RequirePaymentMethod above is enabled
      bypassemaildomains: []
    # -- Notifications contains configuration for notifications sent to users based on events
    notifications:
      # -- ConsoleURL for ui links used in notifications
      consoleurl: "http://localhost:3001"  # @schema type:string; default:http://localhost:3001
    # -- QuestionnaireProductURL is the product URL used to build questionnaire access links
    questionnaireproducturl: "https://console.theopenlane.io"  # @schema type:string; default:https://console.theopenlane.io
  # -- Auth contains the authentication token settings and provider(s)
  auth:
    # -- Enabled authentication on the server, not recommended to disable
    enabled: true  # @schema type:boolean; default:true
    # -- Token contains the token config settings for the issued tokens
    token:
      kid: ""  # @schema type:string
      audience: ""  # @schema type:string
      refreshaudience: ""  # @schema type:string
      issuer: ""  # @schema type:string
      accessduration: "1h0m0s"  # @schema type:integer; default:1h
      refreshduration: "2h0m0s"  # @schema type:integer; default:2h
      refreshoverlap: "-15m0s"  # @schema type:integer; default:-15m
      jwksendpoint: ""  # @schema type:string
      keys: {}
      generatekeys: true  # @schema type:boolean; default:true
      jwkscachettl: "5m0s"  # @schema type:integer; default:5m
      redis:
        enabled: false  # @schema type:boolean; default:false
        config:
          enabled: true  # @schema type:boolean; default:true
          address: "localhost:6379"  # @schema type:string; default:localhost:6379
          name: ""  # @schema type:string
          username: ""  # @schema type:string
          password: ""  # @schema type:string
          db: 0  # @schema type:integer; default:0
          dialtimeout: "5s"  # @schema type:integer; default:5s
          readtimeout: "0s"  # @schema type:integer; default:0
          writetimeout: "0s"  # @schema type:integer; default:0
          maxretries: 3  # @schema type:integer; default:3
          minidleconns: 0  # @schema type:integer; default:0
          maxidleconns: 0  # @schema type:integer; default:0
          maxactiveconns: 0  # @schema type:integer; default:0
        blacklistprefix: "token:blacklist:"  # @schema type:string; default:token:blacklist:
      apitokens:
        enabled: false  # @schema type:boolean; default:false
        envprefix: "IAM_API_TOKEN_KEY_"  # @schema type:string; default:IAM_API_TOKEN_KEY_
        keys: {}
        secretsize: 32  # @schema type:integer; default:32
        delimiter: "."  # @schema type:string; default:.
        prefix: ""  # @schema type:string
      assessmentaccessduration: "1h0m0s"  # @schema type:integer; default:1h
      trustcenterndarequestaccessduration: "1h0m0s"  # @schema type:integer; default:1h
    # -- SupportedProviders are the supported oauth providers that have been configured
    supportedproviders: []
    # -- Providers contains supported oauth2 providers configuration
    providers:
      # -- RedirectURL is the URL that the OAuth2 client will redirect to after authentication is complete
      redirecturl: "http://localhost:3001/login/sso"  # @schema type:string; default:http://localhost:3001/login/sso
      # -- Github contains the configuration settings for the Github Oauth Provider
      github:
        clientid: ""  # @schema type:string
        clientendpoint: ""  # @schema type:string
        scopes: []
        redirecturl: "/v1/github/callback"  # @schema type:string; default:/v1/github/callback
      # -- Google contains the configuration settings for the Google Oauth Provider
      google:
        clientid: ""  # @schema type:string
        clientendpoint: ""  # @schema type:string
        scopes: []
        redirecturl: "/v1/google/callback"  # @schema type:string; default:/v1/google/callback
      # -- Webauthn contains the configuration settings for the Webauthn Oauth Provider
      webauthn:
        enabled: true  # @schema type:boolean; default:true
        displayname: ""  # @schema type:string
        relyingpartyid: ""  # @schema type:string
        requestorigins: []
        maxdevices: 10  # @schema type:integer; default:10
        enforcetimeout: true  # @schema type:boolean; default:true
        timeout: "1m0s"  # @schema type:integer; default:60s
        debug: false  # @schema type:boolean; default:false
  # -- Authz contains the authorization settings for fine grained access control
  authz:
    # -- enables authorization checks with openFGA
    enabled: true  # @schema type:boolean; default:true
    # -- name of openFGA store
    storename: "openlane"  # @schema type:string; default:openlane
    # -- host url with scheme of the openFGA API
    hosturl: "https://authz.theopenlane.io"  # @schema type:string; default:https://authz.theopenlane.io
    # -- id of openFGA store
    storeid: ""  # @schema type:string
    # -- id of openFGA model
    modelid: ""  # @schema type:string
    # -- force create a new model
    createnewmodel: false  # @schema type:boolean; default:false
    # -- path to the fga model file
    modelfile: ""  # @schema type:string
    # -- path to the fga module file
    modulefile: "fga/model/fga.mod"  # @schema type:string; default:fga/model/fga.mod
    # -- credentials for the openFGA client
    credentials:
      # -- client id for the openFGA client
      clientid: ""  # @schema type:string
      # -- audience for the openFGA client
      audience: ""  # @schema type:string
      # -- issuer for the openFGA client
      issuer: ""  # @schema type:string
      # -- scopes for the openFGA client
      scopes: ""  # @schema type:string
    # -- maximum number of writes per batch in a transaction
    maxbatchwritesize: 100  # @schema type:integer; default:100
    # -- disables the automatic addition of parent context tuples
    enableparentcontext: false  # @schema type:boolean
    # -- entity kind names that should not have parent context tuples added
    parentcontextskipkinds: []
    # -- relationship conditions to apply on parent context tuples per entity kind
    parentcontextconditions: []
  # -- DB contains the database configuration for the ent client
  db:
    # -- debug enables printing the debug database logs
    debug: false  # @schema type:boolean; default:false
    # -- the name of the database to use with otel tracing
    databasename: "openlane"  # @schema type:string; default:openlane
    # -- sql driver name
    drivername: "pgx"  # @schema type:string; default:pgx
    # -- enables writing to two databases simultaneously
    multiwrite: false  # @schema type:boolean; default:false
    # -- cache results for subsequent requests
    cachettl: "1s"  # @schema type:integer; default:1s
    # -- run migrations on startup
    runmigrations: true  # @schema type:boolean; default:true
    # -- migration provider to use for running migrations
    migrationprovider: "atlas"  # @schema type:string; default:atlas
    # -- enable history data to be logged to the database
    enablehistory: false  # @schema type:boolean; default:false
    # -- maximum number of connections to the database
    maxconnections: 0  # @schema type:integer; default:0
    # -- maximum number of idle connections to the database
    maxidleconnections: 0  # @schema type:integer; default:0
  # -- JobQueue contains the configuration for the job queue (river) client
  jobqueue:
    runmigrations: false  # @schema type:boolean; default:false
    riverconf:
    metrics:
      enablemetrics: false  # @schema type:boolean; default:false
      metricsdurationunit: "ms"  # @schema type:string; default:ms
      enablesemanticmetrics: true  # @schema type:boolean; default:true
  # -- Redis contains the redis configuration for the key-value store
  redis:
    enabled: true  # @schema type:boolean; default:true
    address: "localhost:6379"  # @schema type:string; default:localhost:6379
    name: ""  # @schema type:string
    username: ""  # @schema type:string
    password: ""  # @schema type:string
    db: 0  # @schema type:integer; default:0
    dialtimeout: "5s"  # @schema type:integer; default:5s
    readtimeout: "0s"  # @schema type:integer; default:0
    writetimeout: "0s"  # @schema type:integer; default:0
    maxretries: 3  # @schema type:integer; default:3
    minidleconns: 0  # @schema type:integer; default:0
    maxidleconns: 0  # @schema type:integer; default:0
    maxactiveconns: 0  # @schema type:integer; default:0
  # -- Sessions config for user sessions and cookies
  sessions:
    domain: ""  # @schema type:string
    maxage: 3600  # @schema type:integer; default:3600
    secure: true  # @schema type:boolean; default:true
    httponly: true  # @schema type:boolean; default:true
    samesite: "Strict"  # @schema type:string; default:Strict
  # -- TOTP contains the configuration for the TOTP provider
  totp:
    enabled: true  # @schema type:boolean; default:true
    codelength: 6  # @schema type:integer; default:6
    issuer: ""  # @schema type:string
    redis: true  # @schema type:boolean; default:true
    recoverycodecount: 16  # @schema type:integer; default:16
    recoverycodelength: 8  # @schema type:integer; default:8
  # -- Ratelimit contains the configuration for the rate limiter
  ratelimit:
    enabled: false  # @schema type:boolean; default:false
    # -- Options enables configuring multiple concurrent rate windows that must all pass.
    options:
      - expiration: 0s
        flushinterval: 0s
        requests: 500
        window: 1m0s
    # -- Headers determines which headers are inspected to determine the origin IP.
    # Defaults to X-Forwarded-For, True-Client-IP, RemoteAddr.
    headers:
        - True-Client-IP
    # -- ForwardedIndexFromBehind selects which IP from X-Forwarded-For should be used.
    # 0 means the closest client, 1 the proxy behind it, etc.
    forwardedindexfrombehind: 0  # @schema type:integer; default:0
    # -- IncludePath appends the request path to the limiter key when true.
    includepath: false  # @schema type:boolean; default:false
    # -- IncludeMethod appends the request method to the limiter key when true.
    includemethod: false  # @schema type:boolean; default:false
    # -- KeyPrefix allows scoping the limiter key space with a static prefix.
    keyprefix: ""  # @schema type:string
    # -- DenyStatus overrides the HTTP status code returned when a rate limit is exceeded.
    denystatus: 429  # @schema type:integer; default:429
    # -- DenyMessage customises the error payload when a rate limit is exceeded.
    denymessage: "Too many requests"  # @schema type:string; default:Too many requests
    # -- SendRetryAfterHeader toggles whether the Retry-After header should be added when available.
    sendretryafterheader: true  # @schema type:boolean; default:true
    # -- DryRun enables logging rate limit decisions without blocking requests.
    dryrun: true  # @schema type:boolean; default:true
  # -- ObjectStorage contains the configuration for the object storage backend
  objectstorage:
    # -- Enabled indicates if object storage is enabled
    enabled: true  # @schema type:boolean; default:true
    # -- Keys are the form field keys that will be processed for uploads
    keys:
        - uploadFile
    # -- MaxSizeMB is the maximum file size allowed in MB
    maxsizemb: 0  # @schema type:integer
    # -- MaxMemoryMB is the maximum memory to use for file uploads in MB
    maxmemorymb: 0  # @schema type:integer
    # -- DevMode automatically configures a local disk storage provider (and ensures directories exist) and ignores other provider configs
    devmode: false  # @schema type:boolean; default:false
    # -- Providers contains configuration for each storage provider
    providers:
      # -- S3 provider configuration
      s3:
        # -- Enabled indicates if this provider is enabled
        enabled: false  # @schema type:boolean; default:false
        # -- EnsureAvailable enforces provider availability before completing server startup
        ensureavailable: false  # @schema type:boolean; default:false
        # -- Region for cloud providers
        region: ""  # @schema type:string
        # -- Bucket name for cloud providers
        bucket: ""  # @schema type:string
        # -- Endpoint for custom endpoints
        endpoint: ""  # @schema type:string
        # -- ProxyPresignEnabled toggles proxy-signed download URL generation
        proxypresignenabled: false  # @schema type:boolean; default:false
        # -- BaseURL is the prefix for proxy download URLs (e.g., http://localhost:17608/v1/files).
        baseurl: "http://localhost:17608/v1/files"  # @schema type:string; default:http://localhost:17608/v1/files
        # -- Credentials contains the credentials for accessing the provider
        credentials:
      # -- R2 provider configuration
      r2:
        # -- Enabled indicates if this provider is enabled
        enabled: false  # @schema type:boolean; default:false
        # -- EnsureAvailable enforces provider availability before completing server startup
        ensureavailable: false  # @schema type:boolean; default:false
        # -- Region for cloud providers
        region: ""  # @schema type:string
        # -- Bucket name for cloud providers
        bucket: ""  # @schema type:string
        # -- Endpoint for custom endpoints
        endpoint: ""  # @schema type:string
        # -- ProxyPresignEnabled toggles proxy-signed download URL generation
        proxypresignenabled: false  # @schema type:boolean; default:false
        # -- BaseURL is the prefix for proxy download URLs (e.g., http://localhost:17608/v1/files).
        baseurl: "http://localhost:17608/v1/files"  # @schema type:string; default:http://localhost:17608/v1/files
        # -- Credentials contains the credentials for accessing the provider
        credentials:
      # -- Disk provider configuration
      disk:
        # -- Enabled indicates if this provider is enabled
        enabled: false  # @schema type:boolean; default:false
        # -- EnsureAvailable enforces provider availability before completing server startup
        ensureavailable: false  # @schema type:boolean; default:false
        # -- Region for cloud providers
        region: ""  # @schema type:string
        # -- Bucket name for cloud providers
        bucket: ""  # @schema type:string
        # -- Endpoint for custom endpoints
        endpoint: ""  # @schema type:string
        # -- ProxyPresignEnabled toggles proxy-signed download URL generation
        proxypresignenabled: false  # @schema type:boolean; default:false
        # -- BaseURL is the prefix for proxy download URLs (e.g., http://localhost:17608/v1/files).
        baseurl: "http://localhost:17608/v1/files"  # @schema type:string; default:http://localhost:17608/v1/files
        # -- Credentials contains the credentials for accessing the provider
        credentials:
      # -- Database provider configuration
      database:
        # -- Enabled indicates if this provider is enabled
        enabled: false  # @schema type:boolean; default:false
        # -- EnsureAvailable enforces provider availability before completing server startup
        ensureavailable: false  # @schema type:boolean; default:false
        # -- Region for cloud providers
        region: ""  # @schema type:string
        # -- Bucket name for cloud providers
        bucket: ""  # @schema type:string
        # -- Endpoint for custom endpoints
        endpoint: ""  # @schema type:string
        # -- ProxyPresignEnabled toggles proxy-signed download URL generation
        proxypresignenabled: false  # @schema type:boolean; default:false
        # -- BaseURL is the prefix for proxy download URLs (e.g., http://localhost:17608/v1/files).
        baseurl: "http://localhost:17608/v1/files"  # @schema type:string; default:http://localhost:17608/v1/files
        # -- Credentials contains the credentials for accessing the provider
        credentials:
  # -- Entitlements contains the configuration for the entitlements service
  subscription:
    # -- Enabled determines if the entitlements service is enabled
    enabled: false  # @schema type:boolean; default:false
    # -- StripeWebhookURL is the URL for the stripe webhook
    stripewebhookurl: "https://api.theopenlane.io/stripe/webhook"  # @schema type:string; default:https://api.theopenlane.io/stripe/webhook
    # -- StripeBillingPortalSuccessURL
    stripebillingportalsuccessurl: "https://console.theopenlane.io/organization-settings/billing"  # @schema type:string; default:https://console.theopenlane.io/organization-settings/billing
    # -- StripeCancellationReturnURL is the URL for the stripe cancellation return
    stripecancellationreturnurl: "https://console.theopenlane.io/organization-settings/billing"  # @schema type:string; default:https://console.theopenlane.io/organization-settings/billing
    # -- StripeWebhookEvents is the list of events to register when creating a webhook endpoint
    stripewebhookevents: []
    # -- StripeWebhookAPIVersion is the Stripe API version currently accepted by the webhook handler
    stripewebhookapiversion: "2026_02_25_CLOVER"  # @schema type:string; default:2026_02_25_CLOVER
    # -- StripeWebhookDiscardAPIVersion is the Stripe API version to discard during migration
    stripewebhookdiscardapiversion: "2025_12_15_CLOVER"  # @schema type:string; default:2025_12_15_CLOVER
  # -- Keywatcher contains the configuration for the key watcher that manages JWT signing keys
  keywatcher:
    # -- Enabled indicates whether the key watcher is enabled
    enabled: false  # @schema type:boolean; default:false
    # -- KeyDir is the path to the directory containing PEM keys for JWT signing
    keydir: "./keys"  # @schema type:string; default:./keys
  # -- Integrations contains operator-level credentials for all v2 integration definitions
  integrations:
    awssecurityhub:
      arn: ""  # @schema type:string
    githubapp:
      appslug: ""  # @schema type:string
    slack:
      clientid: ""  # @schema type:string
      redirecturl: "https://api.theopenlane.io/v1/integrations/auth/callback"  # @schema type:string; default:https://api.theopenlane.io/v1/integrations/auth/callback
      appid: ""  # @schema type:string
    slackruntime:
      # -- Slack incoming webhook URL for fire-and-forget system notifications
      webhookURL: ""  # @schema type:string
      # -- Bot User OAuth Token for full Web API access to the platform workspace
      botToken: ""  # @schema type:string
      # -- Default channel id for system messages when no explicit channel is provided
      defaultChannel: ""  # @schema type:string
    googledrive:
      clientid: ""  # @schema type:string
      redirecturl: "https://api.theopenlane.io/v1/integrations/auth/callback"  # @schema type:string; default:https://api.theopenlane.io/v1/integrations/auth/callback
    googleworkspace:
      clientid: ""  # @schema type:string
      redirecturl: "https://api.theopenlane.io/v1/integrations/auth/callback"  # @schema type:string; default:https://api.theopenlane.io/v1/integrations/auth/callback
    azureentraid:
      clientid: ""  # @schema type:string
      redirecturl: "https://api.theopenlane.io/v1/integrations/auth/callback"  # @schema type:string; default:https://api.theopenlane.io/v1/integrations/auth/callback
      defaulttenant: ""  # @schema type:string
      applicationid: ""  # @schema type:string
    microsoftteams:
      clientid: ""  # @schema type:string
      redirecturl: "https://api.theopenlane.io/v1/integrations/auth/callback"  # @schema type:string; default:https://api.theopenlane.io/v1/integrations/auth/callback
      applicationid: ""  # @schema type:string
    onedrive:
      clientid: ""  # @schema type:string
      redirecturl: "https://api.theopenlane.io/v1/integrations/auth/callback"  # @schema type:string; default:https://api.theopenlane.io/v1/integrations/auth/callback
      contentmode: "iframe"  # @schema type:string; default:iframe
      applicationid: ""  # @schema type:string
    oidclocal:
      enabled: false  # @schema type:boolean; default:false
      clientid: "local-core-oidc"  # @schema type:string; default:local-core-oidc
      discoveryurl: "http://localhost:5557/dex"  # @schema type:string; default:http://localhost:5557/dex
      redirecturl: "http://localhost:17608/v1/integrations/auth/callback"  # @schema type:string; default:http://localhost:17608/v1/integrations/auth/callback
    email:
      # -- Directory for dev-mode email output
      testdir: "fixtures/email"  # @schema type:string; default:fixtures/email
      # -- Email service provider
      provider: "resend"  # @schema type:string; default:resend
      # -- Sender email address
      fromemail: "support@mail.theopenlane.io"  # @schema type:string; default:support@mail.theopenlane.io
      # -- Support contact email address
      supportemail: "support@theopenlane.io"  # @schema type:string; default:support@theopenlane.io
      # -- Sender override for questionnaire auth emails
      questionnaireemail: "support@mail.theopenlane.io"  # @schema type:string; default:support@mail.theopenlane.io
      # -- Root application URL used to construct email action links
      rooturl: "https://www.theopenlane.io"  # @schema type:string; default:https://www.theopenlane.io
      # -- Product home URL
      producturl: "https://console.theopenlane.io"  # @schema type:string; default:https://console.theopenlane.io
      # -- Documentation URL
      docsurl: "https://docs.theopenlane.io"  # @schema type:string; default:https://docs.theopenlane.io
    paymentreminder:
      # -- Days after org creation before marking for deletion
      paymentmethodinterval: 0
      # -- Days between marking and actual deletion
      deletion_days: 0
      # -- Whether the payment reminder listener is enabled
      enabled: false  # @schema type:boolean
      # -- If true only log organization IDs that would be processed
      dryrun: false  # @schema type:boolean
  # -- Workflows contains the configuration for the workflows engine
  workflows:
    enabled: false  # @schema type:boolean; default:false
    cel:
      timeout: "100ms"  # @schema type:integer; default:100ms
      costlimit: 0  # @schema default:0
      interruptcheckfrequency: 100  # @schema default:100
      parserrecursionlimit: 250  # @schema type:integer; default:250
      parserexpressionsizelimit: 100000  # @schema type:integer; default:100000
      comprehensionnestinglimit: 0  # @schema type:integer; default:0
      extendedvalidations: true  # @schema type:boolean; default:true
      optionaltypes: false  # @schema type:boolean; default:false
      identifierescapesyntax: true  # @schema type:boolean; default:true
      crosstypenumericcomparisons: false  # @schema type:boolean; default:false
      macrocalltracking: false  # @schema type:boolean; default:false
      evaloptimize: true  # @schema type:boolean; default:true
      trackstate: false  # @schema type:boolean; default:false
    gala:
      enabled: false  # @schema type:boolean; default:false
      workercount: 10  # @schema type:integer; default:10
      maxretries: 5  # @schema type:integer; default:5
      failonenqueueerror: false  # @schema type:boolean; default:false
      queuename: "events"  # @schema type:string; default:events
  # -- Cloudflare contains configuration for Cloudflare integration
  cloudflare:
    # -- Enabled toggles the Cloudflare snapshot handler
    enabled: false  # @schema type:boolean; default:false
  # -- Shortlinks contains configuration for the URL shortening service
  shortlinks:
    enabled: false  # @schema type:boolean; default:false
    clientid: "d5d5babbdd4ba64d59ae543ac3b6a74d.access"  # @schema type:string; default:d5d5babbdd4ba64d59ae543ac3b6a74d.access
    endpointurl: "https://admin.s.theopenlane.io/api/links"  # @schema type:string; default:https://admin.s.theopenlane.io/api/links

# -- External Secrets configuration
externalSecrets:
  # -- Enable external secrets integration
  enabled: true  # @schema type:boolean; default:true
  # -- List of external secrets to create
  secrets:
    # -- core-server-secretmanager secret configuration
    core-server-secretmanager:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for server.secretmanager
      secretKey: "CORE_SERVER_SECRETMANAGER"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-server-secretmanager"  # @schema type:string
    # -- core-auth-providers-github-clientsecret secret configuration
    core-auth-providers-github-clientsecret:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for auth.providers.github.clientsecret
      secretKey: "CORE_AUTH_PROVIDERS_GITHUB_CLIENTSECRET"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-auth-providers-github-clientsecret"  # @schema type:string
    # -- core-auth-providers-google-clientsecret secret configuration
    core-auth-providers-google-clientsecret:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for auth.providers.google.clientsecret
      secretKey: "CORE_AUTH_PROVIDERS_GOOGLE_CLIENTSECRET"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-auth-providers-google-clientsecret"  # @schema type:string
    # -- core-authz-credentials-apitoken secret configuration
    core-authz-credentials-apitoken:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for authz.credentials.apitoken
      secretKey: "CORE_AUTHZ_CREDENTIALS_APITOKEN"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-authz-credentials-apitoken"  # @schema type:string
    # -- core-authz-credentials-clientsecret secret configuration
    core-authz-credentials-clientsecret:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for authz.credentials.clientsecret
      secretKey: "CORE_AUTHZ_CREDENTIALS_CLIENTSECRET"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-authz-credentials-clientsecret"  # @schema type:string
    # -- core-db-primarydbsource secret configuration
    core-db-primarydbsource:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for db.primarydbsource
      secretKey: "CORE_DB_PRIMARYDBSOURCE"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-db-primarydbsource"  # @schema type:string
    # -- core-db-secondarydbsource secret configuration
    core-db-secondarydbsource:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for db.secondarydbsource
      secretKey: "CORE_DB_SECONDARYDBSOURCE"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-db-secondarydbsource"  # @schema type:string
    # -- core-jobqueue-connectionuri secret configuration
    core-jobqueue-connectionuri:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for jobqueue.connectionuri
      secretKey: "CORE_JOBQUEUE_CONNECTIONURI"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-jobqueue-connectionuri"  # @schema type:string
    # -- core-sessions-signingkey secret configuration
    core-sessions-signingkey:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for sessions.signingkey
      secretKey: "CORE_SESSIONS_SIGNINGKEY"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-sessions-signingkey"  # @schema type:string
    # -- core-sessions-encryptionkey secret configuration
    core-sessions-encryptionkey:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for sessions.encryptionkey
      secretKey: "CORE_SESSIONS_ENCRYPTIONKEY"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-sessions-encryptionkey"  # @schema type:string
    # -- core-totp-secret secret configuration
    core-totp-secret:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for totp.secret
      secretKey: "CORE_TOTP_SECRET"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-totp-secret"  # @schema type:string
    # -- core-objectstorage-providers-s3-credentials-accesskeyid secret configuration
    core-objectstorage-providers-s3-credentials-accesskeyid:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for objectstorage.providers.s3.credentials.accesskeyid
      secretKey: "CORE_OBJECTSTORAGE_PROVIDERS_S3_CREDENTIALS_ACCESSKEYID"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-objectstorage-providers-s3-credentials-accesskeyid"  # @schema type:string
    # -- core-objectstorage-providers-s3-credentials-secretaccesskey secret configuration
    core-objectstorage-providers-s3-credentials-secretaccesskey:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for objectstorage.providers.s3.credentials.secretaccesskey
      secretKey: "CORE_OBJECTSTORAGE_PROVIDERS_S3_CREDENTIALS_SECRETACCESSKEY"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-objectstorage-providers-s3-credentials-secretaccesskey"  # @schema type:string
    # -- core-objectstorage-providers-s3-credentials-projectid secret configuration
    core-objectstorage-providers-s3-credentials-projectid:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for objectstorage.providers.s3.credentials.projectid
      secretKey: "CORE_OBJECTSTORAGE_PROVIDERS_S3_CREDENTIALS_PROJECTID"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-objectstorage-providers-s3-credentials-projectid"  # @schema type:string
    # -- core-objectstorage-providers-s3-credentials-accountid secret configuration
    core-objectstorage-providers-s3-credentials-accountid:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for objectstorage.providers.s3.credentials.accountid
      secretKey: "CORE_OBJECTSTORAGE_PROVIDERS_S3_CREDENTIALS_ACCOUNTID"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-objectstorage-providers-s3-credentials-accountid"  # @schema type:string
    # -- core-objectstorage-providers-s3-credentials-apitoken secret configuration
    core-objectstorage-providers-s3-credentials-apitoken:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for objectstorage.providers.s3.credentials.apitoken
      secretKey: "CORE_OBJECTSTORAGE_PROVIDERS_S3_CREDENTIALS_APITOKEN"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-objectstorage-providers-s3-credentials-apitoken"  # @schema type:string
    # -- core-objectstorage-providers-r2-credentials-accesskeyid secret configuration
    core-objectstorage-providers-r2-credentials-accesskeyid:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for objectstorage.providers.r2.credentials.accesskeyid
      secretKey: "CORE_OBJECTSTORAGE_PROVIDERS_R2_CREDENTIALS_ACCESSKEYID"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-objectstorage-providers-r2-credentials-accesskeyid"  # @schema type:string
    # -- core-objectstorage-providers-r2-credentials-secretaccesskey secret configuration
    core-objectstorage-providers-r2-credentials-secretaccesskey:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for objectstorage.providers.r2.credentials.secretaccesskey
      secretKey: "CORE_OBJECTSTORAGE_PROVIDERS_R2_CREDENTIALS_SECRETACCESSKEY"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-objectstorage-providers-r2-credentials-secretaccesskey"  # @schema type:string
    # -- core-objectstorage-providers-r2-credentials-projectid secret configuration
    core-objectstorage-providers-r2-credentials-projectid:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for objectstorage.providers.r2.credentials.projectid
      secretKey: "CORE_OBJECTSTORAGE_PROVIDERS_R2_CREDENTIALS_PROJECTID"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-objectstorage-providers-r2-credentials-projectid"  # @schema type:string
    # -- core-objectstorage-providers-r2-credentials-accountid secret configuration
    core-objectstorage-providers-r2-credentials-accountid:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for objectstorage.providers.r2.credentials.accountid
      secretKey: "CORE_OBJECTSTORAGE_PROVIDERS_R2_CREDENTIALS_ACCOUNTID"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-objectstorage-providers-r2-credentials-accountid"  # @schema type:string
    # -- core-objectstorage-providers-r2-credentials-apitoken secret configuration
    core-objectstorage-providers-r2-credentials-apitoken:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for objectstorage.providers.r2.credentials.apitoken
      secretKey: "CORE_OBJECTSTORAGE_PROVIDERS_R2_CREDENTIALS_APITOKEN"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-objectstorage-providers-r2-credentials-apitoken"  # @schema type:string
    # -- core-objectstorage-providers-disk-credentials-accesskeyid secret configuration
    core-objectstorage-providers-disk-credentials-accesskeyid:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for objectstorage.providers.disk.credentials.accesskeyid
      secretKey: "CORE_OBJECTSTORAGE_PROVIDERS_DISK_CREDENTIALS_ACCESSKEYID"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-objectstorage-providers-disk-credentials-accesskeyid"  # @schema type:string
    # -- core-objectstorage-providers-disk-credentials-secretaccesskey secret configuration
    core-objectstorage-providers-disk-credentials-secretaccesskey:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for objectstorage.providers.disk.credentials.secretaccesskey
      secretKey: "CORE_OBJECTSTORAGE_PROVIDERS_DISK_CREDENTIALS_SECRETACCESSKEY"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-objectstorage-providers-disk-credentials-secretaccesskey"  # @schema type:string
    # -- core-objectstorage-providers-disk-credentials-projectid secret configuration
    core-objectstorage-providers-disk-credentials-projectid:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for objectstorage.providers.disk.credentials.projectid
      secretKey: "CORE_OBJECTSTORAGE_PROVIDERS_DISK_CREDENTIALS_PROJECTID"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-objectstorage-providers-disk-credentials-projectid"  # @schema type:string
    # -- core-objectstorage-providers-disk-credentials-accountid secret configuration
    core-objectstorage-providers-disk-credentials-accountid:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for objectstorage.providers.disk.credentials.accountid
      secretKey: "CORE_OBJECTSTORAGE_PROVIDERS_DISK_CREDENTIALS_ACCOUNTID"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-objectstorage-providers-disk-credentials-accountid"  # @schema type:string
    # -- core-objectstorage-providers-disk-credentials-apitoken secret configuration
    core-objectstorage-providers-disk-credentials-apitoken:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for objectstorage.providers.disk.credentials.apitoken
      secretKey: "CORE_OBJECTSTORAGE_PROVIDERS_DISK_CREDENTIALS_APITOKEN"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-objectstorage-providers-disk-credentials-apitoken"  # @schema type:string
    # -- core-objectstorage-providers-database-credentials-accesskeyid secret configuration
    core-objectstorage-providers-database-credentials-accesskeyid:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for objectstorage.providers.database.credentials.accesskeyid
      secretKey: "CORE_OBJECTSTORAGE_PROVIDERS_DATABASE_CREDENTIALS_ACCESSKEYID"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-objectstorage-providers-database-credentials-accesskeyid"  # @schema type:string
    # -- core-objectstorage-providers-database-credentials-secretaccesskey secret configuration
    core-objectstorage-providers-database-credentials-secretaccesskey:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for objectstorage.providers.database.credentials.secretaccesskey
      secretKey: "CORE_OBJECTSTORAGE_PROVIDERS_DATABASE_CREDENTIALS_SECRETACCESSKEY"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-objectstorage-providers-database-credentials-secretaccesskey"  # @schema type:string
    # -- core-objectstorage-providers-database-credentials-projectid secret configuration
    core-objectstorage-providers-database-credentials-projectid:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for objectstorage.providers.database.credentials.projectid
      secretKey: "CORE_OBJECTSTORAGE_PROVIDERS_DATABASE_CREDENTIALS_PROJECTID"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-objectstorage-providers-database-credentials-projectid"  # @schema type:string
    # -- core-objectstorage-providers-database-credentials-accountid secret configuration
    core-objectstorage-providers-database-credentials-accountid:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for objectstorage.providers.database.credentials.accountid
      secretKey: "CORE_OBJECTSTORAGE_PROVIDERS_DATABASE_CREDENTIALS_ACCOUNTID"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-objectstorage-providers-database-credentials-accountid"  # @schema type:string
    # -- core-objectstorage-providers-database-credentials-apitoken secret configuration
    core-objectstorage-providers-database-credentials-apitoken:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for objectstorage.providers.database.credentials.apitoken
      secretKey: "CORE_OBJECTSTORAGE_PROVIDERS_DATABASE_CREDENTIALS_APITOKEN"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-objectstorage-providers-database-credentials-apitoken"  # @schema type:string
    # -- core-subscription-privatestripekey secret configuration
    core-subscription-privatestripekey:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for subscription.privatestripekey
      secretKey: "CORE_SUBSCRIPTION_PRIVATESTRIPEKEY"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-subscription-privatestripekey"  # @schema type:string
    # -- core-subscription-stripewebhooksecret secret configuration
    core-subscription-stripewebhooksecret:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for subscription.stripewebhooksecret
      secretKey: "CORE_SUBSCRIPTION_STRIPEWEBHOOKSECRET"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-subscription-stripewebhooksecret"  # @schema type:string
    # -- core-subscription-stripewebhooksecrets secret configuration
    core-subscription-stripewebhooksecrets:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for subscription.stripewebhooksecrets
      secretKey: "CORE_SUBSCRIPTION_STRIPEWEBHOOKSECRETS"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-subscription-stripewebhooksecrets"  # @schema type:string
    # -- core-subscription-stripewebhooksecrets-2025_12_15_clover secret configuration
    core-subscription-stripewebhooksecrets-2025_12_15_clover:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for subscription.stripewebhooksecrets.2025_12_15_CLOVER
      secretKey: "CORE_SUBSCRIPTION_STRIPEWEBHOOKSECRETS_2025_12_15_CLOVER"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-subscription-stripewebhooksecrets-2025_12_15_clover"  # @schema type:string
    # -- core-subscription-stripewebhooksecrets-2026_02_25_clover secret configuration
    core-subscription-stripewebhooksecrets-2026_02_25_clover:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for subscription.stripewebhooksecrets.2026_02_25_CLOVER
      secretKey: "CORE_SUBSCRIPTION_STRIPEWEBHOOKSECRETS_2026_02_25_CLOVER"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-subscription-stripewebhooksecrets-2026_02_25_clover"  # @schema type:string
    # -- core-integrations-awssecurityhub-accesskeyid secret configuration
    core-integrations-awssecurityhub-accesskeyid:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for integrations.awssecurityhub.accessKeyId
      secretKey: "CORE_INTEGRATIONS_AWSSECURITYHUB_ACCESSKEYID"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-integrations-awssecurityhub-accesskeyid"  # @schema type:string
    # -- core-integrations-awssecurityhub-secretaccesskey secret configuration
    core-integrations-awssecurityhub-secretaccesskey:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for integrations.awssecurityhub.secretAccessKey
      secretKey: "CORE_INTEGRATIONS_AWSSECURITYHUB_SECRETACCESSKEY"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-integrations-awssecurityhub-secretaccesskey"  # @schema type:string
    # -- core-integrations-githubapp-appid secret configuration
    core-integrations-githubapp-appid:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for integrations.githubapp.appid
      secretKey: "CORE_INTEGRATIONS_GITHUBAPP_APPID"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-integrations-githubapp-appid"  # @schema type:string
    # -- core-integrations-githubapp-privatekey secret configuration
    core-integrations-githubapp-privatekey:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for integrations.githubapp.privatekey
      secretKey: "CORE_INTEGRATIONS_GITHUBAPP_PRIVATEKEY"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-integrations-githubapp-privatekey"  # @schema type:string
    # -- core-integrations-githubapp-webhooksecret secret configuration
    core-integrations-githubapp-webhooksecret:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for integrations.githubapp.webhooksecret
      secretKey: "CORE_INTEGRATIONS_GITHUBAPP_WEBHOOKSECRET"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-integrations-githubapp-webhooksecret"  # @schema type:string
    # -- core-integrations-slack-clientsecret secret configuration
    core-integrations-slack-clientsecret:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for integrations.slack.clientsecret
      secretKey: "CORE_INTEGRATIONS_SLACK_CLIENTSECRET"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-integrations-slack-clientsecret"  # @schema type:string
    # -- core-integrations-googledrive-clientsecret secret configuration
    core-integrations-googledrive-clientsecret:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for integrations.googledrive.clientsecret
      secretKey: "CORE_INTEGRATIONS_GOOGLEDRIVE_CLIENTSECRET"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-integrations-googledrive-clientsecret"  # @schema type:string
    # -- core-integrations-googleworkspace-clientsecret secret configuration
    core-integrations-googleworkspace-clientsecret:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for integrations.googleworkspace.clientsecret
      secretKey: "CORE_INTEGRATIONS_GOOGLEWORKSPACE_CLIENTSECRET"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-integrations-googleworkspace-clientsecret"  # @schema type:string
    # -- core-integrations-azureentraid-clientsecret secret configuration
    core-integrations-azureentraid-clientsecret:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for integrations.azureentraid.clientsecret
      secretKey: "CORE_INTEGRATIONS_AZUREENTRAID_CLIENTSECRET"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-integrations-azureentraid-clientsecret"  # @schema type:string
    # -- core-integrations-microsoftteams-clientsecret secret configuration
    core-integrations-microsoftteams-clientsecret:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for integrations.microsoftteams.clientsecret
      secretKey: "CORE_INTEGRATIONS_MICROSOFTTEAMS_CLIENTSECRET"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-integrations-microsoftteams-clientsecret"  # @schema type:string
    # -- core-integrations-onedrive-clientsecret secret configuration
    core-integrations-onedrive-clientsecret:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for integrations.onedrive.clientsecret
      secretKey: "CORE_INTEGRATIONS_ONEDRIVE_CLIENTSECRET"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-integrations-onedrive-clientsecret"  # @schema type:string
    # -- core-integrations-oidclocal-clientsecret secret configuration
    core-integrations-oidclocal-clientsecret:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for integrations.oidclocal.clientsecret
      secretKey: "CORE_INTEGRATIONS_OIDCLOCAL_CLIENTSECRET"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-integrations-oidclocal-clientsecret"  # @schema type:string
    # -- core-integrations-email-resendsecret secret configuration
    core-integrations-email-resendsecret:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for integrations.email.resendsecret
      secretKey: "CORE_INTEGRATIONS_EMAIL_RESENDSECRET"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-integrations-email-resendsecret"  # @schema type:string
    # -- core-integrations-email-apikey secret configuration
    core-integrations-email-apikey:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for integrations.email.apikey
      secretKey: "CORE_INTEGRATIONS_EMAIL_APIKEY"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-integrations-email-apikey"  # @schema type:string
    # -- core-cloudflare-apitoken secret configuration
    core-cloudflare-apitoken:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for cloudflare.apitoken
      secretKey: "CORE_CLOUDFLARE_APITOKEN"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-cloudflare-apitoken"  # @schema type:string
    # -- core-cloudflare-accountid secret configuration
    core-cloudflare-accountid:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for cloudflare.accountid
      secretKey: "CORE_CLOUDFLARE_ACCOUNTID"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-cloudflare-accountid"  # @schema type:string
    # -- core-cloudflare-clientid secret configuration
    core-cloudflare-clientid:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for cloudflare.clientid
      secretKey: "CORE_CLOUDFLARE_CLIENTID"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-cloudflare-clientid"  # @schema type:string
    # -- core-cloudflare-clientsecret secret configuration
    core-cloudflare-clientsecret:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for cloudflare.clientsecret
      secretKey: "CORE_CLOUDFLARE_CLIENTSECRET"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-cloudflare-clientsecret"  # @schema type:string
    # -- core-shortlinks-clientsecret secret configuration
    core-shortlinks-clientsecret:
      # -- Enable this external secret
      enabled: true  # @schema type:boolean; default:true
      # -- Environment variable key for shortlinks.clientsecret
      secretKey: "CORE_SHORTLINKS_CLIENTSECRET"  # @schema type:string
      # -- Remote key in GCP Secret Manager
      remoteKey: "core-shortlinks-clientsecret"  # @schema type:string