# Non-secret runtime configuration. Security-integration URLs
# (QONTO_KEY_CAPE_JWKS_URL / QONTO_FLEX_AUTH_URL / QONTO_TENANT_ENGINE_URL)
# are deliberately left unset here: none of key-cape, flex-auth, or
# tenant-engine has a confirmed in-cluster reachable address yet. Each
# integration fails safe when unset (see docs/SecurityPractice.md #10 and
# #4) -- unset is the correct value until those addresses are confirmed,
# not a placeholder to fill in blindly.
apiVersion: v1
kind: ConfigMap
metadata:
  name: qonto-assistant-config
  namespace: qonto-assistant
  labels:
    app.kubernetes.io/name: qonto-assistant
    app.kubernetes.io/part-of: qonto-assistant
data:
  QONTO_ASSISTANT_HOST: "0.0.0.0"
  QONTO_ASSISTANT_PORT: "8080"
  QONTO_ASSISTANT_DEFAULT_TENANT: "binky"
  QONTO_BASE_URL: "https://thirdparty.qonto.com"
  QONTO_AUTH_MODE: "legacy_api_key"
  QONTO_CREDENTIAL_SOURCE: "env"
  QONTO_RATE_LIMIT_REQUESTS: "20"
  QONTO_RATE_LIMIT_WINDOW_SECONDS: "60"
  QONTO_MAX_CONCURRENCY: "4"
  QONTO_DENY_ESCALATION_ENABLED: "true"
  QONTO_AUDIT_HEARTBEAT_INTERVAL_SECONDS: "86400"
  # QONTO_KEY_CAPE_JWKS_URL: TODO once key-cape has a confirmed in-cluster address
  # QONTO_FLEX_AUTH_URL: TODO once flex-auth has a confirmed in-cluster address
  # QONTO_TENANT_ENGINE_URL: TODO once tenant-engine is deployed anywhere reachable