# ==============================================================================
# SPIRE Server Configuration
# Auth-Yes Identity & Access Management Fabric
# ==============================================================================
# This configuration defines the root SPIFFE trust authority for your cluster.
# You can customize trust domains, certificate TTLs, and datastore plugins below.
# ==============================================================================

server {
  # Network binding: 0.0.0.0 listens on all internal mesh interfaces.
  bind_address = "0.0.0.0"
  bind_port = "8081"

  # Trust Domain: Identifies the root cryptographic security domain.
  # SPIFFE IDs will be generated in the format: spiffe://<trust_domain>/<workload>
  trust_domain = "system.local"

  # Directory where SPIRE server persists runtime data, datastore, and keys.
  data_dir = "/opt/spire/data/server"

  # Path to bind the SPIRE Server API admin socket
  socket_path = "/opt/spire/data/server/api.sock"

  # Logging verbosity: DEBUG, INFO, WARN, ERROR
  log_level = "INFO"

  # Certificate Authority (CA) Time-to-Live (default: 30 days)
  ca_ttl = "720h"

  # Default Workload SVID Time-to-Live (default: 1 hour for high-security rotation)
  default_x509_svid_ttl = "1h"
}

plugins {
  # ----------------------------------------------------------------------------
  # DataStore Plugin: Persists SPIFFE registrations, entries, and nodes.
  # Default: Embedded SQLite3 datastore inside /opt/spire/data/server.
  # ----------------------------------------------------------------------------
  DataStore "sql" {
    plugin_data {
      database_type = "sqlite3"
      connection_string = "/opt/spire/data/server/datastore.sqlite3"
    }
  }

  # ----------------------------------------------------------------------------
  # NodeAttestor Plugin: Verifies identity of SPIRE agents joining the cluster.
  # 'join_token' allows dynamic 1-time token enrollment for agents.
  # ----------------------------------------------------------------------------
  NodeAttestor "join_token" {
    plugin_data {}
  }

  # ----------------------------------------------------------------------------
  # KeyManager Plugin: Securely stores the server CA private keys on disk.
  # ----------------------------------------------------------------------------
  KeyManager "disk" {
    plugin_data {
      keys_path = "/opt/spire/data/server/keys.json"
    }
  }
}