# ==============================================================================
# SPIRE Agent Configuration
# Auth-Yes Identity & Access Management Fabric
# ==============================================================================
# The SPIRE Agent runs as a local node daemon, attesting workloads (e.g. Docker
# containers) and serving the Workload API UNIX domain socket.
# ==============================================================================

agent {
  # Directory where the SPIRE agent caches SVIDs, bundles, and keys.
  data_dir = "/opt/spire/data/agent"

  # Logging verbosity: DEBUG, INFO, WARN, ERROR
  log_level = "INFO"

  # Address and port of the SPIRE Server container within the internal network.
  server_address = "spire-server"
  server_port = "8081"

  # UNIX Domain Socket Path exposed to workloads for zero-trust identity fetching.
  socket_path = "/var/run/spire/agent.sock"

  # Must match the SPIRE Server's trust_domain.
  trust_domain = "system.local"

  # Automatically fetch trust bundle from server on first bootstrap
  insecure_bootstrap = true
}

plugins {
  # ----------------------------------------------------------------------------
  # NodeAttestor Plugin: Authenticates this agent with the SPIRE Server.
  # ----------------------------------------------------------------------------
  NodeAttestor "join_token" {
    plugin_data {}
  }

  # ----------------------------------------------------------------------------
  # KeyManager Plugin: Stores node-level private keys on disk.
  # ----------------------------------------------------------------------------
  KeyManager "disk" {
    plugin_data {
      directory = "/opt/spire/data/agent"
    }
  }

  # ----------------------------------------------------------------------------
  # WorkloadAttestor Plugin: Inspects running containers on Docker / Podman
  # to grant SPIFFE SVIDs based on container image, labels, or names.
  # ----------------------------------------------------------------------------
  WorkloadAttestor "docker" {
    plugin_data {}
  }
}