---
# --- Deployment ---
opa_server_namespace: opa
opa_server_name: opa
opa_server_image: docker.io/openpolicyagent/opa:1.21.1-static
opa_server_replicas: 1
opa_server_port: 8443
opa_server_log_level: info
# Log every decision (including the job's extra_vars) to the pod log for auditing.
opa_server_decision_logs: true
opa_server_resources:
  requests:
    cpu: 50m
    memory: 64Mi
  limits:
    cpu: 500m
    memory: 256Mi
opa_server_wait_timeout: 300

# --- Policies ---
# Every *.rego file in this directory is loaded into the server.
opa_server_policy_dir: "{{ role_path }}/files/policies"
# Exposed to policies as data.aap_policy_config (see files/policies/aap_policy.rego).
opa_server_policy_config:
  allowed_ee_registries:
    - aap.toal.ca/
    - registry.redhat.io/
  forbidden_extra_vars:
    - ansible_password
    - ansible_become_password
    - ansible_ssh_pass
    - ansible_become_pass
  change_freeze: false
  change_freeze_exempt_teams: []

# --- Bearer token (OPA --authentication=token) ---
# Generated on first run and stored in Vault; reused afterwards.
opa_server_vault_mount: kv
opa_server_vault_path: toallab/opa-server

# --- AAP integration ---
opa_server_configure_aap: true
opa_server_aap_url: "{{ aap_gateway_url }}"
opa_server_aap_username: admin
opa_server_aap_namespace: aap
opa_server_aap_admin_secret: aap-admin-password
opa_server_aap_validate_certs: true
opa_server_aap_request_timeout: 1.5
opa_server_aap_request_retries: 2
# Attach a policy to AAP resources. Jobs fail closed: any OPA error or violation
# blocks the launch, so start with aap/smoke/allow_all and a test resource.
#   - type: organizations | inventories | job_templates
#     name: Default
#     query_path: aap/policy/decision
opa_server_aap_query_paths: []

# --- Debugging ---
opa_server_no_log: true