midas.yaml

# MIDAS Runtime Configuration
# Schema version: 1
#
# This file is the canonical runtime contract for MIDAS.
# See docs/configuration.md for full field reference.
#
# Precedence (highest to lowest):
#   1. Environment variable overrides  (MIDAS_*)
#   2. This file
#   3. Built-in defaults
#
# Placeholder expansion:
#   Any string value may contain ${ENV_VAR} references.
#   MIDAS will expand them at startup. An unresolved reference is a fatal error.
#
# Profiles:
#   dev        — permissive; any store backend; any auth mode; suitable for local use
#   production — enforces: store.backend=postgres + auth.mode=required
#
# ---------------------------------------------------------------------------
# Deployment modes
# ---------------------------------------------------------------------------
#
# ── Headless / API-only mode ──────────────────────────────────────────────────
# Runs MIDAS as a pure governance engine with no browser-facing surfaces.
# Set server.headless: true (or MIDAS_SERVER_HEADLESS=true).
# When true: Explorer, /auth/*, local IAM, and OIDC are not initialised.
# /v1/*, /healthz, and /readyz remain fully operational.
# Conflicts with: server.explorer_enabled=true, local_iam.enabled=true, platform_oidc.enabled=true
# Startup will fail if any conflicting option is set alongside headless=true.
#
# ── Local platform mode ───────────────────────────────────────────────────────
# Explorer UI + local username/password login.
# Enable: server.headless: false, server.explorer_enabled: true, local_iam.enabled: true
# A bootstrap admin/admin account is created on first run (MustChangePassword=true).
#
# ── OIDC platform mode ────────────────────────────────────────────────────────
# Explorer UI + enterprise SSO via Entra ID or Google Workspace.
# Enable: server.headless: false, server.explorer_enabled: true, platform_oidc.enabled: true
# OIDC requires local_iam.enabled: true for session management.
# Both local_iam and platform_oidc must be enabled together for OIDC login.

version: 1
profile: dev

# ---------------------------------------------------------------------------
# HTTP server
# ---------------------------------------------------------------------------
server:
  # headless: runs MIDAS as a pure API/governance engine.
  # When true, Explorer, /auth/*, local IAM, and OIDC are not initialised.
  # Env: MIDAS_SERVER_HEADLESS=true
  headless: false
  port: 8080
  shutdown_timeout: 15s
  # HTTP server timeouts — protect against slow clients and resource exhaustion.
  # read_timeout:        time to read the full request including body. Default: 30s.
  # read_header_timeout: time to read request headers only.             Default: 10s.
  # write_timeout:       time to write the full response.               Default: 60s.
  # idle_timeout:        max idle time for keep-alive connections.       Default: 120s.
  read_timeout: 30s
  read_header_timeout: 10s
  write_timeout: 60s
  idle_timeout: 120s
  explorer_enabled: true

# ---------------------------------------------------------------------------
# Persistence backend
# ---------------------------------------------------------------------------
store:
  # backend: "memory" (no dependencies) or "postgres" (production)
  backend: memory

  # dsn: Postgres connection string. Required when backend=postgres.
  # Use placeholder expansion to avoid embedding secrets:
  #   dsn: "${DATABASE_URL}"
  dsn: ""

# ---------------------------------------------------------------------------
# Authentication
# ---------------------------------------------------------------------------
auth:
  # mode: "open" (no auth, dev only) or "required" (bearer token enforced)
  mode: open

  # tokens: static bearer token entries.
  # Required when mode=required. Token values support ${VAR} expansion.
  #
  # Example:
  #   tokens:
  #     - token: "${MIDAS_ADMIN_TOKEN}"
  #       principal: "user:admin"
  #       roles: "admin"
  #     - token: "${MIDAS_OPERATOR_TOKEN}"
  #       principal: "svc:payments-engine"
  #       roles: "operator"
  tokens: []

# ---------------------------------------------------------------------------
# Local IAM — enabled by default for browser-based console access.
# Bootstrap credentials: admin / admin (forced password change on first login).
# To disable (headless/API-only deployments): set enabled: false or
# MIDAS_LOCAL_IAM_ENABLED=false.
# ---------------------------------------------------------------------------
# local_iam:
#   enabled: true
#   session_ttl: 8h
#   secure_cookies: true    # required by production profile
#   # secure_cookies: false # use only for local HTTP development

# ---------------------------------------------------------------------------
# Platform OIDC — enable for enterprise SSO via Entra ID or Google Workspace.
# Requires local_iam.enabled: true for session management.
# Single provider at a time. Disable for headless/API-only deployments.
# Env: MIDAS_OIDC_ENABLED=true  MIDAS_OIDC_CLIENT_ID=...  MIDAS_OIDC_CLIENT_SECRET=...
# ---------------------------------------------------------------------------
# platform_oidc:
#   enabled: false
#   provider_name: entra    # entra or google
#
#   issuer_url: ""          # https://login.microsoftonline.com/<tenant>/v2.0  (Entra)
#                           # https://accounts.google.com                      (Google)
#   auth_url: ""            # optional: overrides discovered authorization endpoint
#   token_url: ""           # optional: overrides discovered token endpoint
#
#   client_id: ""           # use MIDAS_OIDC_CLIENT_ID env var in production
#   client_secret: ""       # use MIDAS_OIDC_CLIENT_SECRET env var in production
#
#   redirect_url: ""        # must match the registered redirect URI in your IdP
#
#   scopes:
#     - openid
#     - profile
#     - email
#
#   subject_claim: sub
#   username_claim: preferred_username   # use 'email' for Google
#   groups_claim: groups                 # use 'hd' for Google (hosted domain)
#
#   # domain_hint: ""       # optional: login hint passed to provider
#   # allowed_groups: []    # optional: restrict login to members of listed groups
#
#   role_mappings: []       # map external groups/domains to MIDAS roles
#   deny_if_no_roles: true  # reject login when no internal roles are mapped
#   use_pkce: true          # recommended; required by Google

# ---------------------------------------------------------------------------
# Observability
# ---------------------------------------------------------------------------
observability:
  # log_level: debug | info | warn | error
  log_level: info
  # log_format: json | text
  log_format: json

# ---------------------------------------------------------------------------
# Control plane
# ---------------------------------------------------------------------------
control_plane:
  enabled: true

# ---------------------------------------------------------------------------
# Structural model enforcement
# ---------------------------------------------------------------------------
structural:
  # mode: "permissive" (default) or "enforced"
  # permissive: structural fields (process_id) are optional on /v1/evaluate.
  # enforced:   process_id is required; requests without it are rejected 422.
  # Env: MIDAS_STRUCTURAL_MODE=enforced
  mode: permissive

# ---------------------------------------------------------------------------
# Dev (local / development only)
# ---------------------------------------------------------------------------
dev:
  # seed_demo_data: when true MIDAS seeds the V2 structural demonstration
  # dataset at startup (BusinessService → Process → Surface with Capability
  # relationships). The seed is idempotent — re-running on an already-seeded
  # store is a no-op. Works with both memory and postgres backends.
  # Enabled by default so `make dev` works out of the box. Set false in
  # production or when supplying real governance data.
  seed_demo_data: true

  # seed_demo_user: when true and local_iam.enabled is true, MIDAS creates a
  # demo Local IAM account (username: demo, password: demo, no forced password
  # change) at startup. Enabled by default for local development so the Explorer
  # login hint is accurate. Set false in production or when local_iam is disabled.
  # Env: MIDAS_DEV_SEED_DEMO_USER=false
  seed_demo_user: true

  # seed_synthetic_drift controls the deterministic, dev/demo-only synthetic
  # drift dataset (DriftDefinitions + Series + Points + Observations +
  # Annotations) over the existing demo entities so the Drift heatmap /
  # workbench / inspector UI is populated for demos. Idempotent.
  #
  # When this key is omitted (the default in this sample), the value is
  # INHERITED FROM seed_demo_data:
  #   seed_demo_data: true  → synthetic drift is seeded
  #   seed_demo_data: false → synthetic drift is not seeded
  #
  # Set this key explicitly to override the inheritance:
  #   seed_synthetic_drift: false  → suppresses synthetic drift even when
  #                                  seed_demo_data is true
  #   seed_synthetic_drift: true   → forces synthetic drift even when
  #                                  seed_demo_data is false (warns at
  #                                  startup; the synthetic generator
  #                                  references demo entity IDs)
  #
  # Env: MIDAS_DEV_SEED_SYNTHETIC_DRIFT=true|false (overrides this YAML key)
  # NEVER enable in production.
  # seed_synthetic_drift: false

# ---------------------------------------------------------------------------
# Outbox dispatcher (optional)
# ---------------------------------------------------------------------------
dispatcher:
  # enabled: set to true to start the outbox dispatcher goroutine.
  # Requires a durable store (postgres) and a configured publisher.
  enabled: false
  # publisher: "none" | "kafka"
  publisher: none
  batch_size: 100
  poll_interval: 2s
  max_backoff: 30s

# ---------------------------------------------------------------------------
# Kafka publisher (only used when dispatcher.publisher=kafka)
# ---------------------------------------------------------------------------
kafka:
  # brokers: list of seed broker addresses in "host:port" form.
  brokers: []
  client_id: midas
  required_acks: -1
  write_timeout: 0s