config.yaml.example

# Example Darb Configuration
# Copy this file to config.yaml and update with your values

server:
  port: 8460
  mode: development  # or "production"
  # Local mode only accepts requests with loopback Host/Origin headers.
  # When nebi is served through a reverse proxy on a public hostname
  # (e.g. JupyterHub's jupyter-server-proxy), list that origin here so
  # browser CORS-mode requests (the SPA's crossorigin asset bundle) pass.
  # Comma-separated. Env: NEBI_SERVER_ALLOWED_ORIGINS
  # allowed_origins: "https://hub.example.com"

database:
  driver: sqlite  # or "postgres"
  dsn: ./nebi.db
  # For PostgreSQL:
  # driver: postgres
  # dsn: "host=localhost user=nebi password=secret dbname=nebi port=5432 sslmode=disable"
  # max_idle_conns: 10
  # max_open_conns: 100
  # conn_max_lifetime: 60

auth:
  type: basic
  jwt_secret: change-me-in-production

  # Optional: Enable OIDC/OAuth authentication
  # Uncomment and configure to enable OAuth login button
  # Works with any OIDC provider (Google, GitHub, Keycloak, Auth0, Okta, etc.)
  # oidc_issuer_url: https://accounts.google.com
  # oidc_client_id: your-client-id.apps.googleusercontent.com
  # oidc_client_secret: your-client-secret
  # oidc_redirect_url: http://localhost:8460/api/v1/auth/oidc/callback
  #
  # Optional: separate discovery URL for split-horizon deployments where the
  # issuer (the public URL browsers use, validated in the token's "iss" claim)
  # is not reachable from where nebi runs. nebi fetches
  # .well-known/openid-configuration from oidc_discovery_url while still
  # validating "iss" against oidc_issuer_url. Defaults to oidc_issuer_url.
  # Example (in-cluster Keycloak Service):
  # oidc_discovery_url: http://keycloak-http.keycloak.svc.cluster.local/realms/nebari

queue:
  type: memory  # or "valkey"
  # valkey_addr: localhost:6379

log:
  format: text  # or "json"
  level: info   # debug, info, warn, error

package_manager:
  default_type: pixi
  # pixi_path: /custom/path/to/pixi  # Optional: custom binary path
  # uv_path: /custom/path/to/uv      # Optional: custom binary path

storage:
  environments_dir: ./data/environments

# Admin-provisioned OCI registries (optional). Public registries only:
# entries carry no credentials.
# Entries are declarative: reconciled into the database at every boot,
# marked as config-managed, and locked against UI/API/CLI modification.
# Removing an entry here removes it from the database on next boot.
# This section is YAML-only (no NEBI_* env override for the list).
# registries:
#   # Set false to remove the built-in quay.io/nebari_environments registry.
#   # (Deleting it via the admin UI also sticks now; it is seeded only once.)
#   seed_default: true
#   entries:
#     - name: acme-registry
#       url: registry.acme.com
#       namespace: acme-envs
#       default: true   # at most one entry may set this

# Environment variables can override any setting above
# Example: NEBI_AUTH_OIDC_CLIENT_ID=your-id
# Format: NEBI_<SECTION>_<KEY> (dots become underscores)