dsn: ${DSN}

serve:
    cookies:
        same_site_mode: Lax
    admin:
        cors:
            enabled: true
            allowed_origins:
                - http://localhost:5173
                - http://localhost:5174
                - http://localhost:5175
                - http://localhost:5000
                - https://ssologin.hmac.kr
                - https://sso-test.hmac.kr
                - https://app.brsw.kr
                - https://sss.hmac.kr
                - https://sso.hmac.kr
            allowed_methods:
                - POST
                - GET
                - PUT
                - PATCH
                - DELETE
                - CONNECT
                - HEAD
                - OPTIONS
                - TRACE
            allowed_headers:
                - Authorization
                - Accept
                - Content-Type
                - Content-Length
                - Accept-Language
                - Content-Language
            exposed_headers:
                - Content-Type
                - Cache-Control
                - Expires
                - Last-Modified
                - Pragma
                - Content-Length
                - Content-Language
    public:
        cors:
            enabled: true
            allowed_origins:
                - http://localhost:5173
                - http://localhost:5174
                - http://localhost:5175
                - http://localhost:5000
                - https://ssologin.hmac.kr
                - https://sso-test.hmac.kr
                - https://app.brsw.kr
                - https://sss.hmac.kr
                - https://sso.hmac.kr
            allowed_methods:
                - POST
                - GET
                - PUT
                - PATCH
                - DELETE
                - CONNECT
                - HEAD
                - OPTIONS
                - TRACE
            allowed_headers:
                - Authorization
                - Accept
                - Content-Type
                - Content-Length
                - Accept-Language
                - Content-Language
            exposed_headers:
                - Content-Type
                - Cache-Control
                - Expires
                - Last-Modified
                - Pragma
                - Content-Length
                - Content-Language
            allow_credentials: true

urls:
    self:
        issuer: ${URLS_SELF_ISSUER}
    consent: ${URLS_CONSENT}
    login: ${URLS_LOGIN}
    logout: ${URLS_LOGOUT}
    device:
        verification: http://127.0.0.1:3000/device/verify
        success: http://127.0.0.1:3000/device/success

secrets:
    system:
        - ${SECRETS_SYSTEM}

webfinger:
    oidc_discovery:
        client_registration_url: http://127.0.0.1:4444/oauth2/register

oidc:
    subject_identifiers:
        supported_types:
            - pairwise
            - public
        pairwise:
            salt: youReallyNeedToChangeThis
    dynamic_client_registration:
        enabled: true

ttl:
    access_token: 15m
    id_token: 15m