conf

type Attestations struct {

	// When true, skip writing the attestation bundle to the per-run row in
	// the attestation table; the bundle is stored exclusively in the
	// configured CAS backend. The digest is still recorded on the workflow
	// run so the bundle can be retrieved from CAS on read. Has no effect
	// when the workflow run's CAS backend is inline, since inline backends
	// do not store attestation bundles externally.
	SkipDbStorage bool `protobuf:"varint,1,opt,name=skip_db_storage,json=skipDbStorage,proto3" json:"skip_db_storage,omitempty"`
	// Maximum size in bytes of a policy-evaluation bundle that the workflow-run
	// View API downloads from CAS and inlines in its response. Bundles above
	// this size are returned as a reference for the caller to fetch directly,
	// which keeps a single attestation with a very large number of violations
	// from exhausting the control plane's memory. Values <= 0 select the
	// built-in default.
	PolicyEvaluationsMaxInlineBytes int64 `` /* 161-byte string literal not displayed */
	// Maximum amount of time an unfinished workflow run can remain active before
	// it is marked as expired. When unset, the control plane defaults to 1 hour.
	// In YAML configuration, use seconds with an "s" suffix, for example "3600s".
	WorkflowRunExpirationWindow *durationpb.Duration `` /* 146-byte string literal not displayed */
	// Interval between checks for unfinished workflow runs. When unset, the
	// control plane defaults to 1 minute.
	// In YAML configuration, use seconds with an "s" suffix, for example "60s".
	WorkflowRunExpirationCheckInterval *durationpb.Duration `` /* 169-byte string literal not displayed */
	// Require every pushed attestation to be verified with keyless signing.
	// It only applies when keyless signing is configured (certificate_authorities).
	// When enabled, an attestation must be signed with a certificate issued by one
	// of the configured certificate authorities to the organization that owns the
	// workflow run, and other signing methods are rejected. Set it to false to
	// also accept attestations signed with other methods, for example cosign keys
	// or KMS. When unset, it defaults to true.
	ForceVerification *bool `protobuf:"varint,5,opt,name=force_verification,json=forceVerification,proto3,oneof" json:"force_verification,omitempty"`
	// contains filtered or unexported fields
}

type Auth struct {

	// Authentication creates a JWT that uses this secret for signing
	GeneratedJwsHmacSecret        string         `` /* 131-byte string literal not displayed */
	AllowList                     *v11.AllowList `protobuf:"bytes,3,opt,name=allow_list,json=allowList,proto3" json:"allow_list,omitempty"`
	CasRobotAccountPrivateKeyPath string         `` /* 156-byte string literal not displayed */
	Oidc                          *Auth_OIDC     `protobuf:"bytes,6,opt,name=oidc,proto3" json:"oidc,omitempty"`
	// Generates an initial user. Use only for development purposes
	DevUser string `protobuf:"bytes,7,opt,name=dev_user,json=devUser,proto3" json:"dev_user,omitempty"`
	// Whether a login that sends no code challenge still receives the session token in the
	// callback URL (legacy ?t= callback). Allowed when not set. Denying it requires clients
	// that use the login code exchange.
	AllowLegacyLoginCallback *bool `` /* 144-byte string literal not displayed */
	// contains filtered or unexported fields
}

type Auth_OIDC struct {
	Domain       string `protobuf:"bytes,1,opt,name=domain,proto3" json:"domain,omitempty"`
	ClientId     string `protobuf:"bytes,2,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
	ClientSecret string `protobuf:"bytes,3,opt,name=client_secret,json=clientSecret,proto3" json:"client_secret,omitempty"`
	// Optional login URL that will be used by the CLI to start the OIDC flow
	// If not provided, it will default to [controlplane domain]/login
	LoginUrlOverride string `protobuf:"bytes,5,opt,name=login_url_override,json=loginUrlOverride,proto3" json:"login_url_override,omitempty"`
	// contains filtered or unexported fields
}

type Bootstrap struct {
	Server             *Server                  `protobuf:"bytes,1,opt,name=server,proto3" json:"server,omitempty"`
	Data               *Data                    `protobuf:"bytes,2,opt,name=data,proto3" json:"data,omitempty"`
	Auth               *Auth                    `protobuf:"bytes,3,opt,name=auth,proto3" json:"auth,omitempty"`
	Observability      *Bootstrap_Observability `protobuf:"bytes,4,opt,name=observability,proto3" json:"observability,omitempty"`
	CredentialsService *v1.Credentials          `protobuf:"bytes,5,opt,name=credentials_service,json=credentialsService,proto3" json:"credentials_service,omitempty"`
	// CAS Server endpoint
	CasServer *Bootstrap_CASServer `protobuf:"bytes,6,opt,name=cas_server,json=casServer,proto3" json:"cas_server,omitempty"`
	// Plugins directory
	// NOTE: plugins have the form of chainloop-plugin-<name>
	PluginsDir string `protobuf:"bytes,7,opt,name=plugins_dir,json=pluginsDir,proto3" json:"plugins_dir,omitempty"`
	// The certificate authority used for keyless signing (deprecated, use certificate_authorities instead)
	//
	// Deprecated: Marked as deprecated in controlplane/config/v1/conf.proto.
	CertificateAuthority *CA `protobuf:"bytes,9,opt,name=certificate_authority,json=certificateAuthority,proto3" json:"certificate_authority,omitempty"`
	// Multiple certificate authorities, used for CA rotation
	CertificateAuthorities []*CA `` /* 128-byte string literal not displayed */
	// Multiple timestamp authorities
	TimestampAuthorities []*TSA `protobuf:"bytes,17,rep,name=timestamp_authorities,json=timestampAuthorities,proto3" json:"timestamp_authorities,omitempty"`
	// Configuration for onboarding users in organizations with specific roles
	Onboarding []*v11.OnboardingSpec `protobuf:"bytes,10,rep,name=onboarding,proto3" json:"onboarding,omitempty"`
	// Configuration to enable Prometheus integration for the specified organizations
	PrometheusIntegration []*PrometheusIntegrationSpec `protobuf:"bytes,11,rep,name=prometheus_integration,json=prometheusIntegration,proto3" json:"prometheus_integration,omitempty"`
	// providers for external policy repositories
	PolicyProviders []*PolicyProvider `protobuf:"bytes,12,rep,name=policy_providers,json=policyProviders,proto3" json:"policy_providers,omitempty"`
	// Enable :6060 pprof endpoint
	EnableProfiler bool `protobuf:"varint,13,opt,name=enable_profiler,json=enableProfiler,proto3" json:"enable_profiler,omitempty"`
	// nats server configuration for sending events
	NatsServer *Bootstrap_NatsServer `protobuf:"bytes,14,opt,name=nats_server,json=natsServer,proto3" json:"nats_server,omitempty"`
	// Federated verification allows to delegate the API tokens received during the attestation
	// to a third party service for verification
	// For example, we can forward Gitlab or Github API tokens
	FederatedAuthentication *FederatedAuthentication `` /* 131-byte string literal not displayed */
	// Restrict organization creation to admins
	RestrictOrgCreation bool `protobuf:"varint,18,opt,name=restrict_org_creation,json=restrictOrgCreation,proto3" json:"restrict_org_creation,omitempty"`
	// External URL of the platform UI, if available
	UiDashboardUrl string `protobuf:"bytes,19,opt,name=ui_dashboard_url,json=uiDashboardUrl,proto3" json:"ui_dashboard_url,omitempty"`
	// Optional external operation authorization provider
	OperationAuthorizationProvider *OperationAuthorizationProvider `` /* 154-byte string literal not displayed */
	// Attestation storage and processing options
	Attestations *Attestations `protobuf:"bytes,21,opt,name=attestations,proto3" json:"attestations,omitempty"`
	// Outbound network policy applied to the integration plugins
	PluginsNetworkPolicy *PluginsNetworkPolicy `protobuf:"bytes,22,opt,name=plugins_network_policy,json=pluginsNetworkPolicy,proto3" json:"plugins_network_policy,omitempty"`
	// Additional origins (scheme://host[:port]) the post-login callback may redirect to,
	// on top of the control plane external URL, the login URL and the UI dashboard URL.
	// Matched exactly, wildcards, paths, queries and fragments are not allowed
	AllowedCallbackOrigins []string `` /* 130-byte string literal not displayed */
	// contains filtered or unexported fields
}

type Bootstrap_CASServer struct {

	// CAS server GRPC endpoint
	Grpc *Server_GRPC `protobuf:"bytes,1,opt,name=grpc,proto3" json:"grpc,omitempty"`
	// insecure is used to connect to the CAS server in development
	Insecure bool `protobuf:"varint,2,opt,name=insecure,proto3" json:"insecure,omitempty"`
	// CAS server external http(s) download endpoint
	// In the form of [scheme]://[host]/path i.e https://cas.chainloop.dev/download
	// https://github.com/chainloop-dev/chainloop/blob/126f47b6c0803eac844b8e3e1a21d582f00e4dc6/app/artifact-cas/internal/service/download.go#L34
	DownloadUrl string `protobuf:"bytes,3,opt,name=download_url,json=downloadUrl,proto3" json:"download_url,omitempty"`
	// Default max size for each entry in the CAS backend
	// the format is a number followed by a unit, like 100MB, 1GB, etc
	// Default is 100MB
	DefaultEntryMaxSize string `protobuf:"bytes,4,opt,name=default_entry_max_size,json=defaultEntryMaxSize,proto3" json:"default_entry_max_size,omitempty"`
	// contains filtered or unexported fields
}

type Bootstrap_NatsServer struct {

	// Connection URI
	Uri string `protobuf:"bytes,1,opt,name=uri,proto3" json:"uri,omitempty"`
	// Types that are valid to be assigned to Authentication:
	//
	//	*Bootstrap_NatsServer_Token
	Authentication isBootstrap_NatsServer_Authentication `protobuf_oneof:"authentication"`
	// Number of replicas for JetStream KV buckets.
	// Defaults to 1. Maximum is 3. Set to 3 for production clusters.
	Replicas int32 `protobuf:"varint,3,opt,name=replicas,proto3" json:"replicas,omitempty"`
	// contains filtered or unexported fields
}

type Bootstrap_NatsServer_Token struct {
	// Token based authentication
	Token string `protobuf:"bytes,2,opt,name=token,proto3,oneof"`
}

type Bootstrap_Observability struct {
	Sentry  *Bootstrap_Observability_Sentry  `protobuf:"bytes,1,opt,name=sentry,proto3" json:"sentry,omitempty"`
	Tracing *Bootstrap_Observability_Tracing `protobuf:"bytes,2,opt,name=tracing,proto3" json:"tracing,omitempty"`
	// contains filtered or unexported fields
}

type Bootstrap_Observability_Sentry struct {
	Dsn         string `protobuf:"bytes,1,opt,name=dsn,proto3" json:"dsn,omitempty"`
	Environment string `protobuf:"bytes,2,opt,name=environment,proto3" json:"environment,omitempty"`
	// contains filtered or unexported fields
}

type Bootstrap_Observability_Tracing struct {

	// Whether tracing is enabled. Disabled by default for backward compatibility.
	Enabled bool `protobuf:"varint,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
	// OTLP gRPC exporter endpoint (e.g. "localhost:4317")
	Endpoint string `protobuf:"bytes,2,opt,name=endpoint,proto3" json:"endpoint,omitempty"`
	// Whether to use insecure connection (no TLS). Useful for local development.
	Insecure bool `protobuf:"varint,3,opt,name=insecure,proto3" json:"insecure,omitempty"`
	// Sampling ratio between 0.0 and 1.0. Defaults to 1.0 (sample everything) when unset.
	SamplingRatio *float64 `protobuf:"fixed64,4,opt,name=sampling_ratio,json=samplingRatio,proto3,oneof" json:"sampling_ratio,omitempty"`
	// contains filtered or unexported fields
}

type CA struct {

	// Types that are valid to be assigned to Ca:
	//
	//	*CA_FileCa
	//	*CA_EjbcaCa
	Ca isCA_Ca `protobuf_oneof:"ca"`
	// Marks this CA as the certificate issuer. If set to false, it will be used just for verification,
	// and considered obsolete (after a certificate rotation, for example).
	// Only one CA should have it set to `true` at a time.
	Issuer bool `protobuf:"varint,3,opt,name=issuer,proto3" json:"issuer,omitempty"`
	// contains filtered or unexported fields
}

type CA_EJBCA struct {
	ServerUrl string `protobuf:"bytes,1,opt,name=server_url,json=serverUrl,proto3" json:"server_url,omitempty"`
	// client cert authentication configuration
	KeyPath    string `protobuf:"bytes,2,opt,name=key_path,json=keyPath,proto3" json:"key_path,omitempty"`
	CertPath   string `protobuf:"bytes,3,opt,name=cert_path,json=certPath,proto3" json:"cert_path,omitempty"`
	RootCaPath string `protobuf:"bytes,4,opt,name=root_ca_path,json=rootCaPath,proto3" json:"root_ca_path,omitempty"`
	// EJBCA Profile configuration
	CertificateProfileName   string `` /* 129-byte string literal not displayed */
	EndEntityProfileName     string `protobuf:"bytes,6,opt,name=end_entity_profile_name,json=endEntityProfileName,proto3" json:"end_entity_profile_name,omitempty"`
	CertificateAuthorityName string `` /* 135-byte string literal not displayed */
	// contains filtered or unexported fields
}

type CA_EjbcaCa struct {
	EjbcaCa *CA_EJBCA `protobuf:"bytes,2,opt,name=ejbca_ca,json=ejbcaCa,proto3,oneof"`
}

type CA_FileCA struct {
	CertPath string `protobuf:"bytes,1,opt,name=cert_path,json=certPath,proto3" json:"cert_path,omitempty"`
	KeyPath  string `protobuf:"bytes,2,opt,name=key_path,json=keyPath,proto3" json:"key_path,omitempty"`
	KeyPass  string `protobuf:"bytes,3,opt,name=key_pass,json=keyPass,proto3" json:"key_pass,omitempty"`
	// contains filtered or unexported fields
}

type CA_FileCa struct {
	FileCa *CA_FileCA `protobuf:"bytes,1,opt,name=file_ca,json=fileCa,proto3,oneof"`
}

type Data struct {
	Database *Data_Database `protobuf:"bytes,1,opt,name=database,proto3" json:"database,omitempty"`
	// contains filtered or unexported fields
}

type Data_Database struct {
	Driver string `protobuf:"bytes,1,opt,name=driver,proto3" json:"driver,omitempty"`
	Source string `protobuf:"bytes,2,opt,name=source,proto3" json:"source,omitempty"`
	//  default 0
	MinOpenConns int32 `protobuf:"varint,3,opt,name=min_open_conns,json=minOpenConns,proto3" json:"min_open_conns,omitempty"`
	// default max(4, runtime.NumCPU())
	MaxOpenConns int32 `protobuf:"varint,4,opt,name=max_open_conns,json=maxOpenConns,proto3" json:"max_open_conns,omitempty"`
	// default: no limit, idle connections are not closed because of idle time
	MaxConnIdleTime *durationpb.Duration `protobuf:"bytes,5,opt,name=max_conn_idle_time,json=maxConnIdleTime,proto3" json:"max_conn_idle_time,omitempty"`
	// contains filtered or unexported fields
}

type FederatedAuthentication struct {

	// URL of the federated verification endpoint
	Url string `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
	// Whether to enable the federated verification
	Enabled bool `protobuf:"varint,2,opt,name=enabled,proto3" json:"enabled,omitempty"`
	// contains filtered or unexported fields
}

type OperationAuthorizationProvider struct {

	// URL of the authorization endpoint
	Url string `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
	// Whether to enable the operation authorization
	Enabled bool `protobuf:"varint,2,opt,name=enabled,proto3" json:"enabled,omitempty"`
	// authorized operations list
	Operations []string `protobuf:"bytes,3,rep,name=operations,proto3" json:"operations,omitempty"`
	// contains filtered or unexported fields
}

type PluginsNetworkPolicy struct {

	// Refuse to connect to destinations that are not publicly routable
	// (loopback, private ranges, cloud metadata endpoints) from the plugins
	// that accept an arbitrary target URL, currently the generic webhook and
	// Dependency-Track plugins.
	//
	// It defaults to false so that deployments running those services inside
	// their own network keep working. Plugins whose destination is a known
	// public service, such as the Slack and Discord webhooks, always refuse
	// non-public destinations regardless of this setting.
	BlockPrivateTargets bool `protobuf:"varint,1,opt,name=block_private_targets,json=blockPrivateTargets,proto3" json:"block_private_targets,omitempty"`
	// contains filtered or unexported fields
}

type PolicyProvider struct {
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// default policies will be used for schema-less references eg `my-policy`. Only one provider can be the default one
	Default bool `protobuf:"varint,2,opt,name=default,proto3" json:"default,omitempty"`
	// Host points to the policy API. Deprecated: use `url` instead if you want to provide both policies and groups.
	//
	// Deprecated: Marked as deprecated in controlplane/config/v1/conf.proto.
	Host string `protobuf:"bytes,3,opt,name=host,proto3" json:"host,omitempty"`
	// URL of the provider API, it will be used both for policies and groups. Example: https://my-server/policy-api
	Url string `protobuf:"bytes,4,opt,name=url,proto3" json:"url,omitempty"` // Note. Validations not applied not to break compatibility with current deployments
	// contains filtered or unexported fields
}

type PrometheusIntegrationSpec struct {
	OrgName string `protobuf:"bytes,1,opt,name=org_name,json=orgName,proto3" json:"org_name,omitempty"`
	// contains filtered or unexported fields
}

type Server struct {
	Http *Server_HTTP `protobuf:"bytes,1,opt,name=http,proto3" json:"http,omitempty"`
	Grpc *Server_GRPC `protobuf:"bytes,2,opt,name=grpc,proto3" json:"grpc,omitempty"`
	// HTTPMetrics defines the HTTP server that exposes prometheus metrics
	HttpMetrics *Server_HTTP `protobuf:"bytes,3,opt,name=http_metrics,json=httpMetrics,proto3" json:"http_metrics,omitempty"`
	// Legacy gRPC-only listener that serves native gRPC on its own port, next
	// to the single port that already serves gRPC, gRPC-Web and HTTP. It exists
	// for the deprecation period of docs/specs/issue-3628-single-endpoint.md.
	// Defaults to true when unset. Set it to false to listen on the single port
	// only, plus the internal metrics and profiler ports.
	LegacyGrpcListener *bool `protobuf:"varint,4,opt,name=legacy_grpc_listener,json=legacyGrpcListener,proto3,oneof" json:"legacy_grpc_listener,omitempty"`
	// contains filtered or unexported fields
}

type Server_GRPC struct {
	Network   string               `protobuf:"bytes,1,opt,name=network,proto3" json:"network,omitempty"`
	Addr      string               `protobuf:"bytes,2,opt,name=addr,proto3" json:"addr,omitempty"`
	Timeout   *durationpb.Duration `protobuf:"bytes,3,opt,name=timeout,proto3" json:"timeout,omitempty"`
	TlsConfig *Server_TLS          `protobuf:"bytes,4,opt,name=tls_config,json=tlsConfig,proto3" json:"tls_config,omitempty"`
	// Maximum size in bytes of received gRPC messages.
	// Defaults to 4MB (4194304) if not set. Use this to allow larger attestations.
	MaxRecvMsgSize int32 `protobuf:"varint,5,opt,name=max_recv_msg_size,json=maxRecvMsgSize,proto3" json:"max_recv_msg_size,omitempty"`
	// contains filtered or unexported fields
}

type Server_HTTP struct {
	Network string `protobuf:"bytes,1,opt,name=network,proto3" json:"network,omitempty"`
	Addr    string `protobuf:"bytes,2,opt,name=addr,proto3" json:"addr,omitempty"`
	// In the form of [scheme]://[host] i.e https://instance.chainloop.dev
	// Optional
	ExternalUrl string               `protobuf:"bytes,4,opt,name=external_url,json=externalUrl,proto3" json:"external_url,omitempty"`
	Timeout     *durationpb.Duration `protobuf:"bytes,5,opt,name=timeout,proto3" json:"timeout,omitempty"`
	// TLS for the single port, which serves gRPC, gRPC-Web and HTTP: the
	// listener negotiates HTTP/2 and HTTP/1.1 through ALPN. A partial
	// configuration (only one of certificate/private_key) is a startup
	// error. Note: server.http_metrics reuses this message type but does
	// not support TLS.
	TlsConfig *Server_TLS `protobuf:"bytes,6,opt,name=tls_config,json=tlsConfig,proto3" json:"tls_config,omitempty"`
	// contains filtered or unexported fields
}

type Server_TLS struct {

	// path to certificate and private key
	Certificate string `protobuf:"bytes,1,opt,name=certificate,proto3" json:"certificate,omitempty"`
	PrivateKey  string `protobuf:"bytes,2,opt,name=private_key,json=privateKey,proto3" json:"private_key,omitempty"`
	// contains filtered or unexported fields
}

type TSA struct {

	// TSA service URL for generating timestamps
	Url string `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
	// PEM encoded certificate chain (in leaf to root order)
	CertChainPath string `protobuf:"bytes,2,opt,name=cert_chain_path,json=certChainPath,proto3" json:"cert_chain_path,omitempty"`
	// Marks this TSA as the main timestamp issuer. Only one can be enabled at at ime.
	Issuer bool `protobuf:"varint,3,opt,name=issuer,proto3" json:"issuer,omitempty"`
	// contains filtered or unexported fields
}