params:

  - name: ldap_user_home_dir
    type: string
    description: 'home directory of the LDAP user'
    essential: true
    value: '/fastone/users'
    env: LDAP_USER_HOME_DIRECTORY

  - name: ldap_user_login_shell
    type: string
    description: 'login shell of the LDAP user'
    value: '/bin/bash'
    essential: true
    env: LDAP_USER_LOGIN_SHELL

  - name: ymir_setup_admin_password
    type: string
    description: 'ymir setup时需要的password'
    value: '4nNX7ZWaUgKdTNj2'
    internal: true

  - name: admin_init_pwd
    type: string
    description: 'admin初始化默认密码'
    essential: true
    value: ''

  - name: ssh_port
    type: string
    description: "管理节点ssh服务端口"
    value: 22
    essential: true
    required: false

  - name: grafana_alert_admin_passwd
    type: string
    description: 'password of the grafana alert admin user'
    internal: true
    value: 'X7Eh@C20pw'

  - name: admin_email
    type: string
    description: 'email of the admin user'
    essential: true
    value: 'admin@fastonetech.com'
    env: ADMIN_EMAIL

  - name: max_file_size
    type: number
    description: 'maximum size of the file to be uploaded'
    value: '209715200'

  - name: max_sacct_result_lines
    type: number
    description: 'maximum lines of sacct result'
    value: 10000

  - name: internal_nodes
    type: string
    description: "internal nodes"
    internal: true
    value: |
      {{ if .ha_mode }}
        {{.fastone_mgmt_nodes}},common-2
      {{else}}
        {{.fastone_mgmt_nodes}}
      {{end}}

  - name: auth_type
    type: choices
    description: authentication type
    value: '{{ .auth_type }}'
    choices:
      - ldap
      - nis
      - ad
      - extern_ldap
    internal: true

  - name: auth_type_map
    type: object
    description: "internal: helper variable for mapping provider"
    value:
      ldap: "LOCAL"
      ad: "PAM"
      nis: "PAM"
      extern_ldap: "PAM"
    internal: true

  - name: oidc_enabled
    essential: true
    type: bool
    value: false
    description: |
      是否启用OpenID Connect（OIDC）以实现单点登录（SSO）。
      仅在使用内置LDAP时有效。

  - name: oidc_client_id
    essential: true
    type: string
    value: ''
    description: |
      OIDC客户端ID。
      仅在使用内置LDAP时有效。

  - name: oidc_client_secret
    essential: true
    type: string
    value: ''
    description: |
      OIDC客户端密钥。
      仅在使用内置LDAP时有效。

  - name: oidc_issuer_uri
    essential: true
    type: string
    value: ''
    description: |
      OIDC颁发者URI。
      仅在使用内置LDAP时有效。

  - name: session_validation_interval
    essential: true
    type: string
    value: '1H'
    description: |
      会话有效性验证频率。
      在OIDC中，为确保用户在应用程序中的会话与IDP中的会话同步，可以配置会话有效性验证频率。
      该配置允许应用程序定期向IDP发送验证请求，以确保用户在IDP处的会话仍然有效。
      如果IDP会话失效，则应用程序可以相应地使用户在应用程序中的会话也失效，从而提高安全性。
      此配置指定会话验证的时间间隔，默认为1小时。
      该配置仅在启用OIDC时有效。
      参考值：1H(1小时), 1D(1天)

  - name: license_monitor
    type: string
    description: 'license 监控配置'
    value: false
    env: LICENSE_MONITOR

  - name: license_app
    type: string
    description: 'license 支持的应用'
    value: 'ansys'
    env: LICENSE_APPS

  - name: license_server
    type: string
    description: 'license server地址, eg: 1055@192.168.18.58'
    value: ''
    env: LICENSE_SERVER

  - name: job_types
    type: choices
    essential: true
    description: 'job types: FASTONE_JOB or SCHEDULER_JOB or FASTONE_JOB,SCHEDULER_JOB'
    value: 'FASTONE_JOB'
    choices: [ "FASTONE_JOB", "SCHEDULER_JOB", "FASTONE_JOB,SCHEDULER_JOB" ]

  - name: storage_enabled
    essential: true
    type: string
    value: true

  - name: trust_sources
    type: string
    essential: true
    description: 'Trusted source IPs, the API will ignore the permission check. For example 10.0.0.1,10.0.0.2,10.0.0.3'
    value: '{{ .monitor_server_ip }}'

  - name: internal_api_cloud_vendor
    type: string
    internal: true
    value: |
      {{- if ymir.ContainsModule "cloud_rsrc" -}}
        {{ "{{ cloud_rsrc.provider_vendor }}" }}
      {{- else -}}
        AWS
      {{- end -}}

  - name: internal_api_deploy_mode
    type: string
    internal: true
    value: |
      {{ if not (ymir.ContainsModule "billing") }}
        FCP_PRIVATE
      {{ else }}
        {{ "{{ billing.billing_strategy }}_{{ .cloud_mode }}" }}
      {{ end }}

  - name: internal_api_fastone_strategy
    type: string
    internal: true
    value: |
      {{ if (ymir.ContainsModule "billing") }}
        {{ "{{ billing.billing_strategy }}" }}
      {{else}}
        FCP
      {{end}}

  - name: internal_api_product_level
    type: string
    internal: true
    value: |
      {{ if ymir.ContainsModule "billing" }}
        {{"{{ billing.billing_level }}"}}
      {{end}}

  - name: internal_api_fastone_region
    type: string
    internal: true
    value: |
      {{ if ymir.ContainsModule "billing" }}
        {{"{{ billing.fastone_region }}"}}
      {{end}}

  - name: internal_api_head_ha_enabled
    type: string
    internal: true
    value: |
      {{ if eq deploy.slurm_state_dir "" }}
        {{ "false" }}
      {{ else }}
        {{ "true" }}
      {{end}}

  - name: identity_importing_interval
    description: "(此配置仅在外置认证场景下有效)外置认证实体导入间隔. 参考值: 1D, 1H"
    essential: true
    type: string
    value: '1D'

  - name: identity_importing_lock_new
    description: "(此配置仅在外置认证场景下有效)是否锁定新导入的外置认证实体. 参考值: true, false"
    essential: true
    type: bool
    value: false

  - name: internal_api_svc
    description: "Api svc "
    internal: true
    type: string
    value: http://{{ ymir.IP }}:9000

  - name: internal_cluster_scheduler_svc
    description: "cluster-scheduler svc "
    internal: true
    type: string
    value: http://{{ ymir.IP }}:9300

  - name: enable_ssl
    description: "是否激活ssl认证. 参考值: true, false"
    essential: true
    type: bool
    value: false

  - name: ssl_server_name
    description: "ssl证书配置的的域名"
    essential: true
    type: string
    value: ''

  - name: ssl_cert_file
    description: "ssl认证证书(请提供绝对路径)"
    essential: true
    type: string
    value: ''

  - name: ssl_key_file
    description: "ssl认证证书对应的私钥(请提供绝对路径)"
    essential: true
    type: string
    value: ''

# ---

files:
  # provision files
  - path: '{{ .service_dir }}/fastone'
    source: 'fastone'

  - source: 'fastone/cluster-template/clusterTemplate.json'
    path: '{{ .service_dir }}/fastone/api/provisioning/clusterTemplate/clusterTemplate.json'

volumes:
  ui-assets-data:
    name: ui-assets-data
    driver: local
    driver_opts:
      o: bind
      type: none
      device: /{{ .service_dir }}/fastone/ui/assets/custom-data/

services:
  api:
    image: '{{ .containers.fastone_api.image }}:{{ .containers.fastone_api.version }}'
    container_name: fastone-api
    restart: 'always'
    network_mode: 'host'
    logging:
      driver: 'json-file'
      options:
        max-size: '10m'
        max-file: '5'
    volumes:
      - '/fastone:/fastone:rslave'
      - '/{{ .service_dir }}/fastone/api/provisioning:{{ .service_dir }}/fastone/api/provisioning'
      - '/{{ .service_dir }}/fastone/api/logs:/var/log/fastone'
      - '/{{ .fastone_homedir }}/.ssh/id_rsa:/home/fastone/.ssh/id_rsa:ro'
    changed:
      - '/{{ .service_dir }}/fastone/api/provisioning'
    environment:
      fastone.security.authentication.session.validation.interval: '{{ self.session_validation_interval }}'
      # exclude OAuth2ClientAutoConfiguration if oidc is disabled
      spring.autoconfigure.exclude: '{{ if not self.oidc_enabled }} org.springframework.boot.autoconfigure.security.oauth2.client.servlet.OAuth2ClientAutoConfiguration {{ end }}'
      fastone.security.authentication.oidc.enabled: '{{ self.oidc_enabled }}'
      spring.security.oauth2.client.registration.oidc.client-id: '{{ self.oidc_client_id }}'
      spring.security.oauth2.client.registration.oidc.client-secret: '{{ self.oidc_client_secret }}'
      spring.security.oauth2.client.registration.oidc.scope: 'openid, username, offline_access, email' # note this spring boot does not support pass list value by the following way [a, b, c]
      spring.security.oauth2.client.provider.oidc.user-name-attribute: 'username'
      spring.security.oauth2.client.provider.oidc.issuer-uri: '{{ self.oidc_issuer_uri }}'
      JWT_SECRET: '{{ .jwt_secret }}'
      api.storageEnabled: '{{ self.storage_enabled }}'
      api.ssh.address: '127.0.0.1'
      api.ssh.port: '2022'
      api.authProvider: '{{ get self.auth_type_map self.auth_type }}'
      api.authType: '{{ self.auth_type }}'
      api.cloudVendor: '{{ self.internal_api_cloud_vendor }}'
      api.deployMode: '{{ self.internal_api_deploy_mode }}'
      api.ldap.home-directory: '{{ self.ldap_user_home_dir }}'
      api.ldap.login-shell: '{{ self.ldap_user_login_shell }}'
      api.licenseMonitor: false
      api.maxFileSize: '{{ self.max_file_size }}'
      api.trial-mode: false
      api.version: '{{ .api_version }}'
      api.mgmtNodes: '{{ self.internal_nodes }}'
      api.slurmAccountingUrl: http://{{ .master_private_ip }}:3333/sacct
      api.adminPasswordForStackSetup: '{{ self.ymir_setup_admin_password }}'
      api.defaultAdminEmail: '{{ self.admin_email }}'
      api.headHaEnabled: '{{ self.internal_api_head_ha_enabled }}'
      api.slurmAccountingMaxResultSize: '{{ self.max_sacct_result_lines }}'
      api.jobTypes: '{{ self.job_types }}'
      api.auditEnabled: '{{ .audit_enabled }}'
      api.trustSources: '{{ self.trust_sources }}'
      api.adminInitPwd: '{{ self.admin_init_pwd }}'
      budget.password: 'admin'
      budget.username: csagent
      cluster.storageInfos[0].device: '{{ template "fastone_dir_path" . }}'
      cluster.storageInfos[0].dir: '{{ fastone_dir.mount_point }}'
      cluster.storageInfos[0].fstype: '{{ fastone_dir.mount_fstype }}'
      cluster.storageInfos[0].option: '{{ fastone_dir.mount_options }}'
      cluster.storageInfos[0].password: '{{ fastone_dir.mount_username }}'
      cluster.storageInfos[0].username: '{{ fastone_dir.mount_password }}'
      fa.host: '{{ ymir.IP }}'
      security.authProvider: '{{ get self.auth_type_map self.auth_type }}'
      # multi ldap url separate with comma
      spring.ldap.urls: '{{ ldap_params.ldap_uri | replace " " "," }}'
      spring.ldap.base: '{{ ldap_params.ldap_base }}'
      spring.ldap.username: '{{ ldap_params.ldap_admin_dn }}'
      spring.ldap.password: '{{ ldap_params.ldap_admin_passwd }}'
      api.fastoneStrategy: '{{ self.internal_api_fastone_strategy }}'
      api.productLevel: '{{ self.internal_api_product_level }}'
      api.fastoneRegion: '{{ self.internal_api_fastone_region }}'
      api.stackId: '{{ deploy.stack_id }}'
      monitoring.url: 'http://{{ .monitor_server_ip}}:9090'
      fastone.unix.identity.importing.interval: '{{ self.identity_importing_interval }}'
      fastone.unix.identity.importing.new-identity-locked: '{{ self.identity_importing_lock_new }}'
      management.zipkin.tracing.endpoint: 'http://{{ .monitor_server_ip }}:9411/api/v2/spans'
  #    depends_on:
  #      - db
  #      - redis

  ui:
    image: '{{ .containers.fastone_ui.image }}:{{ .containers.fastone_ui.version }}'
    container_name: fastone-ui
    restart: 'always'
    logging:
      driver: 'json-file'
      options:
        max-size: '10m'
        max-file: '5'
    #    depends_on:
    #      - api
    volumes:
      - '/{{ .service_dir }}/fastone/ui/data/:/usr/share/nginx/html/assets/apk/'
      - '/{{ .service_dir }}/fastone/ui/bill-view:/usr/share/nginx/html/bill-view'
      - 'ui-assets-data:/usr/share/nginx/html/assets/custom-data/'

  gateway:
    image: '{{ .containers.gateway.image }}:{{ .containers.gateway.version }}'
    container_name: gateway
    restart: 'always'
    logging:
      driver: 'json-file'
      options:
        max-size: '10m'
        max-file: '5'
    ports:
      - '80:80'
      - '443:443'
      - '8000:8000'
      - '8443:8443'
    #    depends_on:
    #      - fa
    #      - api
    #      - ui
    environment:
      JWT_SECRET: '{{ .jwt_secret }}'
      MASTER_PRIVATE_IP: '{{ ymir.IP }}'
      MONITOR_PRIVATE_IP: '{{  .monitor_server_ip }}'
      URD_REST_PORT: 19091
      ENABLE_SSL: '{{ self.enable_ssl }}'
      SERVER_NAME: '{{ self.ssl_server_name }}'
      CERT_FILE: '/etc/nginx/ssl/{{ self.ssl_server_name }}/server.crt'
      KEY_FILE: '/etc/nginx/ssl/{{ self.ssl_server_name }}/server.key'
    volumes:
      - '/{{ .service_dir }}/fastone/ui/data:/www/data/download'
      - '/{{ self.ssl_cert_file }}:/etc/nginx/ssl/{{ self.ssl_server_name }}/server.crt'
      - '/{{ self.ssl_key_file }}:/etc/nginx/ssl/{{ self.ssl_server_name }}/server.key'

  admin:
    image: '{{ .containers.fastone_admin.image }}:{{ .containers.fastone_admin.version }}'
    container_name: fastone-admin
    network_mode: 'host'
    restart: 'always'
    logging:
      driver: 'json-file'
      options:
        max-size: '10m'
        max-file: '5'
  alert:
    image: '{{ .containers.alert.image }}:{{ .containers.alert.version }}'
    container_name: alert
    restart: 'always'
    network_mode: 'host'
    logging:
      driver: 'json-file'
      options:
        max-size: '10m'
        max-file: '5'
    #    depends_on:
    #      - api
    environment:
      alert.config.recordWebhook: 'http://{{ ymir.IP }}:8085/api/v1/alertHistory'
      alert.config.haCommonServerInfo: '{{ .ha_common_server_info }}'
      alert.config.haMode: '{{ .ha_mode }}'
      JWT_SECRET: '{{ .jwt_secret }}'
      grafana.url: 'http://{{ .monitor_server_ip  }}:3002'
      api-svc.url: '{{ self.internal_api_svc }}'
      cluster-scheduler.url: '{{ self.internal_cluster_scheduler_svc }}'
      grafana.prometheusUrl: 'http://{{ .monitor_server_ip }}:9090'
      grafana.username: admin
      grafana.password: '{{ self.grafana_alert_admin_passwd }}'
      spring.datasource.url: jdbc:postgresql://{{ ymir.IP }}:5432/alert
      spring.datasource.username: sa
      spring.profiles.active: prod
      management.zipkin.tracing.endpoint: 'http://{{ .monitor_server_ip }}:9411/api/v2/spans'
    volumes:
      - '/{{ .service_dir }}/fastone/alert/logs:/var/log/fastone'

###############################################################################

# Before scripts
before_scripts:
  - 'bash spec/scripts/fastone-account.sh {{ .fastone_homedir }}'
  - 'bash spec/frontend/scripts/dm_handle.sh {{.service_dir}}'
  - 'mkdir -p /{{ .service_dir }}/fastone/ui/assets/custom-data/'
  - '{{if eq true self.enable_ssl }} spec/frontend/scripts/check-ssl.lua  {{end}}'

# After scripts
after_scripts:
  - 'spec/scripts/nfs-lock-check.lua'
  - 'spec/scripts/fastone-waitapi.lua'
  - '{{if eq true .ha_mode }} spec/frontend/scripts/refresh-cluster-ha-conf.lua  {{end}}'
  - '{{ if ne self.internal_api_deploy_mode "FCP_PRIVATE" }} spec/scripts/post-handle-after-startup.sh {{ self.internal_api_fastone_strategy }} {{ self.ymir_setup_admin_password }} {{ .cloud_mode }} {{end}}'
