# Kibana. Mounted read-only; every secret arrives as an environment variable that configure.py generates
# into .env, so this file is committed and contains none.
#
# WHY SECURITY IS ON, AND WHY NOBODY SEES A LOGIN
# Elasticsearch runs with xpack.security.enabled=true because Kibana's Observability apps ask Elasticsearch
# whether the current user holds a privilege. With security off that API does not exist, and the
# Infrastructure / Metrics app fails on every page view with
#   no handler found for uri [/_security/user/_has_privileges]
# Turning it on would normally put a password prompt in front of Kibana, which this stack does not allow:
# Discord is the only login anywhere. So the anonymous provider below signs every visitor in automatically as
# one Elasticsearch user. The real gate is unchanged and is still the only one: Caddy's Authentik
# forward-auth plus the DIAG_REQUIRE_GROUP check on the diag host.
#
# This is not a permission tier. Everyone who clears that gate is the same Elasticsearch user with the same
# rights, exactly as before. The difference is that the identity now exists, which is what the apps need and
# what a read-only tier would later be built on (see STATUS.md 9b: add the http provider with the apikey
# scheme and have Caddy inject a key chosen by Authentik group).

server.host: "0.0.0.0"
server.publicBaseUrl: "https://${DIAG_HOST}"
# NO server.basePath. Kibana IS the root of the diag host, and the key must be ABSENT rather than empty:
# an empty string fails validation with "must start with a slash, don't end with one" and Kibana refuses to
# boot. It survived as an empty SERVER_BASEPATH env var only because the image drops empty values.
telemetry.optIn: false

elasticsearch.hosts: ["http://elasticsearch:9200"]
elasticsearch.username: "kibana_system"     # Kibana's own internal account, NOT what visitors become
elasticsearch.password: "${ES_KIBANA_PASSWORD}"

# Fixed keys: without them Kibana re-generates them on restart and loses saved objects (dashboards, rules).
xpack.encryptedSavedObjects.encryptionKey: "${KIBANA_ENCRYPTION_KEY}"
xpack.reporting.encryptionKey: "${KIBANA_ENCRYPTION_KEY}"
xpack.security.encryptionKey: "${KIBANA_ENCRYPTION_KEY}"

# The only provider, so there is no login page and no login selector: every request is already signed in.
xpack.security.authc.providers:
  anonymous.anonymous1:
    order: 0
    credentials:
      username: "${VG_DIAG_USER}"
      password: "${VG_DIAG_PASSWORD}"