secrets.example.yaml

# Secrets configuration file for vc
# Copy this file to secrets.yaml and fill in real values.
# Referenced via common.secret_file_path in config.yaml.
# ApplySecrets updates the main config with values from this file:
# - Mongo URI: used only when the main config leaves it empty.
# - For each service section (apigw, registry, verifier) present here,
#   the corresponding secret fields in config are cleared and replaced.
#   Sections omitted from this file are left untouched in the config.
# Non-secret fields (TLS paths, etc.) should remain in the main config.
# Protect the real file with restrictive permissions (e.g., chmod 0600).
---
common:
  mongo:
    uri: "mongodb://user:password@mongo:27017"
  # ha.pubsub holds the Redis / Valkey ACL credentials for the HA pub/sub
  # bus. Backfilled into cfg.Common.HA.PubSub only when the main config
  # leaves the matching field empty, so you can keep the username/password
  # here instead of in config.yaml.
  # ha:
  #   pubsub:
  #     username: "<acl-username>"
  #     password: "<acl-password>"

apigw:
  api_server:
    api_auth:
      oidc:
        client_secret: "<your-oidc-client-secret>"
  auth_providers:
    oidc:
      registration:
        preconfigured:
          client_secret: "<your-oidc-client-secret>"
        # dynamic:
        #   initial_access_token: "<your-initial-access-token>"

registry:
  admin_gui:
    password: "<change-me>"

verifier:
  outbound:
    oidc_provider:
      subject_salt: "<random-salt-for-pairwise-subjects>"
      # static_clients maps client_id to client_secret for static OIDC OP clients.
      # Only clients whose client_id matches a static_clients entry in config.yaml
      # will have their secret applied.
      # static_clients:
      #   "my-client-id": "<client-secret>"