# Copyright 2022 Canonical Ltd
# See LICENSE file for licensing details.
options:
  admin-agent-public-key:
    type: string
    default: ""
    description: |
      Base64 encoded 256-bit Ed25519 public key for admin agent.
  api-macaroon-timeout:
    type: string
    default: "48h"
    description: |
      The maximum age an API macaroon can get before requiring 
      re-authorization.
  discharge-macaroon-timeout:
    type: string
    default: "48h"
    description: |
      The maximum age a discharge macaroon can get before it becomes
      invalid.
  discharge-token-timeout:
    type: string
    default: "48h"
    description: |
      The maximum age a discharge token can get before it becomes
      invalid.
  enable-email-login:
    type: boolean
    default: false
    description: |
      Enable the "login with email address" functionality on the
      authentication required page.
  http-proxy:
    type: string
    default: ""
    description:
      Address of proxy to use for outgoing HTTP connections.
  identity-providers:
    type: string
    default: ""
    description: |
     This is a Base64 encoded YAML array
     containing the identity provider definition. See
     https://github.com/CanonicalLtd/candid/blob/master/docs/configuration.md#identity-providers-1
     for a full list of possible options.
  location:
    type: string
    default: ""
    description: |
      Publicly accessable URL of the identity manager (defaults to public
      address of unit).
  logging-config:
    type: string
    default: INFO
    description: Loggo logging configuration string.
  no-proxy:
    type: string
    default: ""
    description: |
      List of addresses that should not use the proxy specified in http-proxy.
      If specified this should be a comma-separated list of addresses.
  private-key:
    type: string
    default: ""
    description: Base64 encoded 256-bit Ed25519 private key of the server.
  public-key:
    type: string
    default: ""
    description: |
      Base64 encoded 256-bit Ed25519 public key, this should match the
      private key.
  redirect-login-trusted-urls:
    type: string
    default: ""
    description: |
      List of URLs that are trusted to return to when using the redirect
      login flow.
  redirect-login-trusted-domains:
    type: string
    default: ""
    description: |
      Comma separated list of domains for which all redirect paths
      are trusted. If a domain starts with "*." that is taken to be a
      wildcard and will match all subdomains of the specified domain.
  rendezvous-timeout:
    type: string
    default: "10m"
    description: |
      Amount of time that an interactive authentication request can
      be active before it is forgotten. The value must be a time duration
      specified as a decimal number followed by a unit from ns, us,
      ms, s, m, h for the time units between nanosecond and hour.
  skip-location-for-cookie-paths:
    type: boolean
    default: false
    description: |
      If true, it leaves cookies' Path value absolute, instead of
      seeting it relative to the path in the location config.
  mfa-rp-display-name:
    type: string
    default: ""
    description: |
      Display name for the multi-factor authentication relying party.
  mfa-rp-id:
    type: string
    default: ""
    description: |
      ID of the multi-factor authentication relying party 
      (usually the FQDN for your site).
  mfa-rp-origin:
    type: string
    default: ""
    description: |
      Origin of the multi-factor authentication WebAuthn requests.
