app-config.yaml

# Backstage override configuration for your local development environment
app:
  title: SourceFuse Backstage
  baseUrl: ${FRONTEND_BASE_URL}

organization:
  name: SourceFuse

backend:
  # Used for enabling authentication, secret is shared by all backend plugins
  # See backend-to-backend-auth.md in the docs for information on the format
  # auth:
  #   keys:
  #     - secret: ${BACKEND_SECRET}
  baseUrl: ${BASE_URL}
  listen:
    port: 7007
  csp:
    connect-src: ["'self'", 'http:', 'https:']
    img-src: ['*', 'data:']
    # Allow Grafana dashboards to be embedded in iframes
    frame-src: ["'self'", 'http:', 'https:']
    # Content-Security-Policy directives follow the Helmet format: https://helmetjs.github.io/#reference
    # Default Helmet Content-Security-Policy values can be removed by setting the key to false
  cors:
    origin: /^http:\/\/(localhost|127\.0\.0\.1|sf-portal\.sourcef\.us)(:\d+)?$/
    methods: [GET, POST, PUT, DELETE]
    credentials: true
  database:
    # config options: https://node-postgres.com/api/client
    client: pg
    connection:
      host: ${POSTGRES_HOST}
      port: ${POSTGRES_PORT}
      user: ${POSTGRES_USER}
      password:
        ${POSTGRES_PASSWORD}
        # https://node-postgres.com/features/ssl
      #ssl: require # see https://www.postgresql.org/docs/current/libpq-ssl.html Table 33.1. SSL Mode Descriptions (e.g. require)
      #ca: # if you have a CA file and want to verify it you can uncomment this section
      #$file: <file-path>/ca/server.crt
  cache:
    store: memory
  # workingDirectory: /tmp # Use this to configure a working directory for the scaffolder, defaults to the OS temp-dir

integrations:
  github:
    - host: github.com
      apiBaseUrl: https://api.github.com
      token: ${GITHUB_TOKEN}
      orgs: [sourcefuse]
      # Rate limit protection - wait when approaching limit
      rateLimit:
        window: 1h
        max: 4500 # Leave buffer below 5000/hour limit
      apps:
        - appId: ${INTEGRATION_GITHUB_APP_ID}
          webhookUrl: ${INTEGRATION_GITHUB_WEBHOOK_URL}
          clientId: ${INTEGRATION_GITHUB_CLIENT_ID}
          clientSecret: ${INTEGRATION_GITHUB_CLIENT_SECRET}
          webhookSecret: ${INTEGRATION_GITHUB_WEBHOOK_SECRET}
          privateKey:
            $file: ./github_private_key.pem
          # signIn:
          #   resolvers:
          #     - resolver: usernameMatchingUserEntityName

# Reference documentation http://backstage.io/docs/features/techdocs/configuration
# Note: After experimenting with basic setup, use CI/CD to generate docs
# and an external cloud storage when deploying TechDocs for production use-case.
# https://backstage.io/docs/features/techdocs/how-to-guides#how-to-migrate-from-techdocs-basic-to-recommended-deployment-approach
techdocs:
  builder: 'local' # Alternatives - 'external'
  generator:
    runIn: 'local' # Alternatives - 'local'
  publisher:
    type: 'local' # Alternatives - 'googleGcs' or 'awsS3'. Read documentation for using alternatives.
  # Cache docs to reduce GitHub API errors for inaccessible repositories
  cache:
    ttl: 3600000 # Cache for 1 hour (in milliseconds)
    readTimeout: 5000 # Timeout after 5 seconds

# auth:
#   # see https://backstage.io/docs/auth/ to learn about auth providers
#   environment: production
#   providers:
#     github:
#       production:
#         clientId: ${AUTH_GITHUB_CLIENT_ID}
#         clientSecret: ${AUTH_GITHUB_CLIENT_SECRET}
#         #below lines are extra in new backend system
#         # signIn:
#         #   resolvers:
#         #     - resolver: usernameMatchingUserEntityName
#     # See https://backstage.io/docs/auth/guest/provider
#     guest: {}
auth:
  environment: development
  providers:
    github:
      development:
        clientId: ${AUTH_GITHUB_CLIENT_ID}
        clientSecret: ${AUTH_GITHUB_CLIENT_SECRET}
        organization: 'sourcefuse'
        ## uncomment if using GitHub Enterprise
        # enterpriseInstanceUrl: ${AUTH_GITHUB_ENTERPRISE_INSTANCE_URL}
        signIn:
          resolvers:
            - resolver: usernameMatchingUserEntityName

scaffolder:
# see https://backstage.io/docs/features/software-templates/configuration for software template options

proxy:
  endpoints:
    '/sonarqube':
      target: https://sonarcloud.io/api
      allowedMethods: ['GET']
      auth: '${SONARCLOUD_TOKEN}:'
      credentials: require

    '/newrelic/apm/api':
      target: https://api.newrelic.com/v2
      headers:
        X-Api-Key: ${NEW_RELIC_USER_KEY}
      allowedHeaders:
        - link

    '/newrelic/api':
      target: https://api.newrelic.com
      headers:
        X-Api-Key: ${NEW_RELIC_USER_KEY}

    '/jira/api':
      target: https://sourcefuse.atlassian.net
      headers:
        Authorization: Basic ${JIRA_TOKEN}
        Accept: application/json
        Content-Type: application/json
        X-Atlassian-Token: no-check
        User-Agent: Backstage

# Required by @backstage-community/plugin-grafana config schema.
# We use our own backend proxy for actual Grafana queries, so this domain
# is only used for the annotation-based dashboard/alert cards (not the tab).
grafana:
  domain: ${GRAFANA_URL}
  unifiedAlerting: false

jira:
  baseUrl: https://sourcefuse.atlassian.net
  token: ${JIRA_TOKEN}

jenkins:
  instances:
    - name: default
      baseUrl: ${JENKINS_BASEURL1}
      username: ${JENKINS_USERNAME1}
      projectCountLimit: ${JENKINS_PROJECTCOUNTLIMIT1}
      apiKey: ${JENKINS_API_TOKEN1}

catalog:
  providers:
    githubOrg:
      - id: production
        githubUrl: 'https://github.com'
        orgs: ['sourcefuse']
        schedule:
          initialDelay: { seconds: 30 }
          frequency: { hours: 24 }
          timeout: { minutes: 15 }
  # github catalog auto-discovery disabled to prevent GitHub API rate limit issues
  # providers:
  #   github:
  #     providerId:
  #       organization: 'sourcefuse'
  #       catalogPath: '/catalog-info.yaml'
  #       filters:
  #         branch: 'main'
  #         repository: '^(?!biz-book-api$).*'
  #       schedule:
  #         initialDelay: { seconds: 30 }
  #         frequency: { hours: 3 }
  #         timeout: { minutes: 15 }

  rules:
    - allow: [Component, System, API, Group, User, Resource, Location, Template]
  locations:
    # AI Check UT Quality template
    - type: url
      target: https://github.com/sourcefuse/ai-test-quality-analyzer/blob/CheckUnitTestCases/scaffolder/ut-quality-workflow/template.yaml
      rules:
        - allow: [Template]

    # AI Generate UT Cases template
    - type: url
      target: https://github.com/sourcefuse/ai-test-quality-analyzer/blob/GenerateUnitTestCases/scaffolder/generate-ut-workflow/template.yaml
      rules:
        - allow: [Template]

    # Backstage example templates
    - type: url
      target: https://github.com/backstage/software-templates/blob/main/scaffolder-templates/react-ssr-template/template.yaml
      rules:
        - allow: [Template]

    - type: url
      target: https://github.com/backstage/software-templates/blob/main/scaffolder-templates/docs-template/template.yaml
      rules:
        - allow: [Template]

    - type: url
      target: https://github.com/backstage/software-templates/blob/main/scaffolder-templates/create-react-app/template.yaml
      rules:
        - allow: [Template]

    - type: url
      target: https://github.com/sourcefuse/sf-software-templates/blob/main/scaffolder-templates/microservice-repo-bootstrap/template.yaml
      rules:
        - allow: [Template]

    - type: url
      target: https://github.com/sourcefuse/typescript-lambda-boilerplate/blob/main/templates/api-gw-lambda.yaml
      rules:
        - allow: [Template]

    - type: url
      target: https://github.com/sourcefuse/arc-mono-repo-infra-template/blob/main/templates/template.yaml
      rules:
        - allow: [Template]

    - type: url
      target: https://github.com/sourcefuse/terraform-aws-arc-cloudfront/blob/main/catalog-info.yaml
      rules:
        - allow: [Component]
      tags: [Backend]

    - type: url
      target: https://github.com/sourcefuse/terraform-k8s-app/blob/main/catalog-info.yaml
      rules:
        - allow: [Component]
      tags: [Backend]

    - type: url
      target: https://github.com/sourcefuse/terraform-aws-arc-db/blob/main/catalog-info.yaml
      rules:
        - allow: [Component]

    - type: url
      target: https://github.com/sourcefuse/terraform-aws-arc-tags/blob/main/catalog-info.yaml
      rules:
        - allow: [Component]

    - type: url
      target: https://github.com/sourcefuse/terraform-sourceloop-apps/blob/main/catalog-info.yml
      rules:
        - allow: [Component]

    - type: url
      target: https://github.com/sourcefuse/terraform-aws-arc-cloudfront/blob/main/catalog-info.yaml
      rules:
        - allow: [Component]

    - type: url
      target: https://github.com/sourcefuse/terraform-aws-arc-ecs/blob/main/catalog-info.yaml
      rules:
        - allow: [Component]

    - type: url
      target: https://github.com/sourcefuse/terraform-aws-arc-network/blob/main/catalog-info.yml
      rules:
        - allow: [Component]

    - type: url
      target: https://github.com/sourcefuse/terraform-aws-arc-eks/blob/main/catalog-info.yml
      rules:
        - allow: [Component]

    - type: url
      target: https://github.com/sourcefuse/terraform-aws-arc-bootstrap/blob/main/catalog-info.yml
      rules:
        - allow: [Component]

    - type: url
      target: https://github.com/sourcefuse/terraform-aws-arc-cloud-custodian/blob/main/catalog-info.yml
      rules:
        - allow: [Component]

    - type: url
      target: https://github.com/sourcefuse/terraform-aws-arc-opensearch/blob/main/catalog-info.yml
      rules:
        - allow: [Component]

    - type: url
      target: https://github.com/sourcefuse/loopback4-vault/blob/master/catalog-info.yaml
      rules:
        - allow: [Component]

    - type: url
      target: https://github.com/sourcefuse/loopback4-s3/blob/master/catalog-info.yaml
      rules:
        - allow: [Component]

    - type: url
      target: https://github.com/sourcefuse/loopback4-audit-log/blob/master/catalog-info.yaml
      rules:
        - allow: [Component]

    - type: url
      target: https://github.com/sourcefuse/loopback4-notifications/blob/master/catalog-info.yaml
      rules:
        - allow: [Component]

    - type: url
      target: https://github.com/sourcefuse/loopback4-helmet/blob/master/catalog-info.yaml
      rules:
        - allow: [Component]

    - type: url
      target: https://github.com/sourcefuse/loopback4-soft-delete/blob/master/catalog-info.yaml
      rules:
        - allow: [Component]

    - type: url
      target: https://github.com/sourcefuse/loopback4-kafka-client/blob/master/catalog-info.yaml
      rules:
        - allow: [Component]

    - type: url
      target: https://github.com/sourcefuse/loopback4-ratelimiter/blob/master/catalog-info.yaml
      rules:
        - allow: [Component]

    - type: url
      target: https://github.com/sourcefuse/loopback4-authorization/blob/master/catalog-info.yaml
      rules:
        - allow: [Component]

    - type: url
      target: https://github.com/sourcefuse/loopback4-authentication/blob/master/catalog-info.yaml
      rules:
        - allow: [Component]

    - type: url
      target: https://github.com/sourcefuse/telemed-app-api/blob/main/template.yaml
      rules:
        - allow: [Template]

    # Backstage self-registration via GitHub
    - type: url
      target: https://github.com/sourcefuse/backstage/blob/main/catalog-info.yaml
      rules:
        - allow: [Component, System, API, Group, User, Resource, Location]

    - type: file
      target: ../../examples/entities.yaml
      rules:
        - allow: [Component, System, API, Group, User, Resource]

    - type: url
      target: https://github.com/sourcefuse/biz-book-api/blob/dev/catalog-info.yaml
      rules:
        - allow: [Component, API, System, Resource, Group, User, Location]

# kubernetes:
# see https://backstage.io/docs/features/kubernetes/configuration for kubernetes configuration options
# see https://backstage.io/docs/permissions/getting-started for more on the permission framework