# The default configuration for all upstreams.
# You can override these settings for each specific upstream as needed.
[upstream.defaults]
vars = {
  SCHEME = "https"  # Example variable to be injected into the plugins or scripts.
}

# Default configuration for the "customvault" upstream.
# You can also override settings for each specific tasks as needed.
[upstream.customvault]
envfile = "./examples/.env.cott.age" # Load environment variables from this encrypted file. Default is no env file.
requires = ["./examples/secrets/secret.json.cott.age"] # Decrypt these secrets before running pull/push (and clean them up afterwards).
vars = {  # Extra variables overwriting the env file.
  HOST = "customvault.example.com"
}

# Use any CLI tool or custom script to fetch secrets.
# Variables defined in this file and the secret metadata will be injected as environment variables.
# Print the fetched secret to stdout which will be piped to cottage for encryption.
# You can see the stderr by enabling debug mode with `ctg pull --debug`.
[upstream.customvault.pull]
vars = {
  OP = "/api/pull"
}
shell = "bash"  # Default is "sh". Use "bash" if you need features like variable interpolation.
script = """
URL="${SCHEME}://${HOST}${OP}${DESTINATION}"
echo "Auto injected cottage binary path is: '$ctg'" 1>&2
echo "Pulling secret from ${URL}..." 1>&2
echo "Writing the secret to stdout, which will be securely piped to cottage..." 1>&2
echo '{"SECRET": "A fresh value fetched from '${URL}'"}'
"""

# The decrypted secret will be securely piped to the script for pushing to the upstream.
# You can see the stderr by enabling debug mode with `ctg push --debug`.
[upstream.customvault.push]
vars = {
  OP = "/api/push"
}
shell = "bash"
script = '''
URL="${SCHEME}://${HOST}${OP}${DESTINATION}"
SECRET="$(cat /dev/stdin)"
echo "Auto injected cottage binary path is: '$ctg'" 1>&2
echo "Pushing secret '${SECRET}' to ${URL}..." 1>&2
'''

# Define another upstream named "kubevault" that uses a plugin to push/pull secrets.
# A plugin is any binary that takes "pull" or "push" as the first argument, reads env vars,
# reads the secret from stdin for "push", and outputs the secret to stdout for "pull".
# To manage secrets with this plugin, you need to add the following lines to the secret metadata:
# ```
# [upstream.kubevault]
# pull = true
# push = true
# vars = {
#   VAULT_SECRET_PATH = "myapp/config",
# }
# ```
[upstream.kubevault]
envfile = "./examples/.env.cott.age"  # Should export VAULT_TOKEN.
vars = {
  VAULT_MOUNT = "secrets",
  KUBE_NAMESPACE = "vault",
  KUBE_CONFIG_PATH = "./examples/secrets/secret.yaml",  # Will be auto-decrypted before running the plugin.
}
plugin = "./examples/plugins/cottage-plugin-vault-in-kubernetes.py"

# Similarly
[upstream.personalvault]
envfile = "./examples/.env.cott.age" # Should export VAULT_TOKEN.
vars = {
  VAULT_ADDR = "http://localhost:8200",
  VAULT_MOUNT = "secret",
}
plugin = "./examples/plugins/cottage-plugin-vault.py"

[upstream.awssecrets]
envfile = "./examples/.env.cott.age" # Should export AWS credentials.
vars = {
  AWS_SECRET_ID = "myapp/dev/secrets",
  AWS_REGION_NAME = "us-east-1",
}
plugin = "./examples/plugins/cottage-plugin-aws-secretsmanager.py"

[upstream.gcpsecrets]
envfile = "./examples/.env.cott.age" # Should export GCP credentials.
vars = {
  GCP_PROJECT = "my-gcp-project",
  GCP_SECRET_ID = "myapp-dev-secrets",
}
plugin = "./examples/plugins/cottage-plugin-gcp-secretmanager.py"

[upstream.doppler]
envfile = "./examples/.env.cott.age" # Should export DOPPLER_TOKEN.
vars = {
  DOPPLER_PROJECT = "my-project",
  DOPPLER_CONFIG = "dev",
}
plugin = "./examples/plugins/cottage-plugin-doppler.py"

[upstream.azurekeyvault]
envfile = "./examples/.env.cott.age" # Should export Azure credentials.
vars = {
  AZURE_KEYVAULT_URL = "https://my-keyvault.vault.azure.net/",
  AZURE_SECRET_NAME = "myapp-dev-secrets",
}
plugin = "./examples/plugins/cottage-plugin-azure-keyvault.py"

[upstream.onepassword]
envfile = "./examples/.env.cott.age" # Should export OP_SERVICE_ACCOUNT_TOKEN.
vars = {
  OP_VAULT_ID = "your-vault-uuid-here",
  OP_ITEM_TITLE = "myapp-dev-secrets",
}
plugin = "./examples/plugins/cottage-plugin-onepassword.py"

[upstream.bitwarden]
envfile = "./examples/.env.cott.age" # Should export BWS_ACCESS_TOKEN.
vars = {
  BW_SECRET_ID = "your-secret-uuid-here",
}
plugin = "./examples/plugins/cottage-plugin-bitwarden.py"

[upstream.zoho]
envfile = "./examples/.env.cott.age" # Should export ZOHO_CLIENT_ID, ZOHO_CLIENT_SECRET, ZOHO_REFRESH_TOKEN.
vars = {
  ZOHO_SECRET_ID = "1234567890",
  ZOHO_VAULT_URL = "https://vault.zoho.com",
}
plugin = "./examples/plugins/cottage-plugin-zoho-vault.py"

[upstream.pass]
vars = {
  PASS_SECRET_PATH = "myapp/dev/secrets",
  PASSWORD_STORE_DIR = "~/.password-store", # Optional override
}
plugin = "./examples/plugins/cottage-plugin-pass.py"

[upstream.dashlane]
vars = {
  DASHLANE_SECRET_ID = "your-secret-uuid-here",
}
plugin = "./examples/plugins/cottage-plugin-dashlane.py"

[upstream.ejson]
vars = {
  EJSON_PATH = "./examples/secrets.ejson",
}
plugin = "./examples/plugins/cottage-plugin-ejson.py"

[upstream.keyring]
vars = {
  KEYRING_SERVICE = "cottage-secrets",
  KEYRING_USERNAME = "myapp-dev",
}
plugin = "./examples/plugins/cottage-plugin-keyring.py"

[upstream.keeper]
envfile = "./examples/.env.cott.age" # Should export KSM_CONFIG.
vars = {
  KEEPER_RECORD_UID = "your-record-uid-here",
}
plugin = "./examples/plugins/cottage-plugin-keeper.py"

[upstream.lastpass]
vars = {
  LPASS_SECRET_NAME = "myapp/dev/secrets",
}
plugin = "./examples/plugins/cottage-plugin-lastpass.py"

[upstream.passhole]
vars = {
  PASSHOLE_SECRET_PATH = "myapp/dev/secrets",
}
plugin = "./examples/plugins/cottage-plugin-passhole.py"

[upstream.protonpass]
vars = {
  PROTON_ITEM_TITLE = "myapp-dev-secrets",
}
plugin = "./examples/plugins/cottage-plugin-protonpass.py"
