cloud_controller_ng.yml.erb

<%
  require 'cgi'

  def discover_external_ip
    networks = spec.networks.marshal_dump
    network = networks.values.detect(&:default) || networks.values.first
    raise "Could not determine IP via network spec: #{networks}" unless network
    network.ip
  end

  def yaml_escape(input_string)
    chars_to_escape = /[:\\"\x00-\x1f\x7f]/
    chars_needing_quotes = /[ !#'&%*,:>@\[\]\\`{|}]/
    delimiter = (chars_needing_quotes.match(input_string) ||
              chars_to_escape.match(input_string)) ? '"' : ''
    fixed_string = input_string.gsub(/(#{chars_to_escape})/) { |m| "\\x#{'%x' % m.ord}" }

    "#{delimiter}#{fixed_string}#{delimiter}"
  end

  def validate_app_domains(app_domains)
    app_domains.each do |app_domain|
      if app_domain.is_a?(Hash) && app_domain['internal'] == true && app_domain.key?('router_group_name')
        raise 'Error for app_domains: Router groups cannot be specified for internal domains.'
      end
    end
  end

  def validate_database_encryption(current_key_label, keys)
    return if current_key_label.empty? && keys.empty?

    if keys.none? { | label, _ | label == current_key_label }
      raise "Error for database_encryption: 'current_key_label' set to '#{current_key_label}', but not present in 'keys' map."
    end
  end

  def extract_active_encryption_key_label(keys)
    return '' if keys.empty?
    active_keys = keys.select { |key| key['active'] }
    if active_keys.length == 1
      return active_keys.first['label']
    end
    raise "Error for database_encryption: #{active_keys.length} were marked active. Only one key may be active"
  end
%>
---
#Actually NGX host and port
<% if p('cc.nginx.ip').empty? %>
local_route: <%= discover_external_ip %>
<% else %>
local_route: <%= p('cc.nginx.ip') %>
<% end %>
external_port: <%= p("cc.external_port") %>
tls_port: <%= p("cc.tls_port") %>
internal_service_hostname: <%= p("cc.internal_service_hostname") %>
webserver: <%= p("cc.experimental.use_puma_webserver") ? 'puma' : 'thin' %>
puma:
  workers: <%= p("cc.puma.workers") %>
  max_threads: <%= p("cc.puma.max_threads") %>
<% if_p("cc.puma.max_db_connections_per_process") do |max_db_conn_per_process| %>
  max_db_connections_per_process: <%= max_db_conn_per_process %>
<% end %>
pid_filename: /var/vcap/data/cloud_controller_ng/cloud_controller_ng.pid
newrelic_enabled: <%= !!properties.cc.newrelic.license_key || p("cc.development_mode") %>
development_mode: <%= p("cc.development_mode") %>

external_protocol: <%= p("cc.external_protocol") %>
external_domain: <%= p("cc.external_host") %>.<%= p("system_domain") %>
temporary_disable_deployments: <%= p("cc.temporary_disable_deployments") %>

system_domain_organization: <%= p("system_domain_organization") %>
system_domain: <%= p("system_domain") %>
app_domains: <%=
  app_domains = p("app_domains").flatten
  validate_app_domains(app_domains)
  app_domains.to_json
%>

reserved_private_domains: <%= p("cc.reserved_private_domains", nil) %>
disable_private_domain_cross_space_context_path_route_sharing: <%= p("cc.disable_private_domain_cross_space_context_path_route_sharing", false) %>

jobs:
  enable_dynamic_job_priorities: <%= p("cc.jobs.enable_dynamic_job_priorities") %>
  global:
    timeout_in_seconds: <%= p("cc.jobs.global.timeout_in_seconds") %>
  <% if_p("cc.jobs.blobstore_delete.timeout_in_seconds") do |timeout| %>
  blobstore_delete:
    timeout_in_seconds: <%= timeout %>
  <% end %>
  <% if_p("cc.jobs.droplet_upload.timeout_in_seconds") do |timeout| %>
  droplet_upload:
    timeout_in_seconds: <%= timeout %>
  <% end %>
  <% if_p("cc.jobs.priorities") do |priorities| %>
  priorities: <%= priorities.to_json %>
  <% end %>

cpu_weight_min_memory: <%= p("cc.cpu_weight_min_memory") %>
cpu_weight_max_memory: <%= p("cc.cpu_weight_max_memory") %>
default_app_memory: <%= p("cc.default_app_memory") %>
default_app_disk_in_mb: <%= p("cc.default_app_disk_in_mb") %>
maximum_app_disk_in_mb: <%= p("cc.maximum_app_disk_in_mb") %>

default_app_log_rate_limit_in_bytes_per_second: <%= p("cc.default_app_log_rate_limit_in_bytes_per_second") %>

instance_file_descriptor_limit: <%= p("cc.instance_file_descriptor_limit") %>

request_timeout_in_seconds: <%= p("request_timeout_in_seconds") %>

nginx:
  use_nginx: true
  instance_socket: "/var/vcap/data/cloud_controller_ng/cloud_controller.sock"

index: <%= spec.index %>
name: <%= name %>
route_services_enabled: <%= !p("router.route_services_secret").empty? %>
volume_services_enabled: <%= p("cc.volume_services_enabled") %>

warn_if_below_min_cli_version: <%= p("cc.warn_if_below_min_cli_version") %>

info:
  name: "<%= p("name") %>"
  build: "<%= p("build") %>"
  version: <%= p("version") %>
  support_address: "<%= p("support_address") %>"
  description: "<%= p("description") %>"
  app_ssh_endpoint: <%= "ssh." + p("system_domain") + ":" + p("app_ssh.port").to_s %>
  app_ssh_host_key_fingerprint: <%= p("app_ssh.host_key_fingerprint", nil) %>
  app_ssh_oauth_client: <%= p("app_ssh.oauth_client_id") %>
  min_cli_version: <%= p("cc.min_cli_version", nil) %>
  min_recommended_cli_version: <%= p("cc.min_recommended_cli_version", nil) %>
<% if_p("cc.info.custom") do |custom| %>
  custom: <%= custom.to_json %>
<% end %>

directories:
  tmpdir: <%= p("cc.directories.tmpdir") %>
  diagnostics: <%= p("cc.directories.diagnostics") %>

logging:
  file: /var/vcap/sys/log/cloud_controller_ng/cloud_controller_ng.log
  syslog: vcap.cloud_controller_ng
  level: "<%= p("cc.logging_level") %>"
  max_retries: <%= p("cc.logging_max_retries") %>
  anonymize_ips: <%= p("cc.logging_anonymize_ips") %>
  format:
    timestamp: <%= p("cc.logging.format.timestamp") %>

<% if p("cc.telemetry_logging_enabled") %>
telemetry_log_path: /var/vcap/sys/log/cloud_controller_ng/telemetry.log
<% end %>

logcache:
  host: <%= p("cc.logcache.host") %>
  port: <%= p("cc.logcache.port") %>
  temporary_ignore_server_unavailable_errors: false

logcache_tls:
  key_file: /var/vcap/jobs/cloud_controller_ng/config/certs/logcache_tls.key
  cert_file: /var/vcap/jobs/cloud_controller_ng/config/certs/logcache_tls.crt
  ca_file: /var/vcap/jobs/cloud_controller_ng/config/certs/logcache_tls_ca.crt
  subject_name: <%= p("cc.logcache_tls.subject_name") %>

loggregator:
  router: <%= p("metron_endpoint.host") %>:<%= p("metron_endpoint.port") %>
  internal_url: <%= p("cc.loggregator.internal_url") %>

log_stream:
  url: https://log-stream.<%= p("system_domain") %>

log_cache:
  url: https://log-cache.<%= p("system_domain") %>

doppler:
  url: ws<%= "s" if p("doppler.use_ssl") %>://doppler.<%= p("system_domain") %>:<%= p("doppler.port") %>

<% db = p("ccdb.databases").find { |db| db["tag"] == "cc" } %>
<% db_role = p("ccdb.roles").find { |role| role["tag"] == "admin" } %>
<%
  database_address = nil
  if_p('ccdb.address') do |host|
    database_address = host
  end.else do
    database_address = link('database').instances[0].address
  end
%>

db: &db
  database:
    adapter: <%= p("ccdb.db_scheme") == "mysql" ? "mysql2" : p("ccdb.db_scheme") %>
    host: <%= database_address %>
    port: <%= p("ccdb.port") %>
    user: <%= db_role["name"] %>
    password: <%= yaml_escape(db_role["password"]) %>
    database: <%= db["name"] %>
  max_connections: <%= p("ccdb.max_connections") %>
  pool_timeout: <%= p("ccdb.pool_timeout") %>
  log_level: "<%= p("cc.db_logging_level") %>"
  log_db_queries: <%= p("cc.log_db_queries") %>
<% if_p("cc.query_size_log_threshold") do %>
  query_size_log_threshold: <%= p("cc.query_size_log_threshold") %>
<% end %>
  ssl_verify_hostname: <%= p("ccdb.ssl_verify_hostname") %>
  read_timeout: <%= p("ccdb.read_timeout") %>
  connection_validation_timeout: <%= p("ccdb.connection_validation_timeout") %>
<% if_p("ccdb.ca_cert") do %>
  ca_cert_path: "/var/vcap/jobs/cloud_controller_ng/config/certs/db_ca.crt"
<% end %>
<% if_p("ccdb.connection_expiration_timeout") do |expiration_timeout| %>
  connection_expiration_timeout: <%= expiration_timeout %>
<% end %>
<% if_p("ccdb.connection_expiration_random_delay") do |expiration_delay| %>
  connection_expiration_random_delay: <%= expiration_delay %>
<% end %>
<% if_p("ccdb.migration_psql_worker_memory_kb") do |psql_worker_memory_kb| %>
  migration_psql_worker_memory_kb: <%= psql_worker_memory_kb %>
<% end %>
  enable_paginate_window: <%= p("ccdb.enable_paginate_window") %>

<% scheme = p("login.protocol")
   system_domain = p("system_domain") %>

<% uaa_url = p("uaa.url", "#{scheme}://uaa.#{system_domain}")
   login_url = p("login.url", "#{scheme}://login.#{system_domain}") %>
max_migration_duration_in_minutes: <%= p("ccdb.max_migration_duration_in_minutes") %>
max_migration_statement_runtime_in_seconds: <%= p("ccdb.max_migration_statement_runtime_in_seconds") %>
migration_psql_concurrent_statement_timeout_in_seconds: <%= p("ccdb.migration_psql_concurrent_statement_timeout_in_seconds") %>
login:
  url: <%= p("login.enabled") ? login_url : uaa_url %>
uaa:
  url: <%= uaa_url %>
  internal_url: <%= "https://#{p("cc.uaa.internal_url")}:#{p("uaa.ssl.port")}" %>
  resource_id: <%= p("cc.uaa_resource_id") %>
  client_timeout: <%= p("cc.uaa.client_timeout")%>
  ca_file: /var/vcap/jobs/cloud_controller_ng/config/certs/uaa_ca.crt
  <% if_p("uaa.cc.token_secret") do |token_secret| %>
  symmetric_secret: "<%= token_secret %>"
  <% end %>
  <% if_p("uaa.cc.token_secret2") do |token_secret2| %>
  symmetric_secret2: "<%= token_secret2 %>"
  <% end %>

<% if p("routing_api.enabled") %>
routing_api:
  url: <%= "https://api.#{system_domain}/routing" %>
  routing_client_name: "cc_routing"
  routing_client_secret: <%= p("uaa.clients.cc_routing.secret") %>
<% end %>

<% if_link("credhub") do |credhub| %>
credhub_api:
  internal_url: <%= "https://#{p("credhub_api.hostname")}:#{credhub.p("credhub.port")}" %>
  <% if_p("credhub_api.external_url") do |url| %>
  external_url: <%= url %>
  <% end %>
  ca_cert_path: "/var/vcap/jobs/cloud_controller_ng/config/certs/credhub_ca.crt"
<% end %>

credential_references:
  interpolate_service_bindings: <%= p("cc.credential_references.interpolate_service_bindings") %>

# App staging parameters
staging:
  legacy_md5_buildpack_paths_enabled: <%= p("cc.legacy_md5_buildpack_paths_enabled") %>
  timeout_in_seconds: <%= p("cc.staging_timeout_in_seconds") %>
  minimum_staging_memory_mb: <%= p("dea_next.staging_memory_limit_mb") %>
  minimum_staging_disk_mb: <%= p("dea_next.staging_disk_limit_mb") %>
  minimum_staging_file_descriptor_limit: <%= p("cc.staging_file_descriptor_limit") %>
  auth:
    user: <%= p("cc.staging_upload_user") %>
    password: <%= yaml_escape(p("cc.staging_upload_password")) %>

default_health_check_timeout: <%= p("cc.default_health_check_timeout") %>
maximum_health_check_timeout: <%= p("cc.maximum_health_check_timeout") %>

stacks_file: /var/vcap/jobs/cloud_controller_ng/config/stacks.yml

shared_isolation_segment_name: <%= p("cc.shared_isolation_segment_name") %>

quota_definitions: <%= p("cc.quota_definitions").to_json %>
default_quota_definition: <%= p("cc.default_quota_definition") %>

resource_pool:
  blobstore_type: <%= p("cc.resource_pool.blobstore_type") %>
  webdav_config:
    blobstore_timeout: <%= p("cc.resource_pool.webdav_config.blobstore_timeout") %>
    public_endpoint: <%= p("cc.resource_pool.webdav_config.public_endpoint") %>
    private_endpoint: <%= p("cc.resource_pool.webdav_config.private_endpoint") %>
    username: <%= p("cc.resource_pool.webdav_config.username") %>
    password: <%= yaml_escape(p("cc.resource_pool.webdav_config.password")) %>
    <% if p("cc.resource_pool.webdav_config.ca_cert") != "" && p("cc.resource_pool.webdav_config.ca_cert") != nil %>
    ca_cert_path: "/var/vcap/jobs/cloud_controller_ng/config/certs/resource_pool_ca_cert.pem"
    <% end %>
  minimum_size: <%= p("cc.resource_pool.minimum_size") %>
  maximum_size: <%= p("cc.resource_pool.maximum_size") %>
  resource_directory_key: <%= p("cc.resource_pool.resource_directory_key") %>
  <% if_p("cc.resource_pool.cdn") do %>
  cdn:
    uri: <%= p("cc.resource_pool.cdn.uri") %>
    key_pair_id: <%= p("cc.resource_pool.cdn.key_pair_id") %>
    private_key: <%= p("cc.resource_pool.cdn.private_key").inspect %>
  <% end %>
  fog_connection: <%= p("cc.resource_pool.fog_connection", {}).to_json %>
  fog_aws_storage_options: <%= p("cc.resource_pool.fog_aws_storage_options", {}).to_json %>
  fog_gcp_storage_options: <%= p("cc.resource_pool.fog_gcp_storage_options", {}).to_json %>

packages:
  blobstore_type: <%= p("cc.packages.blobstore_type") %>
  webdav_config:
    blobstore_timeout: <%= p("cc.packages.webdav_config.blobstore_timeout") %>
    public_endpoint: <%= p("cc.packages.webdav_config.public_endpoint") %>
    private_endpoint: <%= p("cc.packages.webdav_config.private_endpoint") %>
    username: <%= p("cc.packages.webdav_config.username") %>
    password: <%= yaml_escape(p("cc.packages.webdav_config.password")) %>
    <% if p("cc.packages.webdav_config.ca_cert") != "" && p("cc.packages.webdav_config.ca_cert") != nil %>
    ca_cert_path: "/var/vcap/jobs/cloud_controller_ng/config/certs/packages_ca_cert.pem"
    <% end %>
  app_package_directory_key: <%= p("cc.packages.app_package_directory_key") %>
  max_valid_packages_stored: <%= p("cc.packages.max_valid_packages_stored") %>
  max_package_size: <%= p("cc.packages.max_package_size") %>
  <% if_p("cc.packages.cdn") do %>
  cdn:
    uri: <%= p("cc.packages.cdn.uri") %>
    key_pair_id: <%= p("cc.packages.cdn.key_pair_id") %>
    private_key: <%= p("cc.packages.cdn.private_key").inspect %>
  <% end %>
  fog_connection: <%= p("cc.packages.fog_connection", {}).to_json %>
  fog_aws_storage_options: <%= p("cc.packages.fog_aws_storage_options", {}).to_json %>
  fog_gcp_storage_options: <%= p("cc.packages.fog_gcp_storage_options", {}).to_json %>

droplets:
  blobstore_type: <%= p("cc.droplets.blobstore_type") %>
  webdav_config:
    blobstore_timeout: <%= p("cc.droplets.webdav_config.blobstore_timeout") %>
    public_endpoint: <%= p("cc.droplets.webdav_config.public_endpoint") %>
    private_endpoint: <%= p("cc.droplets.webdav_config.private_endpoint") %>
    username: <%= p("cc.droplets.webdav_config.username") %>
    password: <%= yaml_escape(p("cc.droplets.webdav_config.password")) %>
    <% if p("cc.droplets.webdav_config.ca_cert") != "" && p("cc.droplets.webdav_config.ca_cert") != nil %>
    ca_cert_path: "/var/vcap/jobs/cloud_controller_ng/config/certs/droplets_ca_cert.pem"
    <% end %>
  droplet_directory_key: <%= p("cc.droplets.droplet_directory_key") %>
  <% if_p("cc.droplets.cdn") do %>
  cdn:
    uri: <%= p("cc.droplets.cdn.uri") %>
    key_pair_id: <%= p("cc.droplets.cdn.key_pair_id") %>
    private_key: <%= p("cc.droplets.cdn.private_key").inspect %>
  <% end %>
  fog_connection: <%= p("cc.droplets.fog_connection", {}).to_json %>
  fog_aws_storage_options: <%= p("cc.droplets.fog_aws_storage_options", {}).to_json %>
  fog_gcp_storage_options: <%= p("cc.droplets.fog_gcp_storage_options", {}).to_json %>
  max_staged_droplets_stored: <%= p("cc.droplets.max_staged_droplets_stored") %>

buildpacks:
  blobstore_type: <%= p("cc.buildpacks.blobstore_type") %>
  webdav_config:
    blobstore_timeout: <%= p("cc.buildpacks.webdav_config.blobstore_timeout") %>
    public_endpoint: <%= p("cc.buildpacks.webdav_config.public_endpoint") %>
    private_endpoint: <%= p("cc.buildpacks.webdav_config.private_endpoint") %>
    username: <%= p("cc.buildpacks.webdav_config.username") %>
    password: <%= yaml_escape(p("cc.buildpacks.webdav_config.password")) %>
    <% if p("cc.buildpacks.webdav_config.ca_cert") != "" && p("cc.buildpacks.webdav_config.ca_cert") != nil %>
    ca_cert_path: "/var/vcap/jobs/cloud_controller_ng/config/certs/buildpacks_ca_cert.pem"
    <% end %>
  buildpack_directory_key: <%= p("cc.buildpacks.buildpack_directory_key") %>
  <% if_p("cc.buildpacks.cdn") do %>
  cdn:
    uri: <%= p("cc.buildpacks.cdn.uri") %>
    key_pair_id: <%= p("cc.buildpacks.cdn.key_pair_id") %>
    private_key: <%= p("cc.buildpacks.cdn.private_key").inspect %>
  <% end %>
  fog_connection: <%= p("cc.buildpacks.fog_connection", {}).to_json %>
  fog_aws_storage_options: <%= p("cc.buildpacks.fog_aws_storage_options", {}).to_json %>
  fog_gcp_storage_options: <%= p("cc.buildpacks.fog_gcp_storage_options", {}).to_json %>

db_encryption_key: <%= p("cc.db_encryption_key") %>

<% if_p("cc.database_encryption") do | database_encryption |
    keys = database_encryption['keys']
    if keys.is_a?(Array)
      current_key_label = extract_active_encryption_key_label(keys)
      keys = keys.reduce({}) do |result, key_hash|
       result[key_hash['label']] = key_hash['encryption_key']
       result
      end
    elsif keys.is_a?(Hash)
      current_key_label = database_encryption['current_key_label']
    end

    validate_database_encryption(current_key_label, keys) unless database_encryption['skip_validation']
%>

database_encryption:
  keys: <%= keys.to_json %>
  current_key_label: <%= current_key_label.inspect %>
  pbkdf2_hmac_iterations: <%= database_encryption['experimental_pbkdf2_hmac_iterations'] %>
<% end %>

disable_custom_buildpacks: <%= p("cc.disable_custom_buildpacks") %>

broker_client_timeout_seconds: <%= p("cc.broker_client_timeout_seconds") %>
broker_client_default_async_poll_interval_seconds: <%= p('cc.broker_client_default_async_poll_interval_seconds') %>
broker_client_max_async_poll_duration_minutes: <%= p('cc.broker_client_max_async_poll_duration_minutes') %>
broker_client_async_poll_exponential_backoff_rate:  <%= p('cc.broker_client_async_poll_exponential_backoff_rate') %>

broker_client_response_parser:
  log_errors: <%= p("cc.broker_client_response_parser.log_errors") %>
  log_validators: <%= p("cc.broker_client_response_parser.log_validators") %>
  log_response_fields: <%= p("cc.broker_client_response_parser.log_response_fields").to_json %>

renderer:
  max_results_per_page: <%= p("cc.renderer.max_results_per_page") %>
  default_results_per_page: <%= p("cc.renderer.default_results_per_page") %>
  max_inline_relations_depth: <%= p("cc.renderer.max_inline_relations_depth") %>
  <% if_p("cc.renderer.max_total_results") do |max_total_results| %>
  max_total_results: <%= max_total_results %>
  <% end %>

<% if_p("uaa.clients.cc-service-dashboards.secret") do %>
uaa_client_name: "cc-service-dashboards"
uaa_client_secret: <%= p("uaa.clients.cc-service-dashboards.secret") %>
uaa_client_scope: <%= p("uaa.clients.cc-service-dashboards.scope") %>
<% end %>

cloud_controller_username_lookup_client_name: "cloud_controller_username_lookup"
cloud_controller_username_lookup_client_secret: <%= p("uaa.clients.cloud_controller_username_lookup.secret") %>

cc_service_key_client_name: "cc_service_key_client"
cc_service_key_client_secret: <%= p("uaa.clients.cc_service_key_client.secret") %>

allow_app_ssh_access: <%= p("cc.allow_app_ssh_access") %>
default_app_ssh_access: <%= p("cc.default_app_ssh_access") %>

app_log_revision: <%= p("cc.app_log_revision") %>

skip_cert_verify: <%= p("ssl.skip_cert_verify") %>

install_buildpacks: <%= p("cc.install_buildpacks").to_json %>

app_bits_upload_grace_period_in_seconds: <%= p("cc.app_bits_upload_grace_period_in_seconds") %>

log_audit_events: <%= p("cc.log_audit_events") %>

security_group_definitions: <%= p("cc.security_group_definitions").to_json %>
default_running_security_groups: <%= p("cc.default_running_security_groups").to_json %>
default_staging_security_groups: <%= p("cc.default_staging_security_groups").to_json %>
security_groups:
  enable_comma_delimited_destinations: <%= p("cc.security_groups.enable_comma_delimited_destinations") %>

allowed_cors_domains: <%= p("cc.allowed_cors_domains").to_json %>

statsd_host: <%= p("cc.statsd_host") %>
statsd_port: <%= p("cc.statsd_port") %>
enable_statsd_metrics: <%= p("cc.enable_statsd_metrics") %>

security_event_logging:
  enabled: <%= p("cc.security_event_logging.enabled") %>
  file: /var/vcap/sys/log/cloud_controller_ng/security_events.log

system_hostnames: <%= p("cc.system_hostnames") %>

<% instances = p("cc.rate_limiter.enabled") ? link("cloud_controller").instances.length : 1 %>
rate_limiter:
  enabled: <%= p("cc.rate_limiter.enabled") %>
  global_general_limit: <%= p("cc.rate_limiter.general_limit") %>
  per_process_general_limit: <%= (p("cc.rate_limiter.general_limit").to_f/instances).ceil %>
  global_unauthenticated_limit: <%= p("cc.rate_limiter.unauthenticated_limit") %>
  per_process_unauthenticated_limit: <%= (p("cc.rate_limiter.unauthenticated_limit").to_f/instances).ceil %>
  reset_interval_in_minutes: <%= p("cc.rate_limiter.reset_interval_in_minutes") %>

max_concurrent_service_broker_requests: <%= p("cc.max_concurrent_service_broker_requests") %>

<% instances = p("cc.rate_limiter_v2_api.enabled") ? link("cloud_controller").instances.length : 1 %>
rate_limiter_v2_api:
  enabled: <%= p("cc.rate_limiter_v2_api.enabled") %>
  global_general_limit: <%= p("cc.rate_limiter_v2_api.general_limit") %>
  per_process_general_limit: <%= (p("cc.rate_limiter_v2_api.general_limit").to_f/instances).ceil %>
  global_admin_limit: <%= p("cc.rate_limiter_v2_api.admin_limit") %>
  per_process_admin_limit: <%= (p("cc.rate_limiter_v2_api.admin_limit").to_f/instances).ceil %>
  reset_interval_in_minutes: <%= p("cc.rate_limiter_v2_api.reset_interval_in_minutes") %>

<% if p("cc.experimental.use_puma_webserver") || p("cc.experimental.use_redis") %>
redis:
  socket: "/var/vcap/data/valkey/valkey.sock"
<% end %>

<%
cc_uploader_url = nil
if_link("cc_uploader") do |cc_uploader|
  cc_uploader_url = "https://#{cc_uploader.p("internal_hostname")}:#{cc_uploader.p("https_port")}"
end.else do
  cc_uploader_url = p("cc.diego.cc_uploader_https_url")
end

file_server_url = p("cc.diego.file_server_url")
if_link("file_server") do |file_server|
  if file_server.p("https_server_enabled")
    file_server_url = file_server.p("https_url")
  end
end
%>

diego:
  bbs:
    url: <%= p("cc.diego.bbs.url") %>
    key_file: /var/vcap/jobs/cloud_controller_ng/config/certs/mutual_tls.key
    cert_file: /var/vcap/jobs/cloud_controller_ng/config/certs/mutual_tls.crt
    ca_file: /var/vcap/jobs/cloud_controller_ng/config/certs/mutual_tls_ca.crt
    connect_timeout: <%= p("cc.diego.bbs.connect_timeout") %>
    send_timeout: <%= p("cc.diego.bbs.send_timeout") %>
    receive_timeout: <%= p("cc.diego.bbs.receive_timeout") %>
  cc_uploader_url: <%= cc_uploader_url %>
  docker_staging_stack: <%= p("cc.diego.docker_staging_stack") %>
  file_server_url: <%= file_server_url %>
  insecure_docker_registry_list: <%= p("cc.diego.insecure_docker_registry_list") %>
  lifecycle_bundles: <%= p("cc.diego.lifecycle_bundles").to_json %>
  droplet_destinations: <%= p("cc.diego.droplet_destinations").to_json %>
  pid_limit: <%= p("cc.diego.pid_limit") %>
  temporary_oci_buildpack_mode: <%= p("cc.diego.temporary_oci_buildpack_mode", nil) %>
  enable_declarative_asset_downloads: <%= p("cc.diego.enable_declarative_asset_downloads") %>
  use_privileged_containers_for_running: <%= p("cc.diego.use_privileged_containers_for_running") %>
  use_privileged_containers_for_staging: <%= p("cc.diego.use_privileged_containers_for_staging") %>

perm:
  enabled: false

max_labels_per_resource: <%= p("cc.max_labels_per_resource") %>
max_annotations_per_resource: <%= p("cc.max_annotations_per_resource") %>

<%
  internal_vip_range =  p("cc.internal_route_vip_range")
  raise StandardError.new("invalid cc.internal_route_vip_range: #{internal_vip_range}") unless internal_vip_range =~ /\A (?:\d{1,3}\.){3} \d{1,3} \/ \d{1,3} \z/x

  parts = internal_vip_range.split(/[\.\/]/).map(&:to_i)
  raise StandardError.new("invalid cc.internal_route_vip_range: #{internal_vip_range}") if parts[0..3].any? {|x| x > 255} || parts[4] > 32
%>

internal_route_vip_range: <%= internal_vip_range %>

threadpool_size: <%= p("cc.experimental.thin_server.thread_pool_size") %>

default_app_lifecycle: buildpack
custom_metric_tag_prefix_list: <%= p("cc.custom_metric_tag_prefix_list") %>
update_metric_tags_on_rename: <%= p("cc.update_metric_tags_on_rename") %>