# Common Security Schema
# Shared security configuration for all services

{
  tls_enabled | Bool | doc "Enable TLS for all connections" | default = false,
  tls_cert_path | String | doc "Path to TLS certificate file" | default = "/etc/certs/tls.crt",
  tls_key_path | String | doc "Path to TLS private key file" | default = "/etc/certs/tls.key",

  auth = {
    enabled | Bool | doc "Enable authentication" | default = true,
    method | String | doc "Auth method: jwt, oauth2, mfa" | default = "jwt",
  },

  audit = {
    enabled | Bool | doc "Enable audit logging" | default = false,
    log_path | String | doc "Audit log file path" | default = "/var/log/audit.log",
  },
}
