# Security Defaults - Security configuration defaults
# Version: 1.0.0
#
# Scenario: Security best practices and defaults
# Use case: Production-grade security configuration

{
  security_defaults = {
    security = {
      tls = {
        enabled = true,
        min_version = 'TLSv1.2,
        max_version = 'TLSv1.3,
        cipher_suites = [
          "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
          "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
          "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
          "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
        ],
        verify_client = false,
        auto_generate = false,
      },

      auth = {
        method = 'jwt,
        jwt = {
          secret = "changeme-use-strong-random-secret",
          algorithm = 'HS256,
          expiry_seconds = 3600,
          issuer = "api-service",
          audience = ["web-client", "mobile-client"],
        },
      },

      rbac = {
        roles = [
          {
            name = "admin",
            permissions = ["*"],
            resources = ["*"],
            actions = ['create, 'read, 'update, 'delete, 'list],
          },
          {
            name = "user",
            permissions = ["read:own", "write:own"],
            resources = ["users", "profiles"],
            actions = ['read, 'update],
          },
          {
            name = "guest",
            permissions = ["read:public"],
            resources = ["public"],
            actions = ['read],
          },
        ],
        default_role = "user",
        admin_role = "admin",
      },

      security_headers = {
        enable_hsts = true,
        hsts_max_age = 31536000,
        hsts_include_subdomains = true,
        enable_csp = true,
        csp_policy = "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self'",
        enable_xss_protection = true,
        enable_frame_options = true,
        frame_options_value = 'DENY,
        enable_content_type_nosniff = true,
        enable_referrer_policy = true,
        referrer_policy_value = 'strict-origin-when-cross-origin,
        custom_headers = {
          "Permissions-Policy" = "geolocation=(), microphone=(), camera=()",
          "X-Permitted-Cross-Domain-Policies" = "none",
        },
      },

      cors = {
        enabled = true,
        allowed_origins = ["https://example.com"],
        allowed_methods = ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
        allowed_headers = ["Content-Type", "Authorization", "X-Requested-With"],
        expose_headers = ["Content-Length", "X-Request-Id"],
        allow_credentials = true,
        max_age = 86400,
      },

      rate_limiting = {
        enabled = true,
        requests_per_second = 100,
        burst_size = 200,
        strategy = 'ip,
      },

      docker_secrets = [],
      kubernetes_secrets = [
        {
          name = "jwt-secret",
          type = 'Opaque,
          string_data = {
            JWT_SECRET = "changeme-use-strong-random-secret",
          },
        },
        {
          name = "tls-cert",
          type = 'kubernetes.io/tls,
          string_data = {
            "tls.crt" = "",
            "tls.key" = "",
          },
        },
      ],
    },
  },
}
