{
  "dev_limits": {
    "max_cpu_cores_per_user": 32,
    "max_memory_gb_per_user": 128,
    "max_servers_per_user": 10,
    "max_storage_gb_per_user": 500
  },
  "local_extensions": {
    "allow_mixed": true,
    "local_path": "./provisioning/extensions",
    "source": "local"
  },
  "minimal_security": {
    "audit_logging": false,
    "dns_modification": "none",
    "encryption_at_rest": false,
    "encryption_in_transit": false,
    "network_isolation": false,
    "secret_provider": {
      "provider": "sops"
    }
  },
  "mtls_auth": {
    "auth_type": "mtls",
    "mtls_config": {
      "ca_cert_path": "/etc/provisioning/certs/ca.crt",
      "client_cert_path": "/etc/provisioning/certs/client.crt",
      "client_key_path": "/etc/provisioning/certs/client.key",
      "verify_server": true
    },
    "ssh_key_storage": "kms"
  },
  "no_auth": {
    "auth_type": "none",
    "ssh_key_storage": "local"
  },
  "no_locking": {
    "git_integration": "optional",
    "isolation": "none",
    "locking": "disabled"
  },
  "oci_extensions": {
    "oci_registry": {
      "auth_token_path": "~/.provisioning/tokens/oci",
      "cache_dir": "~/.provisioning/oci-cache",
      "enabled": true,
      "endpoint": "harbor.company.local",
      "namespace": "provisioning-extensions",
      "tls_enabled": true,
      "verify_ssl": true
    },
    "source": "oci"
  },
  "prod_limits": {
    "max_cpu_cores_per_user": 64,
    "max_memory_gb_per_user": 256,
    "max_servers_per_user": 20,
    "max_storage_gb_per_user": 1000,
    "max_total_cpu_cores": 2000,
    "max_total_memory_gb": 8192,
    "max_total_servers": 500
  },
  "standard_security": {
    "audit_log_path": "/var/log/provisioning/audit.log",
    "audit_logging": true,
    "dns_modification": "coredns",
    "encryption_at_rest": false,
    "encryption_in_transit": true,
    "network_isolation": false,
    "secret_provider": {
      "provider": "sops"
    }
  },
  "strict_locking": {
    "git_integration": "required",
    "isolation": "strict",
    "lock_provider": "etcd",
    "locking": "required",
    "max_workspaces_per_user": 3
  },
  "strict_security": {
    "audit_log_path": "/var/log/provisioning/enterprise-audit.log",
    "audit_logging": true,
    "dns_modification": "system",
    "encryption_at_rest": true,
    "encryption_in_transit": true,
    "network_isolation": true,
    "secret_provider": {
      "provider": "vault"
    }
  },
  "token_auth": {
    "auth_type": "token",
    "ssh_key_storage": "local",
    "token_config": {
      "expiry_seconds": 86400,
      "refresh_enabled": true,
      "token_format": "jwt",
      "token_path": "~/.provisioning/tokens/auth"
    }
  },
  "user_locking": {
    "git_integration": "required",
    "isolation": "user",
    "lock_provider": "gitea",
    "locking": "enabled",
    "max_workspaces_per_user": 5
  }
}