# A complete dataspace in one file: the authority plus every participant.
#
# This is the hands-on and demo shape. In production the participants below
# would each deploy their own file (see participant.yaml) against
# the same `dataspace.authority`; here they share one cluster and one
# PostgreSQL cluster so the whole thing fits on a laptop.
#
#   tsg render ecosystem.yaml -o out
#   tsg deploy ecosystem.yaml
apiVersion: tsg.dataspac.es/v1alpha1
kind: TsgDeployment
metadata:
  name: handson

spec:
  namespace: tsg-ecosystem

  dataspace:
    name: example-dataspace
    authority:
      did: did:web:authority.example.com:tenants:authority
      domain: authority.example.com
      credentialType: ExampleCredential

  admin:
    username: tsg
    passwordSecret:
      name: tsg-admin
      key: password

  database:
    # The dense demo profile: one CNPG Cluster for every stack in this file.
    # Components still get separate databases and separate owning roles, so
    # none can read another's tables -- but they share a Cluster, so this is
    # not the isolation you want between organisations that do not trust each
    # other. Use `perStack` for that.
    mode: shared
    defaults:
      instances: 1
      storageSize: 1Gi

  stacks:
    # --- the authority ------------------------------------------------------
    # Issues the membership credential every other participant holds. Its DID
    # must match spec.dataspace.authority.did above; the CLI refuses the
    # configuration otherwise, rather than letting these stacks trust a DID
    # nobody answers for.
    - id: authority
      name: Dataspace Authority
      host: authority.example.com
      routing: subdomain
      participantSeeds:
        - id: authority
          name: Dataspace Authority
          issuer: true
      # No control plane: the authority governs membership, it does not trade
      # data. Add one if your authority is also a participant.

    # --- a participant offering data over HTTP ------------------------------
    - id: alfa
      name: Alfa TSG
      host: alfa.example.com
      routing: path
      participantSeeds:
        - id: alfa
          name: Alfa
          # Extra claims the authority puts into Alfa's membership credential.
          credentialSubject:
            legalName: Alfa Logistics BV
            registrationNumber: NL-12345678
          preAuthorizedCodeSecret:
            name: tsg-alfa-preauth
            key: code
      components:
        controlPlane:
          enabled: true
        dataPlanes:
          # The map key is the component name, and by default also the type,
          # the URL path and the DNS label.
          http-data-plane: {}
        useCaseApps:
          dataspace-starter: {}

    # --- a participant running two data planes ------------------------------
    - id: bravo
      name: Bravo TSG
      host: bravo.example.com
      routing: subdomain
      participantSeeds:
        - id: bravo
          name: Bravo
          preAuthorizedCodeSecret:
            name: tsg-bravo-preauth
            key: code
      components:
        controlPlane:
          enabled: true
        dataPlanes:
          # Two data planes of different types on one stack. The key names the
          # component, `type` selects the image and behaviour.
          sales-data:
            type: http-data-plane
            # In `subdomain` routing the key would become sales-data.bravo...;
            # override the label without renaming the component.
            dnsPrefix: sales
          analytics:
            type: analytics-data-plane
        useCaseApps:
          dataspace-starter: {}

    # --- a participant that only consumes -----------------------------------
    - id: charlie
      name: Charlie TSG
      host: charlie.example.com
      routing: path
      participantSeeds:
        - id: charlie
          name: Charlie
          preAuthorizedCodeSecret:
            name: tsg-charlie-preauth
            key: code
      components:
        # A consumer needs a control plane to negotiate and receive transfers,
        # but no data plane of its own. Being a consumer is a starting
        # scenario, not a permanent role: adding a data plane later is a
        # two-line change.
        controlPlane:
          enabled: true
        useCaseApps:
          dataspace-starter: {}