# One organisation joining a dataspace that somebody else runs.
#
# This is the ordinary production shape: you deploy your own stack, and the
# authority that issues membership credentials lives in another cluster,
# operated by another organisation. Nothing in this file describes the
# authority beyond the trust anchor your components must accept.
#
#   tsg render participant.yaml -o out
#   tsg deploy participant.yaml
apiVersion: tsg.dataspac.es/v1alpha1
kind: TsgDeployment
metadata:
  # Identifies the deployment independently of file path or checkout. It
  # derives the inventory names and the ownership labels, so two deployments
  # in one namespace must not share it.
  name: alfa

spec:
  namespace: tsg-alfa

  # The trust domain you are joining. Stated, never derived: the issuer is not
  # described by this file, and a DID guessed from the domain would differ from
  # the one the authority's wallet actually serves.
  dataspace:
    name: example-dataspace
    authority:
      did: did:web:authority.example.com:tenants:authority
      domain: authority.example.com
      credentialType: ExampleCredential

  admin:
    username: tsg
    email: platform@alfa.example.com
    # Referenced, never rendered. Create it with your own tooling, or for a
    # demo: tsg secrets generate <config> --apply
    passwordSecret:
      name: tsg-admin
      key: password

  database:
    # One CNPG Cluster for this stack. Each component still gets its own
    # database and its own login role inside it.
    mode: perStack
    defaults:
      instances: 1
      storageSize: 5Gi

  stacks:
    - id: alfa
      name: Alfa
      host: alfa.example.com
      # Everything on one host under a path prefix: wallet at /wallet, control
      # plane at /control-plane, sso-bridge at the root. One certificate, one
      # DNS record. Use `subdomain` when you would rather have one host each.
      routing: path

      participantSeeds:
        - id: alfa
          name: Alfa
          # The code the authority issued you out of band, which your wallet
          # exchanges for the membership credential.
          preAuthorizedCodeSecret:
            name: tsg-alfa-preauth
            key: code

      components:
        # A wallet and an sso-bridge are always rendered. A control plane is
        # opt-in, and is what makes this participant able to trade data rather
        # than only hold credentials.
        controlPlane:
          enabled: true

        dataPlanes:
          http-data-plane: {}

        useCaseApps:
          dataspace-starter: {}