sandbox:
  enabled: false
supergraph:
  listen: "0.0.0.0:8080"
  introspection: false
  path: /graphql
  query_planning:
    cache:
      in_memory:
        limit: 1024
homepage:
  enabled: false
cors:
  allow_credentials: true
  policies:
    - origins:
        - https://seat.sonymusic.com
health_check:
  listen: "0.0.0.0:8080"
  enabled: true
headers:
  all:
    request:
      - propagate:
          matching: ".*"
      - remove:
          matching: ^x-datadog-.*$
include_subgraph_errors:
  all: true
telemetry:
  instrumentation:
    spans:
      mode: spec_compliant
  exporters:
    logging:
      stdout:
        enabled: true
        format: json
    tracing:
      common:
        resource:
          env: prod
          service.name: graphql-router-internal
        service_name: graphql-router-internal
      otlp:
        enabled: true
        protocol: http
        endpoint: "http://127.0.0.1:4318"

traffic_shaping:
  router:
    timeout: 65s
  all:
    timeout: 65s

plugins:
  experimental.expose_query_plan: true
  theorchard.require_apollo_client_name:
    enabled: true
  pde.auth_enforcement:
    enabled: true
    rules:
      jwt:
        invalid_jwt: Block
        expired_jwt: Block
        issuers:
          - "https://login.distroauth.com/"
          - "https://workstation.auth0.com/"
        audiences:
          - "https://prod-ows.theorchard.io"
          - "https://workstation.theorchard.com/api"
      malformed_auth: Block
      missing_auth: Block
      multiple_auth: Block
      unknown_auth: Block
      hmac:
        hmac_use: Block
        recipient_mismatch: Block