# GCP ADC upstream authentication (experimental)
#
# Acquires an OAuth2 access token from the GCE/GKE metadata server
# or a service-account key file and injects "Authorization: Bearer
# <token>" on every proxied request to Vertex AI. The token is
# cached in memory (cache-through: a request that finds the cache
# stale fetches a fresh token inline before proceeding); the
# downstream client never sees GCP credentials.
#
# source: key_file signs a JWT assertion with a service-account key
# JSON file (client_email, private_key, token_uri) and exchanges it at
# Google's OAuth2 token endpoint. The key file's token_uri must be
# https://oauth2.googleapis.com/token so a tampered key file cannot
# redirect the signed assertion elsewhere; mount the file from a Secret
# and never commit it.
#
# clusters: [...] limits token injection to requests routed to those
# clusters, so a chain that routes to several providers never sends the
# GCP token to the others. It only works with gcp_adc placed after the
# router, as below: before it, no cluster has been selected yet.
#
# This filter only injects Authorization — it does NOT set Host
# or path. Point the cluster at your Vertex regional endpoint
# (and tls.sni) the same way as any other upstream.
#
# Experimental: rebuild with --features gcp-adc-filter.
# Configuration may change before graduation.
#
# Usage:
#   cargo run -p praxis-ai-proxy --features gcp-adc-filter -- \
#     -c examples/configs/gcp-adc.yaml

listeners:
  - name: gateway
    address: "0.0.0.0:8080"
    filter_chains:
      - vertex

filter_chains:
  - name: vertex
    filters:
      - filter: router
        routes:
          - path_prefix: "/"
            cluster: vertex
      - filter: load_balancer
        clusters:
          - name: vertex
            endpoints:
              - "127.0.0.1:3000"
      - filter: gcp_adc
        # source: adc   # default: GOOGLE_APPLICATION_CREDENTIALS, else GKE metadata
        # scope: https://www.googleapis.com/auth/cloud-platform
        # For a mounted service-account key instead of ADC:
        # source: key_file
        # credentials_file: /run/secrets/gcp-service-account.json
        # clusters: [vertex]   # optional; inject only for these clusters
        # Token requests go only to the fixed metadata endpoint or to
        # Google's token endpoint; redirects and ambient HTTP proxies
        # are disabled.

insecure_options:
  allow_private_endpoints: true # example proxies to a local backend