name: "exordos_ecosystem"
description: "Exordos Ecosystem element"
schema_version: 1
version: "0.0.30-dev+20260827131101.3723af90"
api_version: "v1"

requirements:
  core:
    from_version: "0.0.0"
  dbaas:
    from_version: "2.2.4"
  communal_pg_cluster:
    from_version: "2.2.4"

imports:
  pg18:
    element: "$dbaas"
    kind: "resource"
    link: "$dbaas.types.postgres.versions.$pg18"
  core_lb:
    element: "$core"
    kind: "resource"
    link: "$core.network.lb.$core_lb"
  core_lb_http_vhost:
    element: "$core"
    kind: "resource"
    link: "$core.network.lb.$core_lb.vhosts.$core_lb_core_http"
  var_default_cores:
    element: "$core"
    kind: "resource"
    link: "$core.vs.variables.$default_cores"
  var_default_ram:
    element: "$core"
    kind: "resource"
    link: "$core.vs.variables.$default_ram"
  var_hs256_jwks_encryption_key:
    element: "$core"
    kind: "resource"
    link: "$core.vs.variables.$hs256_jwks_encryption_key"
  var_iam_default_client_id:
    element: "$core"
    kind: "resource"
    link: "$core.vs.variables.$iam_default_client_id"
  var_iam_default_client_uuid:
    element: "$core"
    kind: "resource"
    link: "$core.vs.variables.$iam_default_client_uuid"
  var_communal_pg_cluster:
    element: "$communal_pg_cluster"
    kind: "resource"
    link: "$dbaas.types.postgres.instances.$cluster_pg"

resources:

  # IAM
  $core.iam.organizations:
    eco_organization:
      name: "Ecosystem organization"
      description: "Ecosystem organization"

  $core.iam.projects:
    eco_project:
      name: "Ecosystem project"
      organization: $core.iam.organizations.$eco_organization:uuid

  $core.iam.permissions:
    eco_org_create:
      name: "exordos_ecosystem.organization_token.create"
    eco_org_read:
      name: "exordos_ecosystem.organization_token.read"
    eco_org_update:
      name: "exordos_ecosystem.organization_token.update"
    eco_org_delete:
      name: "exordos_ecosystem.organization_token.delete"
    eco_ui_component_create:
      name: "exordos_ecosystem.ui_component.create"
    eco_ui_component_read:
      name: "exordos_ecosystem.ui_component.read"
    eco_ui_component_update:
      name: "exordos_ecosystem.ui_component.update"
    eco_ui_component_delete:
      name: "exordos_ecosystem.ui_component.delete"
    eco_ui_sidebar_item_create:
      name: "exordos_ecosystem.ui_sidebar_item.create"
    eco_ui_sidebar_item_read:
      name: "exordos_ecosystem.ui_sidebar_item.read"
    eco_ui_sidebar_item_update:
      name: "exordos_ecosystem.ui_sidebar_item.update"
    eco_ui_sidebar_item_delete:
      name: "exordos_ecosystem.ui_sidebar_item.delete"
    eco_ui_data_source_create:
      name: "exordos_ecosystem.ui_data_source.create"
    eco_ui_data_source_read:
      name: "exordos_ecosystem.ui_data_source.read"
    eco_ui_data_source_update:
      name: "exordos_ecosystem.ui_data_source.update"
    eco_ui_data_source_delete:
      name: "exordos_ecosystem.ui_data_source.delete"
    eco_metadata_shared_data_provider_read:
      name: "exordos_ecosystem.metadata_shared_data_provider.read"
    eco_realm_create:
      name: "exordos_ecosystem.realm.create"
    eco_realm_read:
      name: "exordos_ecosystem.realm.read"
    eco_realm_update:
      name: "exordos_ecosystem.realm.update"
    eco_realm_delete:
      name: "exordos_ecosystem.realm.delete"
    eco_telemetry_read:
      name: "exordos_ecosystem.telemetry.read"

  $core.iam.permissionbinding:
    # owner
    eco_org_create_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_org_create:uuid
      project_id: 12345678-c625-4fee-81d5-f691897b8142
    eco_org_read_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_org_read:uuid
      project_id: 12345678-c625-4fee-81d5-f691897b8142
    eco_org_update_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_org_update:uuid
      project_id: 12345678-c625-4fee-81d5-f691897b8142
    eco_org_delete_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_org_delete:uuid
      project_id: 12345678-c625-4fee-81d5-f691897b8142
    eco_ui_component_create_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_ui_component_create:uuid
      project_id: 12345678-c625-4fee-81d5-f691897b8142
    eco_ui_component_read_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_ui_component_read:uuid
      project_id: 12345678-c625-4fee-81d5-f691897b8142
    eco_ui_component_update_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_ui_component_update:uuid
      project_id: 12345678-c625-4fee-81d5-f691897b8142
    eco_ui_component_delete_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_ui_component_delete:uuid
      project_id: 12345678-c625-4fee-81d5-f691897b8142
    eco_ui_sidebar_item_create_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_ui_sidebar_item_create:uuid
      project_id: 12345678-c625-4fee-81d5-f691897b8142
    eco_ui_sidebar_item_read_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_ui_sidebar_item_read:uuid
      project_id: 12345678-c625-4fee-81d5-f691897b8142
    eco_ui_sidebar_item_update_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_ui_sidebar_item_update:uuid
      project_id: 12345678-c625-4fee-81d5-f691897b8142
    eco_ui_sidebar_item_delete_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_ui_sidebar_item_delete:uuid
      project_id: 12345678-c625-4fee-81d5-f691897b8142
    eco_ui_data_source_create_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_ui_data_source_create:uuid
      project_id: 12345678-c625-4fee-81d5-f691897b8142
    eco_ui_data_source_read_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_ui_data_source_read:uuid
      project_id: 12345678-c625-4fee-81d5-f691897b8142
    eco_ui_data_source_update_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_ui_data_source_update:uuid
      project_id: 12345678-c625-4fee-81d5-f691897b8142
    eco_ui_data_source_delete_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_ui_data_source_delete:uuid
      project_id: 12345678-c625-4fee-81d5-f691897b8142
    eco_metadata_shared_data_provider_read_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_metadata_shared_data_provider_read:uuid
      project_id: 12345678-c625-4fee-81d5-f691897b8142
    eco_realm_create_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_realm_create:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    eco_realm_read_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_realm_read:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    eco_realm_update_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_realm_update:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    eco_realm_delete_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_realm_delete:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    eco_telemetry_read_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_telemetry_read:uuid
      project_id: $core.iam.projects.$eco_project:uuid

    # org owner manages realms of its projects
    eco_org_owner_realm_create_binding:
      role: $core.iam.roles.$ecosystem_org_owner:uuid
      permission: $core.iam.permissions.$eco_realm_create:uuid
    eco_org_owner_realm_read_binding:
      role: $core.iam.roles.$ecosystem_org_owner:uuid
      permission: $core.iam.permissions.$eco_realm_read:uuid
    eco_org_owner_realm_update_binding:
      role: $core.iam.roles.$ecosystem_org_owner:uuid
      permission: $core.iam.permissions.$eco_realm_update:uuid
    eco_org_owner_realm_delete_binding:
      role: $core.iam.roles.$ecosystem_org_owner:uuid
      permission: $core.iam.permissions.$eco_realm_delete:uuid
    eco_org_owner_telemetry_read_binding:
      role: $core.iam.roles.$ecosystem_org_owner:uuid
      permission: $core.iam.permissions.$eco_telemetry_read:uuid

    # admin
    ecosystem_admin_users_create_binding:
      # iam.user.create
      permission: "6e264a97-6640-59ae-8314-d55fdbf85b66"
      role: $core.iam.roles.$ecosystem_admin:uuid
    ecosystem_admin_users_read_binding:
      # iam.user.list
      permission: "a8a7eea2-7514-53ac-a408-8b1235352310"
      role: $core.iam.roles.$ecosystem_admin:uuid
    ecosystem_admin_rb_read_binding:
      # iam.role_binding.read
      permission: "ff96b360-0f40-5aa4-9396-5de7aba31cb1"
      role: $core.iam.roles.$ecosystem_admin:uuid
    ecosystem_admin_rb_create_binding:
      # iam.role_binding.create
      permission: "4c6a94fc-e18f-5d0e-8ada-daaf5d470dd2"
      role: $core.iam.roles.$ecosystem_admin:uuid
    ecosystem_admin_orgs_binding:
      # iam.organization.create
      permission: "51330c56-c241-520f-8b83-234a0ab7ba1d"
      role: $core.iam.roles.$ecosystem_admin:uuid
    ecosystem_admin_role_read_binding:
      # iam.role.read
      permission: "4737a4f2-dd9e-584c-9cb2-3927364481db"
      role: $core.iam.roles.$ecosystem_admin:uuid
    ecosystem_admin_projects_read_binding:
      # iam.project.read_all
      permission: "626d4b57-3cc7-56d6-bf30-7c2ada04d6b0"
      role: $core.iam.roles.$ecosystem_admin:uuid
    ecosystem_org_owner_token_create_binding:
      # iam.service_token.create
      permission: "ef1dd949-29c5-514a-ad19-3502a343a9d8"
      role: $core.iam.roles.$ecosystem_org_owner:uuid
    ecosystem_admin_certificate_read_binding:
      # secret.certificate.read
      permission: 9fbcf344-550b-4069-a6b1-adcab6bfe403
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid

    # admin: manage nodes/configs hosting managed realms
    # (see docs/realm-manager.md; UUIDs are uuid5 of the permission name)
    ecosystem_admin_node_read_binding:
      # compute.node.read
      permission: "62dc01b3-f556-5ba3-bcd6-709c52d7418c"
      role: $core.iam.roles.$ecosystem_admin:uuid
    ecosystem_admin_node_create_binding:
      # compute.node.create
      permission: "086988df-a84b-5c42-8f3a-1fd3d0dd3878"
      role: $core.iam.roles.$ecosystem_admin:uuid
    ecosystem_admin_node_update_binding:
      # compute.node.update
      permission: "44b6c954-867f-558b-9dba-b8c7baf9df38"
      role: $core.iam.roles.$ecosystem_admin:uuid
    ecosystem_admin_node_delete_binding:
      # compute.node.delete
      permission: "31eff665-2e96-5202-873a-a2f3c812a281"
      role: $core.iam.roles.$ecosystem_admin:uuid
    ecosystem_admin_config_read_binding:
      # config.config.read
      permission: "ab09a33c-50bc-5102-b94f-d9b443cfeba0"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    ecosystem_admin_config_create_binding:
      # config.config.create
      permission: "662d2b35-3f66-5c1d-9e67-3e37203de1f3"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    ecosystem_admin_config_update_binding:
      # config.config.update
      permission: "58a9b19d-00fe-5887-9896-28b5801025e7"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    ecosystem_admin_config_delete_binding:
      # config.config.delete
      permission: "36332a84-db81-51af-8b28-05ab0059eb48"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    # compute.node_set.* replaced compute.node.* as the builder's API of
    # choice (see exordos_ecosystem/realm/infra/ — NodeSet+RestCoreCapabilityDriver,
    # matching exordos_s3/mail/db). Needs project scoping (unlike the old
    # node.* bindings above): RestCoreCapabilityDriver requests a
    # project-scoped token (use_project_scope=True), which a project-less
    # binding does not satisfy.
    ecosystem_admin_node_set_read_binding:
      # compute.node_set.read
      permission: "93f0b1b3-6fd9-53b9-a58c-1678a3e63a42"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    ecosystem_admin_node_set_create_binding:
      # compute.node_set.create
      permission: "28712ab0-4ce0-5b6e-b3bf-7546a1a405c6"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    ecosystem_admin_node_set_update_binding:
      # compute.node_set.update
      permission: "b140db60-8c0c-50ed-954a-c08f105e9a6c"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    ecosystem_admin_node_set_delete_binding:
      # compute.node_set.delete
      permission: "a111927f-efa6-501c-bb44-deab41cc5c40"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid

    # network.border.* — the realm border (NAT gateway) the infra builder
    # drives on managed realm nodes (permissions seeded by core migration
    # 0067; UUIDs are uuid5 of the permission name).
    ecosystem_admin_border_read_binding:
      # network.border.read
      permission: "26f8c4ed-e1f1-5a05-9206-ee23f009fc54"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    ecosystem_admin_border_create_binding:
      # network.border.create
      permission: "77a01f64-99ba-5adc-8c94-dc2f9c6def02"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    ecosystem_admin_border_update_binding:
      # network.border.update
      permission: "cac4210d-62f9-5b38-bb2f-115e44ac5f83"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    ecosystem_admin_border_delete_binding:
      # network.border.delete
      permission: "8c016760-e6ad-5a8b-b334-3239b2bf5bb6"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid

    # Shared realm-ingress LB + realm DNS: the realm manager
    # reconciles vhosts/pools/routes and A records at runtime as the
    # ecosystem service user (SharedLBManager / RealmLBService).
    ecosystem_admin_lb_read_binding:
      # network.lb.read
      permission: "bf77a2be-2d26-55a9-a239-c62e660f1ab4"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    ecosystem_admin_lb_create_binding:
      # network.lb.create
      permission: "efabafc1-37ac-5845-a350-390fff7cdae4"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    ecosystem_admin_lb_update_binding:
      # network.lb.update
      permission: "1f964856-a169-5403-8722-fa4f44385234"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    ecosystem_admin_lb_delete_binding:
      # network.lb.delete
      permission: "415c918d-d7d9-5d6e-aafc-15233c132608"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    ecosystem_admin_lb_vhost_read_binding:
      # network.lb_vhost.read
      permission: "bc87f63e-86de-5740-9c5c-7d19919eb992"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    ecosystem_admin_lb_vhost_create_binding:
      # network.lb_vhost.create
      permission: "8a58a93d-486d-5ff4-b727-4e5726197264"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    ecosystem_admin_lb_vhost_update_binding:
      # network.lb_vhost.update
      permission: "f9e9cf7c-c6c5-5f60-8eb7-ef4fc9153177"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    ecosystem_admin_lb_vhost_delete_binding:
      # network.lb_vhost.delete
      permission: "c2c96450-f23f-53f9-be44-64d50b519b93"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    ecosystem_admin_lb_vhost_route_read_binding:
      # network.lb_vhost_route.read
      permission: "17860888-f181-5ed5-a2a1-38dbb6d4a598"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    ecosystem_admin_lb_vhost_route_create_binding:
      # network.lb_vhost_route.create
      permission: "6f4186ea-6e43-504d-845a-16de6775f6d1"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    ecosystem_admin_lb_vhost_route_update_binding:
      # network.lb_vhost_route.update
      permission: "f4e3fc03-383c-5569-a65e-5f04ea05e3c8"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    ecosystem_admin_lb_vhost_route_delete_binding:
      # network.lb_vhost_route.delete
      permission: "6b14f9a1-a64c-5ef8-b761-211d85069a20"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    ecosystem_admin_lb_backendpool_read_binding:
      # network.lb_backendpool.read
      permission: "b39f8ced-382d-59d7-8151-b980ac40eeea"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    ecosystem_admin_lb_backendpool_create_binding:
      # network.lb_backendpool.create
      permission: "1eec8be1-9e1d-5006-b909-907a635e5531"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    ecosystem_admin_lb_backendpool_update_binding:
      # network.lb_backendpool.update
      permission: "08c0f2ff-5aef-5652-859d-8d7125624059"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    ecosystem_admin_lb_backendpool_delete_binding:
      # network.lb_backendpool.delete
      permission: "572f3219-7fa0-5666-bf5e-3a59281685cb"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    ecosystem_admin_dns_domain_read_binding:
      # dns.domain.read
      permission: "74d3d8e2-85fa-5a05-8caa-4a3036181f88"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    ecosystem_admin_dns_domain_create_binding:
      # dns.domain.create
      permission: "57286e51-6554-5a13-bf43-08bebf9b37a3"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    ecosystem_admin_dns_domain_update_binding:
      # dns.domain.update
      permission: "5d08d7dc-d455-59ae-aede-ae4db96b04e8"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    ecosystem_admin_dns_domain_delete_binding:
      # dns.domain.delete
      permission: "e0896a81-15c0-5005-bfca-bcffa48867e8"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    ecosystem_admin_dns_record_read_binding:
      # dns.record.read
      permission: "776e0696-32f6-50ba-b419-0bfc35c6dfe1"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    ecosystem_admin_dns_record_create_binding:
      # dns.record.create
      permission: "0e332cde-811c-5c91-a903-d2809acfe817"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    ecosystem_admin_dns_record_update_binding:
      # dns.record.update
      permission: "63e98744-132e-5b67-8b83-8dc0cd7646b1"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid
    ecosystem_admin_dns_record_delete_binding:
      # dns.record.delete
      permission: "3c937db2-917b-5353-82b6-66acabe83604"
      role: $core.iam.roles.$ecosystem_admin:uuid
      project_id: $core.iam.projects.$eco_project:uuid

    # ecosystem_realm DNS bindings
    ecosystem_realm_dns_domain_read_binding:
      # dns.domain.read
      permission: "74d3d8e2-85fa-5a05-8caa-4a3036181f88"
      role: $core.iam.roles.$ecosystem_realm:uuid
      project_id: "29e2e6cc-0a74-5d07-997d-bbcb65b82c93"
    ecosystem_realm_dns_domain_create_binding:
      # dns.domain.create
      permission: "57286e51-6554-5a13-bf43-08bebf9b37a3"
      role: $core.iam.roles.$ecosystem_realm:uuid
      project_id: "29e2e6cc-0a74-5d07-997d-bbcb65b82c93"
    ecosystem_realm_dns_domain_update_binding:
      # dns.domain.update
      permission: "5d08d7dc-d455-59ae-aede-ae4db96b04e8"
      role: $core.iam.roles.$ecosystem_realm:uuid
      project_id: "29e2e6cc-0a74-5d07-997d-bbcb65b82c93"
    ecosystem_realm_dns_domain_delete_binding:
      # dns.domain.delete
      permission: "e0896a81-15c0-5005-bfca-bcffa48867e8"
      role: $core.iam.roles.$ecosystem_realm:uuid
      project_id: "29e2e6cc-0a74-5d07-997d-bbcb65b82c93"
    ecosystem_realm_dns_record_read_binding:
      # dns.record.read
      permission: "776e0696-32f6-50ba-b419-0bfc35c6dfe1"
      role: $core.iam.roles.$ecosystem_realm:uuid
      project_id: "29e2e6cc-0a74-5d07-997d-bbcb65b82c93"
    ecosystem_realm_dns_record_create_binding:
      # dns.record.create
      permission: "0e332cde-811c-5c91-a903-d2809acfe817"
      role: $core.iam.roles.$ecosystem_realm:uuid
      project_id: "29e2e6cc-0a74-5d07-997d-bbcb65b82c93"
    ecosystem_realm_dns_record_update_binding:
      # dns.record.update
      permission: "63e98744-132e-5b67-8b83-8dc0cd7646b1"
      role: $core.iam.roles.$ecosystem_realm:uuid
      project_id: "29e2e6cc-0a74-5d07-997d-bbcb65b82c93"
    ecosystem_realm_dns_record_delete_binding:
      # dns.record.delete
      permission: "3c937db2-917b-5353-82b6-66acabe83604"
      role: $core.iam.roles.$ecosystem_realm:uuid
      project_id: "29e2e6cc-0a74-5d07-997d-bbcb65b82c93"

  $core.iam.users:
    ecosystem_admin_user:
      username: ecosystem_admin
      first_name: "Ecosystem admin"
      last_name: "Ecosystem admin"
      email: "noreply+eco@exordos.com"
      password: $core.secret.passwords.$ecosystem_admin_password:value

  $core.iam.roles:
    ecosystem_admin:
      name: ecosystem_admin
      description: "Ecosystem administrator"
    ecosystem_org_owner:
      name: ecosystem_org_owner
      description: "Ecosystem organization owner"
    ecosystem_realm:
      name: ecosystem_realm
      description: "Ecosystem realm"

  $core.iam.rolebinding:
    # Global (project-less) binding: the ecosystem's IamClient authenticates
    # WITHOUT a project scope, and core resolves permissions for such tokens
    # only from role_bindings with project=NULL (iam_permissions_fast_view
    # keeps the binding's project as-is; Introspection.has_permission matches
    # the token's project exactly). Without this, e.g. the cross-project
    # user lookup in the managed-realm create path gets 403.
    ecosystem_admin_global_role_binding:
      role: $core.iam.roles.$ecosystem_admin:uuid
      user: $core.iam.users.$ecosystem_admin_user:uuid
    ecosystem_admin_role_binding:
      role: $core.iam.roles.$ecosystem_admin:uuid
      user: $core.iam.users.$ecosystem_admin_user:uuid
      # Needed for RestCoreCapabilityDriver's project-scoped tokens
      # (use_project_scope=True in exordos_ecosystem/realm/infra/): Core's
      # policy enforcement resolves permissions from role_bindings scoped
      # to the SAME project as the token, not from project-less
      # permission_bindings alone (see exordos_ecosystem_admin_*_binding
      # entries above).
      # NOTE: the RoleBinding API field is `project` (iam_binding_roles.project),
      # not `project_id` — with the wrong key the binding is silently dropped.
      project: $core.iam.projects.$eco_project:uuid

  # DB
  $exordos_ecosystem.imports.$var_communal_pg_cluster.users:
    ecosystem_db_user:
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      name: ecosystem_db_user
      password: $core.secret.passwords.$ecosystem_db_password:value
      instance: $exordos_ecosystem.imports.$var_communal_pg_cluster:uuid

  $exordos_ecosystem.imports.$var_communal_pg_cluster.databases:
    ecosystem_db:
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      name: ecosystem_db
      owner: $dbaas.types.postgres.instances.$cluster_pg.users.$ecosystem_db_user:uuid
      instance: $exordos_ecosystem.imports.$var_communal_pg_cluster:uuid

  # Compute
  $core.compute.nodes:
    ecosystem_cp:
      name: ecosystem-cp
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      cores: 1
      ram: 2048
      disk_spec:
        kind: "disks"
        disks:
          - size: 6
            image: "https://repo.exordos.com/exordos-elements/exordos_ecosystem/0.0.30-dev+20260827131101.3723af90/images/exordos-ecosystem.raw.gz"
            label: root

  # Secrets
  $core.secret.passwords:

    ecosystem_db_password:
      name: ecosystem_db_password
      description: "Ecosystem DB password"
      constructor:
        kind: plain
      method: AUTO_HEX

    ecosystem_admin_password:
      name: ecosystem_admin_password
      description: "Ecosystem admin password"
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      constructor:
        kind: plain
      method: AUTO_HEX

    ecosystem_global_salt:
      name: ecosystem_global_salt
      description: "Ecosystem global salt"
      constructor:
        kind: plain
      method: AUTO_HEX

  # Config
  $core.config.configs:
    dbaas_cp_config:
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      path: /etc/genesis_init.txt
      target:
        kind: node
        node: $core.compute.nodes.$ecosystem_cp:uuid
      body:
        kind: text
        content: |
          f"
          GC_PG_USER={$dbaas.types.postgres.instances.$cluster_pg.users.$ecosystem_db_user:name}
          GC_PG_PASS={$core.secret.passwords.$ecosystem_db_password:value}
          GC_PG_DB={$dbaas.types.postgres.instances.$cluster_pg.databases.$ecosystem_db:name}
          GC_PG_ENDPOINTS={$exordos_ecosystem.imports.$var_communal_pg_cluster:join(ipsv4)}
          GC_ECO_ADMIN_USER={$core.iam.users.$ecosystem_admin_user:username}
          GC_ECO_ADMIN_PASS={$core.secret.passwords.$ecosystem_admin_password:value}
          GC_ECO_ORG_OWNER_ROLE_UUID={$core.iam.roles.$ecosystem_org_owner:uuid}
          GC_ECO_REALM_ROLE_UUID={$core.iam.roles.$ecosystem_realm:uuid}
          GC_ECO_ECOSYSTEM_ENDPOINT=exordos.io
          GC_ECO_ECOSYSTEM_API_URL=http://exordos.io
          GC_ECO_HS256_JWKS_ENCRYPTION_KEY={$exordos_ecosystem.imports.$var_hs256_jwks_encryption_key:value}
          GC_ECO_GLOBAL_SALT={$core.secret.passwords.$ecosystem_global_salt:value}
          GC_ECO_NODE_PROJECT_ID={$core.iam.projects.$eco_project:uuid}
          GC_ECO_REALM_IMAGE=https://repo.exordos.com/exordos-elements/exordos-realm/latest/images/exordos-realm.raw.zst
          GC_ECO_IAM_CLIENT_ID={$exordos_ecosystem.imports.$var_iam_default_client_id:value}
          GC_ECO_IAM_CLIENT_UUID={$exordos_ecosystem.imports.$var_iam_default_client_uuid:value}
          GC_ECO_WILDCARD_CERT_UUID=
          GC_ECO_L4_LB_HOST=
          "

  # Core LB endpoint

  $exordos_ecosystem.imports.$core_lb.backend_pools:
    core_lb_ecosystem_backend_http:
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      parent: $exordos_ecosystem.imports.$core_lb:uuid
      endpoints:
        - kind: host
          host: $core.compute.nodes.$ecosystem_cp:default_network:ipv4
          port: 8080
          weight: 1
  $exordos_ecosystem.imports.$core_lb_http_vhost.routes:
    core_lb_ecosystem_route:
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      parent: $exordos_ecosystem.imports.$core_lb_http_vhost:uuid
      condition:
        kind: prefix
        value: /api/ecosystem/
        allowed_ips:
          - 0.0.0.0/0
        actions:
          - kind: backend
            pool: $core.network.lb.$core_lb.backend_pools.$core_lb_ecosystem_backend_http:uuid
            protocol:
              kind: http
        modifiers:
          - kind: auto_header
            headers:
              - 'Host'
              - 'X-Forwarded-For'
              - 'X-Forwarded-Port'
              - 'X-Forwarded-Proto'
              - 'X-Forwarded-Prefix'
          - kind: rewrite_url
            regex: "^/api/ecosystem/(.*)"
            replacement: "/$1"
    core_lb_ecosystem_web_route:
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      parent: $exordos_ecosystem.imports.$core_lb_http_vhost:uuid
      condition:
        kind: prefix
        value: /
        allowed_ips:
          - 0.0.0.0/0
        actions:
          - kind: local_dir_download
            url: "https://repo.exordos.com/exordos-elements/exordos_ecosystem/0.0.30-dev+20260827131101.3723af90/artifacts/web.tar.zst"
            is_spa: true
        modifiers:
          - kind: auto_header
            headers:
              - 'Host'
              - 'X-Forwarded-For'
              - 'X-Forwarded-Port'
              - 'X-Forwarded-Proto'
              - 'X-Forwarded-Prefix'