name: "exordos_ecosystem"
description: "Exordos Ecosystem element"
schema_version: 1
version: "0.0.6-rc+20260706094312.afc6eb2c"
api_version: "v1"

requirements:
  core:
    from_version: "0.0.0"
  dbaas:
    from_version: "2.2.4"

imports:
  pg18:
    element: "$dbaas"
    kind: "resource"
    link: "$dbaas.types.postgres.versions.$pg18"
  core_lb:
    element: "$core"
    kind: "resource"
    link: "$core.network.lb.$core_lb"
  core_lb_http_vhost:
    element: "$core"
    kind: "resource"
    link: "$core.network.lb.$core_lb.vhosts.$core_lb_core_http"
  var_default_cores:
    element: "$core"
    kind: "resource"
    link: "$core.vs.variables.$default_cores"
  var_default_ram:
    element: "$core"
    kind: "resource"
    link: "$core.vs.variables.$default_ram"
  var_hs256_jwks_encryption_key:
    element: "$core"
    kind: "resource"
    link: "$core.vs.variables.$hs256_jwks_encryption_key"

resources:

  # IAM
  $core.iam.organizations:
    eco_organization:
      name: "Ecosystem organization"
      description: "Ecosystem organization"

  $core.iam.projects:
    eco_project:
      name: "Ecosystem project"
      organization: $core.iam.organizations.$eco_organization:uuid

  $core.iam.permissions:
    eco_org_create:
      name: "exordos_ecosystem.organization_token.create"
    eco_org_read:
      name: "exordos_ecosystem.organization_token.read"
    eco_org_update:
      name: "exordos_ecosystem.organization_token.update"
    eco_org_delete:
      name: "exordos_ecosystem.organization_token.delete"
    eco_ui_component_create:
      name: "exordos_ecosystem.ui_component.create"
    eco_ui_component_read:
      name: "exordos_ecosystem.ui_component.read"
    eco_ui_component_update:
      name: "exordos_ecosystem.ui_component.update"
    eco_ui_component_delete:
      name: "exordos_ecosystem.ui_component.delete"
    eco_ui_sidebar_item_create:
      name: "exordos_ecosystem.ui_sidebar_item.create"
    eco_ui_sidebar_item_read:
      name: "exordos_ecosystem.ui_sidebar_item.read"
    eco_ui_sidebar_item_update:
      name: "exordos_ecosystem.ui_sidebar_item.update"
    eco_ui_sidebar_item_delete:
      name: "exordos_ecosystem.ui_sidebar_item.delete"
    eco_ui_data_source_create:
      name: "exordos_ecosystem.ui_data_source.create"
    eco_ui_data_source_read:
      name: "exordos_ecosystem.ui_data_source.read"
    eco_ui_data_source_update:
      name: "exordos_ecosystem.ui_data_source.update"
    eco_ui_data_source_delete:
      name: "exordos_ecosystem.ui_data_source.delete"
    eco_metadata_shared_data_provider_read:
      name: "exordos_ecosystem.metadata_shared_data_provider.read"

  $core.iam.permissionbinding:
    # owner
    eco_org_create_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_org_create:uuid
      project_id: 12345678-c625-4fee-81d5-f691897b8142
    eco_org_read_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_org_read:uuid
      project_id: 12345678-c625-4fee-81d5-f691897b8142
    eco_org_update_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_org_update:uuid
      project_id: 12345678-c625-4fee-81d5-f691897b8142
    eco_org_delete_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_org_delete:uuid
      project_id: 12345678-c625-4fee-81d5-f691897b8142
    eco_ui_component_create_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_ui_component_create:uuid
      project_id: 12345678-c625-4fee-81d5-f691897b8142
    eco_ui_component_read_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_ui_component_read:uuid
      project_id: 12345678-c625-4fee-81d5-f691897b8142
    eco_ui_component_update_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_ui_component_update:uuid
      project_id: 12345678-c625-4fee-81d5-f691897b8142
    eco_ui_component_delete_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_ui_component_delete:uuid
      project_id: 12345678-c625-4fee-81d5-f691897b8142
    eco_ui_sidebar_item_create_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_ui_sidebar_item_create:uuid
      project_id: 12345678-c625-4fee-81d5-f691897b8142
    eco_ui_sidebar_item_read_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_ui_sidebar_item_read:uuid
      project_id: 12345678-c625-4fee-81d5-f691897b8142
    eco_ui_sidebar_item_update_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_ui_sidebar_item_update:uuid
      project_id: 12345678-c625-4fee-81d5-f691897b8142
    eco_ui_sidebar_item_delete_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_ui_sidebar_item_delete:uuid
      project_id: 12345678-c625-4fee-81d5-f691897b8142
      project_id: 12345678-c625-4fee-81d5-f691897b8142
    eco_ui_data_source_create_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_ui_data_source_create:uuid
      project_id: 12345678-c625-4fee-81d5-f691897b8142
    eco_ui_data_source_read_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_ui_data_source_read:uuid
      project_id: 12345678-c625-4fee-81d5-f691897b8142
    eco_ui_data_source_update_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_ui_data_source_update:uuid
      project_id: 12345678-c625-4fee-81d5-f691897b8142
    eco_ui_data_source_delete_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_ui_data_source_delete:uuid
      project_id: 12345678-c625-4fee-81d5-f691897b8142
    eco_metadata_shared_data_provider_read_binding:
      role: "726f6c65-0000-0000-0000-000000000002"
      permission: $core.iam.permissions.$eco_metadata_shared_data_provider_read:uuid
      project_id: 12345678-c625-4fee-81d5-f691897b8142

    # admin
    ecosystem_admin_users_create_binding:
      # iam.user.create
      permission: "6e264a97-6640-59ae-8314-d55fdbf85b66"
      role: $core.iam.roles.$ecosystem_admin:uuid
    ecosystem_admin_users_read_binding:
      # iam.user.list
      permission: "a8a7eea2-7514-53ac-a408-8b1235352310"
      role: $core.iam.roles.$ecosystem_admin:uuid
    ecosystem_admin_rb_read_binding:
      # iam.role_binding.read
      permission: "ff96b360-0f40-5aa4-9396-5de7aba31cb1"
      role: $core.iam.roles.$ecosystem_admin:uuid
    ecosystem_admin_rb_create_binding:
      # iam.role_binding.create
      permission: "4c6a94fc-e18f-5d0e-8ada-daaf5d470dd2"
      role: $core.iam.roles.$ecosystem_admin:uuid
    ecosystem_admin_orgs_binding:
      # iam.organization.create
      permission: "51330c56-c241-520f-8b83-234a0ab7ba1d"
      role: $core.iam.roles.$ecosystem_admin:uuid
    ecosystem_admin_role_read_binding:
      # iam.role.read
      permission: "4737a4f2-dd9e-584c-9cb2-3927364481db"
      role: $core.iam.roles.$ecosystem_admin:uuid
    ecosystem_admin_projects_read_binding:
      # iam.project.read_all
      permission: "626d4b57-3cc7-56d6-bf30-7c2ada04d6b0"
      role: $core.iam.roles.$ecosystem_admin:uuid
    ecosystem_org_owner_token_create_binding:
      # iam.service_token.create
      permission: "ef1dd949-29c5-514a-ad19-3502a343a9d8"
      role: $core.iam.roles.$ecosystem_org_owner:uuid

    # ecosystem_realm DNS bindings
    ecosystem_realm_dns_domain_read_binding:
      # dns.domain.read
      permission: "74d3d8e2-85fa-5a05-8caa-4a3036181f88"
      role: $core.iam.roles.$ecosystem_realm:uuid
      project_id: "29e2e6cc-0a74-5d07-997d-bbcb65b82c93"
    ecosystem_realm_dns_domain_create_binding:
      # dns.domain.create
      permission: "57286e51-6554-5a13-bf43-08bebf9b37a3"
      role: $core.iam.roles.$ecosystem_realm:uuid
      project_id: "29e2e6cc-0a74-5d07-997d-bbcb65b82c93"
    ecosystem_realm_dns_domain_update_binding:
      # dns.domain.update
      permission: "5d08d7dc-d455-59ae-aede-ae4db96b04e8"
      role: $core.iam.roles.$ecosystem_realm:uuid
      project_id: "29e2e6cc-0a74-5d07-997d-bbcb65b82c93"
    ecosystem_realm_dns_domain_delete_binding:
      # dns.domain.delete
      permission: "e0896a81-15c0-5005-bfca-bcffa48867e8"
      role: $core.iam.roles.$ecosystem_realm:uuid
      project_id: "29e2e6cc-0a74-5d07-997d-bbcb65b82c93"
    ecosystem_realm_dns_record_read_binding:
      # dns.record.read
      permission: "776e0696-32f6-50ba-b419-0bfc35c6dfe1"
      role: $core.iam.roles.$ecosystem_realm:uuid
      project_id: "29e2e6cc-0a74-5d07-997d-bbcb65b82c93"
    ecosystem_realm_dns_record_create_binding:
      # dns.record.create
      permission: "0e332cde-811c-5c91-a903-d2809acfe817"
      role: $core.iam.roles.$ecosystem_realm:uuid
      project_id: "29e2e6cc-0a74-5d07-997d-bbcb65b82c93"
    ecosystem_realm_dns_record_update_binding:
      # dns.record.update
      permission: "63e98744-132e-5b67-8b83-8dc0cd7646b1"
      role: $core.iam.roles.$ecosystem_realm:uuid
      project_id: "29e2e6cc-0a74-5d07-997d-bbcb65b82c93"
    ecosystem_realm_dns_record_delete_binding:
      # dns.record.delete
      permission: "3c937db2-917b-5353-82b6-66acabe83604"
      role: $core.iam.roles.$ecosystem_realm:uuid
      project_id: "29e2e6cc-0a74-5d07-997d-bbcb65b82c93"

  $core.iam.users:
    ecosystem_admin_user:
      username: ecosystem_admin
      first_name: "Ecosystem admin"
      last_name: "Ecosystem admin"
      email: "noreply+eco@exordos.com"
      password: $core.secret.passwords.$ecosystem_admin_password:value

  $core.iam.roles:
    ecosystem_admin:
      name: ecosystem_admin
      description: "Ecosystem administrator"
    ecosystem_org_owner:
      name: ecosystem_org_owner
      description: "Ecosystem organization owner"
    ecosystem_realm:
      name: ecosystem_realm
      description: "Ecosystem realm"

  $core.iam.rolebinding:
    ecosystem_admin_role_binding:
      role: $core.iam.roles.$ecosystem_admin:uuid
      user: $core.iam.users.$ecosystem_admin_user:uuid

  # DB
  $dbaas.types.postgres.instances:
    ecosystem_cluster_pg:
      name: "ecosystem-pg-cluster"
      nodes_number: 1
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      cpu: $exordos_ecosystem.imports.$var_default_cores:value
      ram: $exordos_ecosystem.imports.$var_default_ram:value
      # TODO(gmelikov): Make it configurable
      disk_size: 20
      version: $exordos_ecosystem.imports.$pg18:uuid

  $dbaas.types.postgres.instances.$ecosystem_cluster_pg.users:
    ecosystem_db_user:
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      name: ecosystem_db_user
      password: $core.secret.passwords.$ecosystem_db_password:value
      instance: $dbaas.types.postgres.instances.$ecosystem_cluster_pg:uuid

  $dbaas.types.postgres.instances.$ecosystem_cluster_pg.databases:
    ecosystem_db:
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      name: ecosystem_db
      owner: $dbaas.types.postgres.instances.$ecosystem_cluster_pg.users.$ecosystem_db_user:uuid
      instance: $dbaas.types.postgres.instances.$ecosystem_cluster_pg:uuid

  # Compute
  $core.compute.nodes:
    ecosystem_cp:
      name: ecosystem-cp
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      cores: 1
      ram: 2048
      disk_spec:
        kind: "disks"
        disks:
          - size: 6
            image: "https://repo.exordos.com/exordos-elements/exordos_ecosystem/0.0.6-rc+20260706094312.afc6eb2c/images/exordos-ecosystem.raw.gz"
            label: root

  # Secrets
  $core.secret.passwords:

    ecosystem_db_password:
      name: ecosystem_db_password
      description: "Ecosystem DB password"
      constructor:
        kind: plain
      method: AUTO_HEX

    ecosystem_admin_password:
      name: ecosystem_admin_password
      description: "Ecosystem admin password"
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      constructor:
        kind: plain
      method: AUTO_HEX

    ecosystem_global_salt:
      name: ecosystem_global_salt
      description: "Ecosystem global salt"
      constructor:
        kind: plain
      method: AUTO_HEX

  # Config
  $core.config.configs:
    dbaas_cp_config:
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      path: /etc/genesis_init.txt
      target:
        kind: node
        node: $core.compute.nodes.$ecosystem_cp:uuid
      body:
        kind: text
        content: |
          f"
          GC_PG_USER={$dbaas.types.postgres.instances.$ecosystem_cluster_pg.users.$ecosystem_db_user:name}
          GC_PG_PASS={$core.secret.passwords.$ecosystem_db_password:value}
          GC_PG_DB={$dbaas.types.postgres.instances.$ecosystem_cluster_pg.databases.$ecosystem_db:name}
          GC_PG_ENDPOINTS={$dbaas.types.postgres.instances.$ecosystem_cluster_pg:join(ipsv4)}
          GC_ECO_ADMIN_USER={$core.iam.users.$ecosystem_admin_user:username}
          GC_ECO_ADMIN_PASS={$core.secret.passwords.$ecosystem_admin_password:value}
          GC_ECO_ORG_OWNER_ROLE_UUID={$core.iam.roles.$ecosystem_org_owner:uuid}
          GC_ECO_REALM_ROLE_UUID={$core.iam.roles.$ecosystem_realm:uuid}
          GC_ECO_ECOSYSTEM_ENDPOINT=exordos.io
          GC_ECO_HS256_JWKS_ENCRYPTION_KEY={$exordos_ecosystem.imports.$var_hs256_jwks_encryption_key:value}
          GC_ECO_GLOBAL_SALT={$core.secret.passwords.$ecosystem_global_salt:value}
          "

  # Core LB endpoint

  $core.network.lb:
    eco_lb:
      project_id: "12345678-c625-4fee-81d5-f691897b8142"

  $exordos_ecosystem.imports.$core_lb.backend_pools:
    core_lb_ecosystem_backend_http:
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      parent: $exordos_ecosystem.imports.$core_lb:uuid
      endpoints:
        - kind: host
          host: $core.compute.nodes.$ecosystem_cp:default_network:ipv4
          port: 8080
          weight: 1
  $exordos_ecosystem.imports.$core_lb_http_vhost.routes:
    core_lb_ecosystem_route:
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      parent: $exordos_ecosystem.imports.$core_lb_http_vhost:uuid
      condition:
        kind: prefix
        value: /api/ecosystem/
        allowed_ips:
          - 0.0.0.0/0
        actions:
          - kind: backend
            pool: $core.network.lb.$core_lb.backend_pools.$core_lb_ecosystem_backend_http:uuid
            protocol:
              kind: http
        modifiers:
          - kind: auto_header
            headers:
              - 'Host'
              - 'X-Forwarded-For'
              - 'X-Forwarded-Port'
              - 'X-Forwarded-Proto'
              - 'X-Forwarded-Prefix'
          - kind: rewrite_url
            regex: "^/api/ecosystem/(.*)"
            replacement: "/$1"

  $core.network.lb.$eco_lb.backend_pools:
    ecosystem_backend_http:
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      parent: "$core.network.lb.$eco_lb:uuid"
      endpoints:
        - kind: host
          host: $core.compute.nodes.$ecosystem_cp:default_network:ipv4
          port: 8090
  $core.network.lb.$eco_lb.vhosts:
    ecosystem_http:
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      parent: "$core.network.lb.$eco_lb:uuid"
      domains:
        - exordos.tech
        - www.exordos.tech
      protocol: http
      port: 8090
  $core.network.lb.$eco_lb.vhosts.$ecosystem_http.routes:
    ecosystem_http_route:
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      parent: $core.network.lb.$eco_lb.vhosts.$ecosystem_http:uuid
      condition:
        kind: prefix
        value: /
        actions:
          - kind: local_dir_download
            url: f"http://{$core.compute.nodes.$ecosystem_cp:default_network:ipv4}:8090/web.tar.zst"