{
  "ScadaBridge": {
    "Node": {
      "Role": "Central",
      "NodeName": "central-b",
      "NodeHostname": "scadabridge-central-b",
      "RemotingPort": 8081
    },
    "Cluster": {
      "SeedNodes": [
        "akka.tcp://scadabridge@scadabridge-central-a:8081",
        "akka.tcp://scadabridge@scadabridge-central-b:8081"
      ],
      "SplitBrainResolverStrategy": "keep-oldest",
      "StableAfter": "00:00:15",
      "HeartbeatInterval": "00:00:02",
      "FailureDetectionThreshold": "00:00:10",
      "MinNrOfMembers": 1
    },
    "Database": {
      "_comment": "ConfigurationDb/MachineDataDb (which carry the dev SQL password) are supplied as ScadaBridge__Database__* whole-key env overrides in docker/docker-compose.yml (dev-only-insecure, mirroring the ApiKeyPepper convention). The same dev password already ships committed for the sibling scadabridge-mssql container (infra/docker-compose.yml MSSQL_SA_PASSWORD) — this is consolidation, not new exposure. Env overrides layer over JSON before the ${secret:} expander runs, so the dev cluster boots with no KEK/secret store. Real/prod config uses ${secret:} tokens in src/.../appsettings.Central.json (T4)."
    },
    "Security": {
      "Ldap": {
        "Server": "10.100.0.35",
        "Port": 3893,
        "Transport": "None",
        "AllowInsecure": true,
        "SearchBase": "dc=zb,dc=local",
        "ServiceAccountDn": "cn=serviceaccount,dc=zb,dc=local",
        "_comment_ServiceAccountPassword": "Supplied as ScadaBridge__Security__Ldap__ServiceAccountPassword env override in docker-compose.yml (dev-only-insecure)."
      },
      "Auth": {
        "DisableLogin": false,
        "User": "multi-role"
      },
      "_comment_JwtSigningKey": "Supplied as ScadaBridge__Security__JwtSigningKey env override in docker-compose.yml (dev-only-insecure).",
      "JwtExpiryMinutes": 15,
      "IdleTimeoutMinutes": 30,
      "RequireHttpsCookie": false,
      "ForwardedHeaders": {
        "_comment": "Traefik fronts this node on the external scadabridge-net docker network. Trust X-Forwarded-For from the docker bridge address pool so LoginThrottle keys on the real client IP (arch-review R2 N2). Narrow to the Traefik container IP if the network is pinned.",
        "Enabled": true,
        "KnownNetworks": [ "172.16.0.0/12" ]
      }
    },
    "Communication": {
      "DeploymentTimeout": "00:02:00",
      "LifecycleTimeout": "00:00:30",
      "QueryTimeout": "00:00:30",
      "TransportHeartbeatInterval": "00:00:05",
      "TransportFailureThreshold": "00:00:15",
      "CentralFetchBaseUrl": "http://scadabridge-traefik"
    },
    "ManagementService": {
      "CommandTimeout": "00:00:30",
      "LongRunningCommandTimeout": "00:05:00"
    },
    "HealthMonitoring": {
      "ReportInterval": "00:00:30",
      "OfflineTimeout": "00:01:00"
    },
    "InboundApi": {
      "DefaultMethodTimeout": "00:00:30"
    },
    "Notification": {
      "SmtpServer": "scadabridge-smtp",
      "SmtpPort": 1025,
      "AuthMode": "None",
      "FromAddress": "scada-notifications@company.com"
    },
    "NotificationOutbox": {
      "DispatchInterval": "00:00:05",
      "DispatchBatchSize": 1000
    },
    "KpiHistory": {
      "SampleInterval": "00:01:00",
      "RetentionDays": 90,
      "PurgeInterval": "1.00:00:00",
      "DefaultMaxSeriesPoints": 200
    },
    "Transport": {
      "SourceEnvironment": "docker-cluster"
    },
    "Logging": {
      "MinimumLevel": "Information"
    }
  }
}