{
  "Serilog": {
    "Using": [ "Serilog.Sinks.Console", "Serilog.Sinks.File" ],
    "WriteTo": [
      { "Name": "Console" },
      { "Name": "File", "Args": { "path": "logs/otopcua-.log", "rollingInterval": "Day" } }
    ]
  },
  "Security": {
    "Auth": {
      "DisableLogin": false
    }
  },
  "Secrets": {
    "SqlitePath": "otopcua-secrets.db",
    "MasterKey": {
      "Source": "Environment",
      "EnvVarName": "ZB_SECRETS_MASTER_KEY"
    },
    "RunMigrationsOnStartup": true,
    "ResolveCacheTtl": "00:00:30",
    "Replication": {
      "_comment": "Peer-to-peer secret replication over the Akka cluster. OPT-IN: Enabled=false keeps the plain local SQLite store on every node. KNOWN NON-FUNCTIONAL against ZB.MOM.WW.Secrets.Replicator.AkkaDotNet 0.2.0 — that version's ISecretReplicator registration is shadowed by the NoOp one AddZbSecrets registers first, so enabling this decorates the store but replicates nothing and starts no actor. Do not enable until the library is fixed. All nodes must also share the same KEK.",
      "Enabled": false,
      "AnnounceInterval": "00:00:30",
      "ActorName": "zb-secret-replication"
    }
  },
  "ServerHistorian": {
    "_comment": "Server-side HistoryRead backend (the ZB.MOM.WW.HistorianGateway gRPC client). Disabled => NullHistorianDataSource (historized nodes return GoodNoData). The gateway must run RuntimeDb:EventReadsEnabled=true for alarm-history ReadEvents, and the API key must carry historian:read + historian:write + historian:tags:write scopes.",
    "Enabled": false,
    "Endpoint": "",
    "ApiKey": "",
    "_ApiKeyComment": "NEVER commit a real key. Supply via env var ServerHistorian__ApiKey, either as a literal or as a ${secret:otopcua/historian/api-key} token resolved fail-closed by the pre-host secrets expander.",
    "UseTls": true,
    "AllowUntrustedServerCertificate": false,
    "CaCertificatePath": null,
    "CallTimeout": "00:00:30",
    "MaxTieClusterOverfetch": 65536
  },
  "ContinuousHistorization": {
    "_comment": "Continuous historization of driver (non-Galaxy) tag values: a crash-safe FasterLog outbox + recorder draining to the ServerHistorian gateway's WriteLiveValues. Disabled => no recorder is spawned. Requires ServerHistorian to be configured; the gateway connection (endpoint/key/TLS) is sourced from the ServerHistorian section, not here.",
    "Enabled": false,
    "OutboxPath": "",
    "_OutboxPathComment": "Directory holding the FasterLog segment + commit files. Required when Enabled=true. In production set an ABSOLUTE path on durable storage.",
    "CommitMode": "PerEntry",
    "CommitIntervalMs": 100,
    "DrainBatchSize": 64,
    "DrainIntervalSeconds": 2,
    "Capacity": 0,
    "MinBackoffSeconds": 1,
    "MaxBackoffSeconds": 30
  },
  "AlarmHistorian": {
    "_comment": "Durable SQLite store-and-forward alarm sink. Drains alarm events to the ServerHistorian gateway's SendEvent path; the downstream connection (endpoint/key/TLS) is sourced from the ServerHistorian section.",
    "Enabled": false,
    "DatabasePath": "alarm-historian.db",
    "DrainIntervalSeconds": 5,
    "Capacity": 1000000,
    "DeadLetterRetentionDays": 30
  },
  "Deployment": {
    "_comment": "R2-11 (05/CONV-2): deploy-gate TagConfig strictness. Warn (default) = non-blocking warnings logged + appended to the deployment result message; Error = a config with a typo'd enum or unparseable TagConfig is rejected at the draft gate. Running servers are untouched; the gate only sees re-deploys.",
    "TagConfigValidationMode": "Warn"
  }
}