cf-secrets-example.main.yml

# The following line helps maintain current documentation at http://docs.cloudfoundry.org.
# code_snippet cf-stub-aws start
---
director_uuid: DIRECTOR_ID
meta:
  environment: DEPLOYMENT_NAME

  releases:
    - name: cf
      version: latest

  resource_key: (( meta.environment ))
  app_domains:
  - APP_DOMAIN
  service_domain: mypaas.com
  zones:
    z1: us-gov-west-1a
    z2: us-gov-west-1b
  elbs:
  - cfrouter
  default_env:
    # Default vcap & root password on deployed VMs (ie c1oudc0w)
    bosh:
      password: xxx
  aws:
    key_name: ~

networks:
- name: cf1
  subnets:
  - cloud_properties:
      subnet: SUBNET1_ID
      security_groups:
      - SECURITY_GROUP
    static:
    - 10.0.10.65 - 10.0.10.100
    range: 10.0.10.100/26
    gateway: 10.0.10.1
    reserved:
    - RESERVED_IP
    dns:
    - DNS_IP
- name: cf2
  subnets:
  - cloud_properties:
      subnet: SUBNET2_ID
      security_groups:
      - SECURITY_GROUP
    static:
    - 10.0.11.65 - 10.0.11.100
    range: 10.0.11.100/26
    gateway: 10.0.10.1
    reserved:
    - RESERVED_IP
    dns:
    - DNS_IP

properties:
  app_ssh:
    host_key_fingerprint: DIEGO-SSH-FINGERPRINT
    oauth_client_id: ssh-proxy
  ssl:
    skip_cert_verify: false

  consul:
    encrypt_keys:
    - RANDOM-SECRET-KEY
    ca_cert: |
      -----BEGIN CERTIFICATE-----
      -----END CERTIFICATE-----
    agent_cert: |
      -----BEGIN CERTIFICATE-----
      -----END CERTIFICATE-----
    agent_key: |
      -----BEGIN RSA PRIVATE KEY-----
      -----END RSA PRIVATE KEY-----
    server_cert: |
      -----BEGIN CERTIFICATE-----
      -----END CERTIFICATE-----
    server_key: |
      -----BEGIN RSA PRIVATE KEY-----
      -----END RSA PRIVATE KEY-----
  cc:
    mutual_tls:
      ca_cert: |-
        -----BEGIN CERTIFICATE-----
        -----END CERTIFICATE-----
      public_cert: |-
        -----BEGIN CERTIFICATE-----
        -----END CERTIFICATE-----
      private_key: |-
        -----BEGIN RSA PRIVATE KEY-----
        -----END RSA PRIVATE KEY-----
    min_cli_version: 6.22.2
    default_to_diego_backend: true
    users_can_select_backend: false
    diego:
      staging: optional
      running: disabled
    droplets:
      droplet_directory_key: DROPLET_DIR_KEY
    buildpacks:
      buildpack_directory_key: BUILDPACK_DIR_KEY
    staging_upload_user: STAGING_UPLOADER
    staging_upload_password: STAGING_UPLOAD_PASSWORD
    bulk_api_password: BULK_API_PASSWORD
    <<: ( merge )

  domain: DOMAIN
  nats:
    user: NATS_USER
    password: NATS_PASSWORD
  router:
    route_services_secret: ROUTE_SERVICES_SECRET
    status:
      user: ROUTER_USER
      password: ROUTER_PASSWORD
  template_only:
    aws:
      availability_zone: us-gov-west-1a
      availability_zone2: us-gov-west-1b
      region: us-gov-west-1
  uaa:
    ca_cert: |-
      -----BEGIN CERTIFICATE-----
      -----END CERTIFICATE-----
    sslCertificate: |-
      -----BEGIN CERTIFICATE-----
      -----END CERTIFICATE-----
    sslPrivateKey: |-
      -----BEGIN RSA PRIVATE KEY-----
      -----END RSA PRIVATE KEY-----
    admin:
      client_secret:
    cc:
      client_secret:
    clients:
      cc_routing:
        secret:
      cloud_controller_username_lookup:
        secret:
      # if you change this, change logregator.uaa.client_secret as well
      doppler:
        secret: DOPPLER_SECRET
      gorouter:
        secret:
      tcp_emitter:
        secret: tcp_emitter_client_secret
      tcp_router:
        secret:
      login:
        secret:
      notifications:
        secret:
      <<: (( merge ))
    jwt:
      signing_key: |
        -----BEGIN RSA PRIVATE KEY-----
        -----END RSA PRIVATE KEY-----
      verification_key: |
        -----BEGIN PUBLIC KEY-----
        -----END PUBLIC KEY-----
    scim:
      groups:
        admin_ui.user: "Admin UI users"
        admin_ui.admin: "Admin UI admins"
      users:
      - name: admin
        password: admin-password
        groups:
        - scim.write
        - openid
        - scim.read
        - cloud_controller.admin
        - doppler.firehose
      - name: services
        password: services-password
        groups:
        - scim.write
        - openid
        - scim.read
        - cloud_controller.admin
      - name: sys-tester
        password: sys-tester-password
        groups:
        - scim.write
        - openid
        - scim.read
        - cloud_controller.admin
        - doppler.firehose
      - name: user-tester
        password: user_tester_password
        groups:
        - openid
      - <<: (( merge ))

  loggregator:
    uaa:
      # this is the client secret for the "doppler" client
      client_secret: DOPPLER_SECRET
    tls:
      ca_cert: |-
        -----BEGIN CERTIFICATE-----
        -----END CERTIFICATE-----
      doppler:
        cert: |-
          -----BEGIN CERTIFICATE-----
          -----END CERTIFICATE-----
        key: |-
          -----BEGIN RSA PRIVATE KEY-----
          -----END RSA PRIVATE KEY-----
      metron:
        cert: |-
          -----BEGIN CERTIFICATE-----
          -----END CERTIFICATE-----
        key: |-
          -----BEGIN RSA PRIVATE KEY-----
          -----END RSA PRIVATE KEY-----
      trafficcontroller:
        cert: |-
          -----BEGIN CERTIFICATE-----
          -----END CERTIFICATE-----
        key: |-
          -----BEGIN RSA PRIVATE KEY-----
          -----END RSA PRIVATE KEY-----
      statsd_injector:
        cert: |-
          -----BEGIN CERTIFICATE-----
          -----END CERTIFICATE-----
        key: |-
          -----BEGIN RSA PRIVATE KEY-----
          -----END RSA PRIVATE KEY-----
      syslogdrainbinder:
        cert: |-
          -----BEGIN CERTIFICATE-----
          -----END CERTIFICATE-----
        key: |-
          -----BEGIN RSA PRIVATE KEY-----
          -----END RSA PRIVATE KEY-----
  loggregator_endpoint:
    shared_secret: loggregator_shared_secret
  login:
    branding:
      product_logo: "BASE64_ENCODED_IMAGE"
      square_logo: "BASE64_ENCODED_SQUARE_IMAGE"
      company_name: cloud.gov
      footer_legal_text: "'&nbsp;'"
    uaa_certificate: |
      -----BEGIN CERTIFICATE-----
      -----END CERTIFICATE-----

  acceptance_tests:
    api:  (( "api." domain ))
    apps_domain: APP_DOMAIN
    admin_user: sys-tester
    admin_password: sys-tester-password
    backend: diego
    skip_ssl_validation: true
    system_domain: (( domain ))
    oauth_password: tcp_emitter_client_secret
    include_diego_ssh: true
    include_route_services: true
    include_routing_api: true
    include_v3: false
    include_tasks: false
    # include_sso: true
    nodes: 2
    existing_user: user-tester
    existing_user_password: user_tester_password
    include_sso: false
    skip_regex: 'dotnet\-core|transparently\sproxies\sboth\sreserved\scharacters\sand\sunsafe\scharacters'

  smoke_tests:
    api:  (( "api." domain ))
    apps_domain: APP_DOMAIN
    backend: diego
    user: sys-tester
    password: sys-tester-password
    org: test
    space: test
    ginkgo_opts: ~
    skip_ssl_validation: true

  <<: ( merge )