# keyproxy.toml.example — copy to keyproxy.toml and fill in.
# keyproxy.toml is gitignored; it holds the ref MAP (paths + key names),
# never material itself. Refs are mpk-<name> placeholders: consumers see
# only these names; material resolves at request time, memory-only.

# HTTP hop bind address. Keep it loopback unless you know why not.
listen = "127.0.0.1:8082"

[auth]
# Bearer token for POST /v1/resolve, bootstrapped from the file backend
# itself: a 0600 env file holding the token. Resolved once at startup,
# never logged, never persisted by keyproxy.
token_ref = "mpk-keyproxy-self"

# --- file backend: KEY=VALUE env files, 0600, parsed in Go (never
# sourced/exec'd). mode is the allowed permission mask (default 0600;
# stricter files like 0400 always pass, looser files are refused).
[refs."mpk-keyproxy-self"]
backend = "file"
source = "~/.config/keyproxy/keyproxy.env"
key = "KEYPROXY_TOKEN"

[refs."mpk-example"]
backend = "file"
source = "~/.config/keyproxy/example.env"
key = "EXAMPLE_API_KEY"

# --- env backend: process-environment indirection. source IS the
# variable name (no key field); useful for container-injected values.
[refs."mpk-example-env"]
backend = "env"
source = "EXAMPLE_API_KEY"

# --- bitwarden backend: Bitwarden Secrets Manager REST (machine
# accounts). NOT IMPLEMENTED in v0 — resolves fail loudly with 501
# not_implemented so phase 3 is a drop-in behind the same interface.
[refs."mpk-example-bitwarden"]
backend = "bitwarden"
source = "sm://projects/example"
key = "EXAMPLE_API_KEY"

# --- vault backend: HashiCorp Vault KV v2 + AppRole. NOT IMPLEMENTED in
# v0 — same explicit 501 stub as bitwarden.
[refs."mpk-example-vault"]
backend = "vault"
source = "secret/data/example"
key = "EXAMPLE_API_KEY"