kit.yml

---
name:    bosh
authors: [ James Hunt <jhunt@starkandwayne.com>,
           Troy Liebel <tliebel@starkandwayne.com>,
           Dennis Bell <dbell@starkandwayne.com> ]
docs:    https://github.com/genesis-community/bosh-genesis-kit
code:    https://github.com/genesis-community/bosh-genesis-kit
version: 1.10.2-rc3

genesis_version_min: 2.7.6

certificates:
  base:
    ssl:
      ca:
        valid_for: ${params.ca_validity_period}
      server:
        valid_for: ${params.cert_validity_period}
        names:
        - ${params.static_ip}
      mbus:
        valid_for: ${params.cert_validity_period}
        names:
        - ${params.static_ip}
      uaa:
        valid_for: ${params.cert_validity_period}
        names:
        - ${params.static_ip}
      uaa-sp:
        valid_for: ${params.cert_validity_period}
        names:
        - ${params.static_ip}

    blobstore:
      ca:
        valid_for: ${params.ca_validity_period}
      server:
        valid_for: ${params.cert_validity_period}
        names:
        - ${params.static_ip}

    credhub:
      ca:
        valid_for: ${params.ca_validity_period}
      server:
        valid_for: ${params.cert_validity_period}
        names:
        - ${params.static_ip}

    nats:
      ca:
        valid_for: ${params.ca_validity_period}
      server:
        valid_for: ${params.cert_validity_period}
        names:
        - default.nats.bosh-internal
        - ${params.static_ip}
      director:
        valid_for: ${params.cert_validity_period}
        names:
        - default.director.bosh-internal
        - ${params.static_ip}
      health/monitor:
        valid_for: ${params.cert_validity_period}
        names:
        - default.hm.bosh-internal
        - ${params.static_ip}

  vault-credhub-proxy:
    vault-proxy_tls:
      server:
        valid_for: ${params.cert_validity_period}
        signed_by: credhub/ca
        names:
        - ${params.static_ip}

credentials:
  base:
    op/net: ssh 4096
    op/sys:
      password: random 12 fmt crypt-sha512

    blobstore/agent:
      password: random 64 fixed
    blobstore/director:
      password: random 64
    db:
      password: random 64
    nats:
      password: random 64 fixed
    registry:
      password: random 64 fixed

    users/admin:
      password: random 30
    users/hm:
      password: random 30
    users/concourse:
      password: random 30
    vcap:
      password: random 64 fmt crypt-sha512

    credhub/encryption:
      key: random 32 fixed

    uaa/jwt: rsa 2048
    uaa/encryption:
      key: random 64 fixed

    uaa/client:
      secret: random 32
    uaa/clients/director_to_credhub:
      secret: random 32
    uaa/clients/hm:
      secret: random 32
    uaa/clients/uaa_admin:
      secret: random 32
    uaa/clients/prometheus:
      secret: random 32

    uaa/users/credhub-cli:
      password: random 32

  vault-credhub-proxy:
    uaa/users/credhub-admin:
      password: random 32

  external-db:
    external-db/bosh_user:
      password: random 32
    external-db/credhub_user:
      password: random 32
    external-db/uaa_user:
      password: random 32

  proto: &proto
    mbus_bootstrap:
      password: random 64
  bosh-init: *proto

  azure: &azure
    azure/ssh: ssh 2048
  azure-cpi: *azure

  aws: &aws
    aws/ssh: ssh 2048
  aws-cpi: *aws

  openstack: &openstack
    openstack/ssh: ssh 2048
  openstack-cpi: *openstack

provided:
  aws: &provided_aws
    aws:
      keys:
        secret_key:
          sensitive: false
          prompt:    AWS Secret Key
        access_key:
          prompt:    AWS Access Key
  aws-cpi: *provided_aws

  vsphere: &provided_vsphere
    vsphere:
      keys:
        user:
          sensitive: false
          prompt:    Username for BOSH to authenticate with vCenter
        address:
          sensitive: false
          prompt:    IP address of VMWare vCenter Server Appliance
        password:
          prompt:    Password for vCenter user
  vsphere-cpi: *provided_vsphere

  google: &provided_google
    google:
      keys:
        json_key:
          sensitive: false
          prompt:    GCP credentials (generally supplied as a JSON block)
  google-cpi: *provided_google

  azure: &provided_azure
    azure:
      keys:
        client_id:
          sensitive: false
          prompt:    Azure Client ID
        client_secret:
          prompt:    Azure Client Secret
        tenant_id:
          sensitive: false
          prompt:    Azure Tenant ID
        subscription_id:
          sensitive: false
          prompt:    Azure Resource Group to be used by BOSH to deploying VMs
  azure-cpi: *provided_azure

  openstack: &provided_openstack
    openstack:
      keys:
        username:
          sensitive: false
          prompt:    OpenStack username
        password:
          prompt:    OpenStack password
        domain:
          sensitive: false
          prompt:    OpenStack domain
        project:
          sensitive: false
          prompt:    OpenStack project
  openstack: *provided_openstack