# Prod counterpart of data.yaml (the dev-only version, kept as-is for local iteration —
# see docker-compose.openzaak.yml's own comment on why it hardcodes a client secret). This
# template has no secret in it; render-prod-secrets.sh substitutes OPENZAAK_CLIENT_SECRET
# into it to produce the gitignored data.prod.yaml that docker-compose.openzaak.prod.yml
# mounts over the container's data.yaml.
#
# Least-privilege client scopes: heeft_alle_autorisaties is false, matching the dev
# harness (setup_configuration has no YAML field for granular `autorisaties` — see
# data.yaml's comment). This template only covers infra config; a real deploy must grant this
# client's Autorisaties the same way bootstrap-catalogus.sh does for the dev harness — via
# `manage.py shell` (or the Autorisaties REST API from an already-privileged caller) against
# the production catalogus/zaaktype URLs, once, as part of standing up that environment.
sites_config_enable: true
sites_config:
  items:
    - domain: ${OPENZAAK_SITE_DOMAIN}
      name: OpenZaak (production)

vng_api_common_credentials_config_enable: true
vng_api_common_credentials:
  items:
    - identifier: ${OPENZAAK_CLIENT_ID}
      secret: ${OPENZAAK_CLIENT_SECRET}

vng_api_common_applicaties_config_enable: true
vng_api_common_applicaties:
  items:
    - uuid: ${OPENZAAK_APPLICATIE_UUID}
      client_ids:
        - ${OPENZAAK_CLIENT_ID}
      label: BIG-register BFF (production)
      heeft_alle_autorisaties: false