spring:
  application:
    name: tbp-core-service
  profiles:
    active: prod
  jackson:
    deserialization:
      accept-float-as-int: false
  jpa:
    open-in-view: false
  flyway:
    enabled: true
    baseline-on-migrate: true
    locations: classpath:db/migration
  threads:
    virtual:
      enabled: true

server:
  port: 8090

management:
  endpoints:
    web:
      exposure:
        include: health
  endpoint:
    health:
      show-details: never
security:
  jwt:
    public-key: ${JWT_PUBLIC_KEY:}
    jwks-url: ${JWT_JWKS_URL:}
app:
  build:
    # Filled from the CI run by the Dockerfile.
    commit: ${APP_BUILD_COMMIT:dev}
    time: ${APP_BUILD_TIME:}
  # The frontend; FRONTEND_HOST in the Deployment compose file. The prod host as default: an image that starts before
  # the compose file sets the env var keeps working.
  frontend-url: ${APP_FRONTEND_URL:https://tbp.andreas-dahm.eu}
  cors:
    allowed-origins: ${app.frontend-url}
  steam:
    api-key: ${STEAM_API_KEY}
    base-url: https://api.steampowered.com
    imageService-url: https://cdn.cloudflare.steamstatic.com/steam/apps/
  igdb:
    # A Twitch developer app (dev.twitch.tv). Without both values time to beat is off.
    client-id: ${IGDB_CLIENT_ID:}
    client-secret: ${IGDB_CLIENT_SECRET:}
    base-url: https://api.igdb.com/v4
    token-base-url: https://id.twitch.tv
  psn:
    # Base64 of 32 random bytes (openssl rand -base64 32). Empty = the PlayStation link is off.
    token-key: ${APP_PSN_TOKEN_KEY:}
    auth-base-url: https://ca.account.sony.com/api/authz/v3/oauth
    api-base-url: https://m.np.playstation.com/api
    # Days before the link ends that the inbox gets its "ends soon" note.
    expiry-warning-days: 2
    # The public client of the PlayStation app, as the psn-api project ships it. Not a secret of ours.
    client-id: 09515159-7237-4370-9b40-3806e67c0891
    client-secret: ucPjka5tntB2KqsP
    redirect-uri: com.scee.psxandroid.scecompcall://redirect
  speedrun:
    # No key needed. false stops every call to speedrun.com.
    enabled: true
    base-url: https://www.speedrun.com/api/v1
  library:
    sync-ttl-hours: 20
    # At most one sync try per user and hour on a visit, also after a failure.
    login-retry-minutes: 60
    force-sync-cooldown-seconds: 60
    running-stale-minutes: 5
    achievement-ttl-hours: 1
    schema-ttl-days: 30
    speedrun-ttl-days: 30
    # Existing games get their IGDB series and companies in batches; 2 IGDB requests per batch.
    credit-ttl-days: 30
    credit-backfill-ms: 30000
    credit-backfill-batch: 250
    edition-ttl-days: 30
    release-ttl-days: 30
    # Reported broken pictures, repaired after the nightly sync.
    image-repair-cron: "0 30 1 * * *"
    merge-undo-purge-cron: "0 45 3 * * *"
    image-repair-batch: 200
    image-repair-max-attempts: 3
    image-repair-retry-days: 30
  rewards:
    # Pile Points of every user, after the nightly sync (23:55) and the image repair (01:30).
    settle-cron: "0 30 2 * * *"
  follow:
    # The hand changes of a followed user are one batch after this quiet time.
    digest-ms: 600000
    quiet-minutes: 10
  inbox:
    purge-cron: "0 15 3 * * *"
    keep-days: 90
  account-cleanup:
    # Log only, delete nothing. Auth's nightly cleanup drives this; see the Deployment README before flipping it.
    dry-run: ${APP_ACCOUNT_CLEANUP_DRY_RUN:true}
    # A prune refuses more orphans than this per run; raise it once for a big cleanup.
    max-orphans: 5

resilience4j:
  retry:
    instances:
      steamApi:
        max-attempts: 3
        wait-duration: 500ms
        enable-exponential-backoff: true
        exponential-backoff-multiplier: 2
        retry-exceptions:
          - org.springframework.web.client.RestClientException
          - org.springframework.web.client.ResourceAccessException
        # A 4xx (a refused key, a private list) is the same on the next try.
        ignore-exceptions:
          - org.springframework.web.client.HttpClientErrorException
      # Calls a page waits for, and the optional wishlist: one try, else a Steam outage holds every page (or the
      # sync) for three read timeouts.
      steamApiOnce:
        max-attempts: 1
  ratelimiter:
    instances:
      steamApi:
        # Steam allows ~100k req/day. Cap at ~2 req/s to leave headroom for bursts.
        limit-for-period: 2
        limit-refresh-period: 1s
        timeout-duration: 5s
      speedrunApi:
        # speedrun.com allows 100 requests/min per IP.
        limit-for-period: 1
        limit-refresh-period: 1s
        timeout-duration: 30s
      igdbApi:
        # IGDB allows 4 requests/s. Taken per HTTP request.
        limit-for-period: 4
        limit-refresh-period: 1s
        timeout-duration: 10s
      psnApi:
        # Unofficial API; third-party tools limit themselves to about 300 requests / 15 min. One request every 4 s
        # for the whole server, taken per HTTP request.
        limit-for-period: 1
        limit-refresh-period: 4s
        timeout-duration: 30s