# aegisgate-platform.yaml
server:
  proxy_port: 8443
  dashboard_port: 8444
  tls_cert: /etc/aegisgate/cert.pem
  tls_key: /etc/aegisgate/key.pem

database:
  url: "postgres://aegisgate:password@localhost:5432/aegisgate"

sso:
  enabled: true
  # See SSO Configuration Guide for provider config

siem:
  enabled: true
  # See SIEM & SOAR Integration guide

soar:
  enabled: true
  # See SIEM & SOAR Integration guide

trust:
  enabled: true
  require_license: true

ml_threat_detection_enabled: true
ml_shadow_mode: false  # Set to true for first 7 days

# Shared PostgreSQL (managed or dedicated)
database:
  url: "postgres://aegisgate:password@pg-cluster.internal:5432/aegisgate"
  max_connections: 50

# Redis for distributed state (if using cluster features)
cluster:
  enabled: true
  redis_url: "redis://redis.internal:6379"

# Each instance runs behind a load balancer
# TLS terminated at the load balancer (nginx/ALB)

# No external network access
server:
  proxy_port: 8443
  dashboard_port: 8444

database:
  url: "postgres://aegisgate:password@db.internal:5432/aegisgate"

# SSO via on-prem IdP (Keycloak, AD FS)
sso:
  enabled: true
  saml:
    enabled: true
    idp_metadata_url: "https://keycloak.internal/realms/your-realm/protocol/saml/descriptor"

# SIEM via internal Syslog or Splunk HEC
siem:
  enabled: true
  platforms:
    - platform: splunk
      endpoint: "https://splunk.internal:8088/services/collector"
      token: "${SPLUNK_HEC_TOKEN}"

# No external API calls
ml_shadow_mode: false

sso:
  enabled: true

  oidc:
    enabled: true
    provider: azure           # or: google, okta, generic
    client_id: "your-client-id"
    client_secret: "your-client-secret"
    redirect_url: "https://aegisgate.yourcompany.com/auth/callback"
    scopes:
      - openid
      - profile
      - email

  session:
    duration_hours: 8
    secure: true
    same_site: "lax"

sso:
  role_mappings:
    - idp_group: "security-admins"
      aegisgate_role: "admin"
    - idp_group: "security-analysts"
      aegisgate_role: "analyst"
    - idp_group: "developers"
      aegisgate_role: "viewer"

  allowed_domains:
    - "yourcompany.com"
    - "subsidiary.com"

# Test SSO login flow
curl -L https://aegisgate.yourcompany.com/auth/login

# Should redirect to your IdP login page
# After authentication, should redirect back to dashboard

siem:
  enabled: true
  source: "aegisgate-prod"
  poll_interval: 5s
  batch_size: 100
  platforms:
    - platform: splunk
      endpoint: "https://splunk.yourcompany.com:8088/services/collector"
      token: "${SPLUNK_HEC_TOKEN}"
      format: json
      enabled: true

    - platform: datadog
      endpoint: "https://api.datadoghq.com/api/v2/logs"
      token: "${DD_API_KEY}"
      format: json
      enabled: true

# Check SIEM status
curl -H "X-API-Key: your-key" \
  https://aegisgate.yourcompany.com/api/v1/siem/status

# Generate a test event
curl -X POST -H "X-API-Key: your-key" \
  -d '{"content":"test-secret AKIAIOSFODNN7EXAMPLE"}' \
  https://aegisgate.yourcompany.com/v1/scan

# Check your SIEM for the forwarded event

soar:
  enabled: true
  platforms:
    - platform: pagerduty
      endpoint: "https://events.pagerduty.com/v2/enqueue"
      token: "${PAGERDUTY_INTEGRATION_KEY}"
      severity_threshold: "high"  # Only high+ severity triggers SOAR

    - platform: jira
      endpoint: "https://yourcompany.atlassian.net"
      token: "${JIRA_API_TOKEN}"
      project: "SEC"
      severity_threshold: "medium"

    - platform: servicenow
      endpoint: "https://yourcompany.service-now.com"
      token: "${SN_API_TOKEN}"
      severity_threshold: "critical"

compliance:
  enabled: true
  frameworks:
    - soc2
    - hipaa
    - pci_dss
    - eu_ai_act
    - nist_ai_rmf
    - owasp_llm
    - iso_27001

  # Live compliance scanning
  live_scan: true
  scan_interval: 1h

  # Report generation
  auto_generate_reports: true
  report_retention_days: 365

Request received → POST /api/v1/dsar/export → Data bundle generated
                 → POST /api/v1/dsar/erase  → Data erased (if not under legal hold)
                                              → 409 Conflict if under hold

Litigation notice → POST /api/v1/legal-holds → Entity's data frozen
                  → DSAR erasure blocked (409 Conflict)
                  → DELETE /api/v1/legal-holds/{id} → Hold released, data can be pruned

trust:
  enabled: true
  require_license: true
  score_threshold_suspicious: 50
  score_threshold_blocked: 50
  anomaly_sensitivity: 0.3
  incident_decay_hours: 168

multi_tenant:
  enabled: true
  default_tenant: "default"

  # Tenant isolation via Row-Level Security (RLS)
  rls:
    enabled: true
    policy_column: "tenant_id"

  # Per-tenant configuration
  tenants:
    - id: "tenant-a"
      name: "Business Unit A"
      sso_provider: "okta-tenant-a"
      siem_platform: "splunk-tenant-a"
    - id: "tenant-b"
      name: "Business Unit B"
      sso_provider: "azure-tenant-b"
      siem_platform: "datadog-tenant-b"

# Create an A/B test
curl -X POST -H "X-API-Key: your-key" \
  -d '{
    "name": "v4.4-evaluation",
    "description": "Compare current vs new model",
    "variants": [
      {"name": "champion", "weight": 90, "model_ref": "model-v11b"},
      {"name": "challenger", "weight": 10, "model_ref": "model-v12"}
    ]
  }' \
  https://aegisgate.yourcompany.com/api/v1/abtest/tests

# Start the test
curl -X POST -H "X-API-Key: your-key" \
  https://aegisgate.yourcompany.com/api/v1/abtest/tests/{id}/start

# Check metrics
curl -H "X-API-Key: your-key" \
  https://aegisgate.yourcompany.com/api/v1/abtest/tests/{id}/metrics

# Basic health (proxy + persistence + license + certificates)
curl https://aegisgate.yourcompany.com/health

# Extended health (includes scanner + A2A)
curl https://aegisgate.yourcompany.com/api/v1/health

# Readiness check (for load balancer)
curl https://aegisgate.yourcompany.com/ready

aegisgate_requests_total{tier="enterprise",result="blocked"}
aegisgate_threats_detected_total{category="pii",layer="l1"}
aegisgate_ml_inference_latency_ms
aegisgate_trust_score{agent="agent-001"}
aegisgate_siem_events_forwarded_total{platform="splunk"}
aegisgate_soar_incidents_sent_total{platform="pagerduty"}