manifest.yml

name: ((deployment_name))

influx_db:
  ip: &influxdb_ip ((web_static_ip))
  url: &influxdb_url http://((web_static_ip)):8086

telegraf:
  <<: &influxdb_properties
    influxdb:
      database: concourse
      url: *influxdb_url
      username: admin
      password: ((influxdb_password))
  jobs:
  # captures host metrics
  - <<: &telegraf_job
      name: telegraf
      release: telegraf
      properties:
        <<: *influxdb_properties
  # captures per-process metrics
  # https://github.com/influxdata/telegraf/blob/4d3519756c278c90d1207518bcc97a10c28555f3/plugins/inputs/procstat/README.md
  - <<: &telegraf_agent_job
      name: telegraf-agent
      release: telegraf-agent
      properties:
        <<: *influxdb_properties
        inputs:
          procstat:
            pattern: 'bin/concourse|bin/baggageclaim|garden-properties|bin/runc|resource/check|gzip|erlc|beam.smp|ct_run|dockerd|telegraf|postgres'

variables:
- name: credhub-encryption-password
  type: password
  options: {length: 40}
- name: atc_encryption_key
  type: password
  options: {length: 32}
- name: uaa-jwt
  type: rsa
  options: {key_length: 4096}
- name: uaa-users-admin
  type: password
- name: uaa-admin
  type: password
- name: uaa-login
  type: password
- name: uaa_clients_atc_to_credhub
  type: password
- name: credhub_cli_password
  type: password
- name: credhub_admin_client_secret
  type: password
- name: uaa-passphrase
  type: password
- name: atc_password
  type: password
- name: influxdb_password
  type: password
- name: token_signing_key
  type: rsa
- name: tsa_host_key
  type: ssh
- name: worker_key
  type: ssh
- name: ca
  options:
    common_name: ConcourseCA
    is_ca: true
  type: certificate
- name: internal_tls
  type: certificate
  options:
    ca: ca
    common_name: ((domain))
    alternative_names:
    - ((domain))
    - 127.0.0.1
- name: external_tls
  type: certificate
  options:
    ca: ca
    common_name: ((domain))

releases:
- name: concourse
  version: latest
- name: grafana
  version: latest
- name: influxdb
  version: latest
- name: credhub
  version: latest
- name: uaa
  version: latest
- name: bosh-dns
  version: latest
- name: bpm
  version: latest
- name: telegraf
  version: latest
- name: telegraf-agent
  version: latest

stemcells:
- alias: jammy
  os: ubuntu-jammy
  version: latest

tags:
  control-tower-project: ((project))
  control-tower-component: concourse

instance_groups:
- name: web
  azs: [z1]
  persistent_disk_type: ((persistent_disk))
  instances: 1
  vm_extensions:
  - atc
  networks:
  - name: ((web_network_name))
    default: [dns, gateway]
    static_ips: [*influxdb_ip]
  - name: vip
    static_ips: [((atc_eip))]
  stemcell: jammy
  vm_type: ((web_vm_type))
  jobs:
  - name: bpm
    release: bpm
  - name: web
    release: concourse
    properties:
      encryption_key: ((atc_encryption_key))
      allow_self_signed_certificates: true
      add_local_users: ['admin:((atc_password))']
      enable_global_resources: ((enable_global_resources))
      enable_pipeline_instances: ((enable_pipeline_instances))
      redact_secrets: true
      main_team:
        auth:
          local:
            users: [admin]
      bind_port: 80
      credhub:
        client_id: atc_to_credhub
        client_secret: ((uaa_clients_atc_to_credhub))
        tls:
          ca_cert:
            certificate: ((internal_tls.ca))
        url: https://((domain)):8844
      external_url: https://((domain))
      influxdb:
        database: concourse
        password: ((influxdb_password))
        url: *influxdb_url
        username: admin
      log_level: debug
      postgresql:
        ca_cert:
          certificate: ((postgres_ca_cert))
        database: concourse_atc
        host: ((postgres_host))
        port: ((postgres_port))
        role:
          name: ((postgres_role))
          password: ((postgres_password))
        sslmode: verify-ca
      tls:
        bind_port: 443
        cert:
          certificate: ((external_tls.certificate))
          private_key: ((external_tls.private_key))
      token_signing_key: ((token_signing_key))
      worker_gateway:
        host_key: ((tsa_host_key))
        authorized_keys: [((worker_key.public_key))]
  - name: influxdb
    release: influxdb
    properties:
      influxdb:
        database: concourse
        password: ((influxdb_password))
        user: admin
        retention: ((influx_db_retention_period))
        data:
          index_version: tsi1
  - <<: *telegraf_job
  - <<: *telegraf_agent_job
  - name: grafana
    release: grafana
    properties:
      grafana:
        admin_password: ((atc_password))
        admin_username: admin
        dashboards:
        - name: Concourse
          content: ((grafana_dashboard))
        datasources:
        - name: concourse
          database_name: concourse
          url: *influxdb_url
          database_type: influxdb
          user: admin
          password: ((influxdb_password))
        # Leaving duplicate datasource in case we split metrics out
        # to a separate vm in the future
        - name: telegraf
          database_name: concourse
          url: *influxdb_url
          database_type: influxdb
          user: admin
          password: ((influxdb_password))
        listen_port: 3000
        root_url: https://((domain)):3000/
        ssl:
          cert: ((external_tls.certificate))
          key: ((external_tls.private_key))
  - name: uaa
    release: uaa
    properties:
      encryption:
        encryption_keys:
          - label: 'uaa-passphrase'
            passphrase: ((uaa-passphrase))
        active_key_label: 'uaa-passphrase'
      uaa:
        url: https://((domain)):8443
        catalina_opts: -Djava.security.egd=file:/dev/./urandom -Xmx768m -XX:MaxMetaspaceSize=256m
        scim:
          users:
          - name: admin
            password: ((uaa-users-admin))
            groups:
            - scim.write
            - scim.read
            - bosh.admin
            - credhub.read
            - credhub.write
          - name: credhub-cli
            password: ((credhub_cli_password))
            groups:
            - credhub.read
            - credhub.write
        clients:
          credhub_cli:
            override: true
            authorized-grant-types: password,refresh_token
            scope: credhub.read,credhub.write
            authorities: uaa.none
            access-token-validity: 30
            refresh-token-validity: 3600
            secret: ""
          credhub_admin:
            override: true
            authorized-grant-types: client_credentials
            scope: ""
            authorities: credhub.read,credhub.write
            access-token-validity: 30
            refresh-token-validity: 3600
            secret: ((credhub_admin_client_secret))
          atc_to_credhub:
            override: true
            authorized-grant-types: client_credentials
            scope: ""
            authorities: credhub.read,credhub.write
            access-token-validity: 3600
            secret: ((uaa_clients_atc_to_credhub))
        admin: {client_secret: ((uaa-admin))}
        login: {client_secret: ((uaa-login))}
        zones: {internal: {hostnames: []}}
        sslCertificate: ((internal_tls.certificate))
        sslPrivateKey: ((internal_tls.private_key))
        jwt:
          revocable: true
          policy:
            active_key_id: key-1
            keys:
              key-1:
                signingKey: ((uaa-jwt.private_key))
      uaadb:
        address: ((postgres_host))
        port: ((postgres_port))
        db_scheme: postgresql
        tls: enabled_skip_hostname_validation
        databases:
        - tag: uaa
          name: uaa
        roles:
        - tag: admin
          name: ((postgres_role))
          password: ((postgres_password))
      login:
        saml:
          serviceProviderCertificate: ((internal_tls.certificate))
          serviceProviderKey: ((internal_tls.private_key))
          serviceProviderKeyPassword: ""
  - name: credhub
    release: credhub
    properties:
      credhub:
        tls: ((internal_tls))
        authorization:
          permissions:
            - path: /*
              actors: ["uaa-client:credhub_cli","uaa-client:credhub_admin"]
              operations: [read,write,delete,read_acl,write_acl]
            - path: /concourse/*
              actors: ["uaa-client:atc_to_credhub"]
              operations: [read,read_acl]
        authentication:
          uaa:
            url: https://((domain)):8443
            verification_key: ((uaa-jwt.public_key))
            ca_certs: [((internal_tls.ca))]
        data_storage:
          type: postgres
          username: ((postgres_role))
          password: ((postgres_password))
          host: ((postgres_host))
          port: ((postgres_port))
          database: credhub
          require_tls: true
          tls_ca: ((postgres_ca_cert))
        encryption:
          keys:
          - provider_name: int
            active: true
            key_properties:
              encryption_password: ((credhub-encryption-password))
          providers:
          - name: int
            type: internal
  - name: bosh-dns
    release: bosh-dns
    properties:
      cache:
        enabled: true
      api:
        server:
          tls: ((internal_tls))
        client:
          tls: ((internal_tls))

- name: worker
  azs: [z1]
  instances: ((worker_count))
  networks:
  - name: ((worker_network_name))
    default: [dns, gateway]
  stemcell: jammy
  vm_type: ((worker_vm_type))
  jobs:
  - name: worker
    release: concourse
    properties:
      drain_timeout: 10m
      worker_gateway: {worker_key: ((worker_key))}
  - <<: *telegraf_job
  - <<: *telegraf_agent_job

update:
  canaries: 1
  canary_watch_time: 1000-600000
  max_in_flight: 3
  serial: false
  update_watch_time: 1000-600000