import { CodeBlock } from "../components/CodeBlock";
import { Callout } from "../components/Callout";
import { ParamTable } from "../components/ParamTable";

export function ConfigurationPage() {
  return (
    <div>
      <h1 id="configuration">Configuration Reference</h1>
      <p>
        Veylant IA is configured via <code>config.yaml</code> at the repository root. Any key can
        be overridden via an environment variable using the <code>VEYLANT_</code> prefix and
        replacing <code>.</code> with <code>_</code>.
      </p>

      <Callout type="info" title="Environment variable override">
        <code>server.port: 9000</code> → <code>VEYLANT_SERVER_PORT=9000</code>
        <br />
        <code>pii.timeout_ms: 200</code> → <code>VEYLANT_PII_TIMEOUT_MS=200</code>
      </Callout>

      <h2 id="full-config">Full config.yaml</h2>
      <CodeBlock
        language="yaml"
        code={`server:
  port: 8090
  env: development       # development | production
  read_timeout: 30s
  write_timeout: 60s
  allowed_origins:
    - "http://localhost:3000"

database:
  url: "postgres://veylant:veylant@localhost:5432/veylant?sslmode=disable"
  max_open_conns: 25
  max_idle_conns: 5

redis:
  url: "redis://localhost:6379"
  db: 0

clickhouse:
  dsn: "clickhouse://localhost:9000/veylant?dial_timeout=5s"

keycloak:
  base_url: "http://localhost:8080"
  realm: "veylant"
  client_id: "veylant-proxy"

pii:
  enabled: true
  grpc_addr: "localhost:50051"
  timeout_ms: 100
  fail_open: true        # if true, continue on PII service failure

providers:
  openai:
    api_key: ""          # or VEYLANT_PROVIDERS_OPENAI_API_KEY
    base_url: "https://api.openai.com/v1"
  anthropic:
    api_key: ""
    base_url: "https://api.anthropic.com"
  azure:
    api_key: ""
    endpoint: ""
    api_version: "2024-02-01"
  mistral:
    api_key: ""
    base_url: "https://api.mistral.ai/v1"
  ollama:
    base_url: "http://localhost:11434"

rbac:
  user_allowed_models:
    - "gpt-4o-mini"
    - "mistral-medium"
  # admin and manager have unrestricted model access

circuit_breaker:
  threshold: 5           # failures before opening
  open_ttl: 60s          # how long to stay open

rate_limit:
  default_rpm: 1000      # requests per minute per tenant
  default_tpm: 100000    # tokens per minute per tenant

metrics:
  enabled: true
  path: "/metrics"

audit:
  batch_size: 100
  flush_interval: 5s

crypto:
  key: ""                # 32-byte AES key (base64), REQUIRED in production

vault:
  enabled: false
  addr: "http://localhost:8200"
  token: ""`}
      />

      <h2 id="server">Server Settings</h2>
      <ParamTable
        title="server.*"
        params={[
          { name: "server.port", type: "int", required: false, default: "8090", description: "HTTP server port" },
          { name: "server.env", type: "string", required: false, default: "development", description: "Environment: development | production. In production, all service failures are fatal." },
          { name: "server.allowed_origins", type: "[]string", required: false, default: '["http://localhost:3000"]', description: "CORS allowed origins for /v1/* routes" },
        ]}
      />

      <h2 id="pii-config">PII Settings</h2>
      <ParamTable
        title="pii.*"
        params={[
          { name: "pii.enabled", type: "bool", required: false, default: "true", description: "Enable PII detection. When false, prompts are forwarded as-is." },
          { name: "pii.grpc_addr", type: "string", required: false, default: "localhost:50051", description: "gRPC address of the PII service" },
          { name: "pii.timeout_ms", type: "int", required: false, default: "100", description: "PII detection timeout in milliseconds (latency budget: <50ms)" },
          { name: "pii.fail_open", type: "bool", required: false, default: "true", description: "If true, continue on PII failure (request proceeds unredacted). If false, return 503." },
        ]}
      />

      <h2 id="production-checklist">Production Checklist</h2>
      <Callout type="warning" title="Required in production">
        When <code>server.env=production</code>, these values must be set or the proxy fails to
        start:
      </Callout>
      <ul>
        <li>
          <code>crypto.key</code> — 32-byte AES-256 key (base64 encoded)
        </li>
        <li>
          <code>database.url</code> — PostgreSQL DSN with TLS
        </li>
        <li>
          <code>keycloak.base_url</code> — reachable Keycloak instance
        </li>
        <li>At least one provider API key</li>
      </ul>

      <CodeBlock
        language="bash"
        code={`# Generate a secure AES-256 key
openssl rand -base64 32

# Set in environment (never commit to git)
export VEYLANT_CRYPTO_KEY="$(openssl rand -base64 32)"`}
      />
    </div>
  );
}
