config.example.darwin.yaml

# =============================================================================
# macOS (Darwin) Configuration for Hypeman
# =============================================================================
# Copy this file to ~/.config/hypeman/config.yaml and customize for your
# environment.
#
# Configuration precedence (highest to lowest):
#   1. Environment variables (e.g., JWT_SECRET, PORT)
#   2. This YAML config file
#   3. Built-in defaults
#
# Key differences from Linux (see config.example.yaml):
# - hypervisor.default: Use "vz" (Virtualization.framework) instead of cloud-hypervisor/qemu
# - data_dir: Uses macOS conventions (~/Library/Application Support)
# - Network settings: network.bridge_name, subnet_cidr, etc. are IGNORED (Hypeman targets VZ's default 192.168.64.0/24 shared NAT)
# - Rate limiting: Not supported on macOS (no tc/HTB equivalent)
# - GPU passthrough: Not supported on macOS
# =============================================================================

# Required - used to sign and verify API tokens
jwt_secret: dev-secret-change-me

# Data directory - use macOS conventions
# Note: ~ is NOT expanded; use full path or let the install script fill this in
data_dir: ~/Library/Application Support/hypeman

# Server configuration
port: "4973"

# =============================================================================
# Hypervisor Configuration (IMPORTANT FOR MACOS)
# =============================================================================
# On macOS, use "vz" (Virtualization.framework)
# - "cloud-hypervisor" and "qemu" are NOT supported on macOS
hypervisor:
  default: vz
  memory:
    enabled: false
    kernel_page_init_mode: hardened
    reclaim_enabled: true
    vz_balloon_required: true
    active_ballooning:
      enabled: false
      poll_interval: 2s
      pressure_high_watermark_available_percent: 10
      pressure_low_watermark_available_percent: 15
      protected_floor_percent: 50
      protected_floor_min_bytes: 536870912
      min_adjustment_bytes: 67108864
      per_vm_max_step_bytes: 268435456
      per_vm_cooldown: 5s

# =============================================================================
# Network Configuration (DIFFERENT ON MACOS)
# =============================================================================
# On macOS with VZ, Hypeman targets Virtualization.framework's default shared NAT:
# - Hypeman statically allocates VM addresses from 192.168.64.0/24
# - The expected host gateway is 192.168.64.1
# - A host-level vmnet Shared_Net_Address override is not currently supported
# - Other vmnet clients can receive DHCP leases in the same subnet; avoid running
#   overlapping VM workloads when static-address collisions are possible
# - No TAP devices, user-created bridges, or iptables rules are needed
# - The following settings are IGNORED on macOS because VZ owns the network:
#   network.bridge_name, subnet_cidr, subnet_gateway, uplink_interface
network:
  dns_server: 8.8.8.8

# =============================================================================
# Logging
# =============================================================================
logging:
  level: debug

# =============================================================================
# Images
# =============================================================================
# images:
#   auto_delete:
#     enabled: false              # server-wide automatic deletion of cached converted images
#     unused_for: 720h            # delete only after no instances or snapshots reference the image for this long
#     allowed:                    # safety gate: only delete repositories matching one of these patterns
#       - docker.io/library/*     # match normalized repository names
#       - ghcr.io/kernel/*        # use ["*"] to allow deletion for every repository
#                                 # only affects data_dir/images, not the shared OCI cache
#   oci_cache_gc:
#     enabled: false              # mark-and-sweep GC for data_dir/system/oci-cache
#     interval: 1h                # how often to run a sweep
#     min_blob_age: 1h            # grace period; blobs written more recently are kept
#                                 # to avoid racing with concurrent pulls

# =============================================================================
# Caddy / Ingress Configuration
# =============================================================================
caddy:
  listen_address: 0.0.0.0
  admin_address: 127.0.0.1
  admin_port: 2019
  # Note: 5353 is used by mDNSResponder (Bonjour) on macOS, using 5354 instead
  internal_dns_port: 5354
  stop_on_shutdown: false

# =============================================================================
# Public API Ingress (optional)
# =============================================================================
# Exposes the Hypeman API through Caddy. Leave hostname empty to use the API
# directly on port 4973 instead.
# api:
#   hostname: api.example.com
#   tls: true                     # requires the hostname in acme.allowed_domains
#   redirect_http: true           # redirect HTTP requests to HTTPS

# =============================================================================
# Build System Configuration
# =============================================================================
# For builds on macOS with VZ, the registry URL needs to be accessible from
# NAT VMs. On the default shared NAT targeted by Hypeman, the host is at
# 192.168.64.1.
#
# IMPORTANT: "host.docker.internal" does NOT work in vz VMs - that's a Docker
# Desktop-specific hostname. Use the NAT gateway IP instead.
registry:
  url: 192.168.64.1:4973
  insecure: true

build:
  # builder_image: ""  # empty (default) = built from Dockerfile on first run
  docker_socket: /var/run/docker.sock
  max_concurrent_source_builds: 2
  timeout: 600

# =============================================================================
# Resource Limits (same as Linux)
# =============================================================================
limits:
  max_vcpus_per_instance: 4
  max_memory_per_instance: 8GB
  # max_concurrent_pushes: 2     # concurrent outbound registry pushes
  # max_total_volume_storage: ""  # 0 or empty = unlimited

# =============================================================================
# OpenTelemetry (optional, same as Linux)
# =============================================================================
# metrics:
#   listen_address: 127.0.0.1
#   port: 9464
#   vm_label_budget: 200
#   resource_refresh_interval: 120s
#
# otel:
#   enabled: false
#   endpoint: 127.0.0.1:4317
#   service_name: hypeman
#   insecure: true
#   metric_export_interval: 60s
# env: dev

# =============================================================================
# TLS / ACME Configuration (same as Linux)
# =============================================================================
# acme:
#   email: admin@example.com
#   dns_provider: cloudflare
#   allowed_domains: "*.example.com"
#   cloudflare_api_token: ""

# =============================================================================
# macOS Limitations
# =============================================================================
# The following features are NOT AVAILABLE on macOS:
#
# 1. GPU Passthrough (VFIO, mdev)
#    - gpu.profile_cache_ttl is ignored
#    - Device registration/binding will fail
#
# 2. Network Rate Limiting
#    - network.upload_burst_multiplier, download_burst_multiplier are ignored
#    - No tc/HTB equivalent on macOS
#
# 3. CPU/Memory Hotplug
#    - Resize operations not supported
#
# 4. Disk I/O Limiting
#    - capacity.disk_io, oversubscription.disk_io are ignored
#
# 5. Snapshots (requires macOS 14+ on Apple Silicon)
#    - SaveMachineStateToPath/RestoreMachineStateFromURL require macOS 14+
#    - Only supported on ARM64 (Apple Silicon) Macs