{
  "ConnectionStrings": {
    "Default": "server=localhost;port=3306;database=ttrating;uid=ttrating;Pwd=tTraTing!1;Old Guids=true;"
  },

  "TokenTT": "5487138946:AAFfhULGpWcy81MTvzszx1jjUZc7W4ypstg",

  "GoogleGeoKey": "AIzaSyD9ENWvXc7ctqmQITCsAKoF3QN_zHoI8Go",

  "AppSettings": {
    "BotName": "tt_rating_bot",
    "MobileAppScheme": "ttar",
    "PasswordResetWebUrl": "https://ttar.app",
    "Cors": [ "https://ttar.app" ],
    "AllowedAuthRedirectUris": [ "https://ttar.app/auth" ]
  },

  // Centralized protection against request flooding that would overload the DB.
  // Set "Enabled": false to switch off all rate limiting at once if anything goes wrong.
  "RateLimit": {
    "Enabled": true,
    "Global": {
      "WindowSeconds": 60,
      "AnonymousPermitsPerWindow": 60,
      "AuthenticatedPermitsPerWindow": 240,
      "BurstSize": 20,
      "QueueLimit": 0
    },
    "Heavy": {
      "WindowSeconds": 60,
      "AnonymousPermitsPerWindow": 15,
      "AuthenticatedPermitsPerWindow": 40,
      "BurstSize": 10,
      "QueueLimit": 0
    },
    // Avatar image endpoint = static-file emulator; a single profile view fans out many requests.
    "Avatars": {
      "WindowSeconds": 60,
      "AnonymousPermitsPerWindow": 300,
      "AuthenticatedPermitsPerWindow": 600,
      "BurstSize": 100,
      "QueueLimit": 0
    },
    "HeavyConcurrency": {
      "PermitLimit": 10,
      "QueueLimit": 20
    },
    // Telegram alert to the super-admin when a client is throttled. Self-limited so a flood
    // can't turn the alerting into its own flood: one alert per client per cooldown, capped globally.
    "RejectionReport": {
      "Enabled": true,
      "PerClientCooldownSeconds": 600,
      "GlobalMaxPerWindow": 6,
      "GlobalWindowSeconds": 60
    },
    // IPs of trusted reverse proxies (Apache). Loopback is always trusted; add the proxy
    // address here if it forwards from a non-loopback interface, otherwise per-IP limits
    // collapse because every request appears to originate from the proxy.
    "KnownProxies": []
  },

  // Idempotency-Key support of the API writes: a retry with the same key gets the stored response instead of a
  // second run. "Enabled": false stops advertising Idempotency-Supported, so clients stop retrying writes.
  "Idempotency": {
    "Enabled": true,
    "Retention": "1.00:00:00",
    "InProgressTimeout": "00:02:00"
  },

  // City of the client's IP (DB-IP City Lite, CC BY 4.0 — the client shows the attribution): the venue list of a client
  // sending no coordinates starts from it. The bot downloads the monthly database into DatabaseDirectory and the API
  // reads it from there, so both need the same folder, one that survives a deploy (default: ~/.local/share/ttar/geoip).
  "IpGeo": {
    "Enabled": true,
    "DatabaseDirectory": "/home/geoip"
  },

  // Operating expenses of the running month in US dollars (hosting, licenses, etc.): the "Expenses and support" page
  // and its menu banner. A closed month gets the value of that moment fixed in DonationMonths. 0 switches it off.
  "Donations": {
    "MonthlyExpenses": 285, // +1 for RU proxy
    // Kind: External | Acquiring | Wallet | Transfer. Countries (ISO alpha-2, upper case): offered only there, listed first;
    // empty = everyone. ExceptCountries: a method for everyone withheld there (kept when the country is unknown).
    "Methods": [
      {
        "Id": "erip-phone",
        "Kind": "Transfer",
        "Phone": "+375293360659",
        "Bank": "Приорбанк",
        "Countries": [ "BY" ]
      },
      {
        // «Мой QR» from raschet.by/qr: the same phone, no amount (the payer enters it).
        "Id": "erip-qr",
        "Kind": "Transfer",
        "Url": "https://pay.raschet.by/#00020132420010by.raschet010753375311013+37529336065953039335802BY6304CB5C",
        "Countries": [ "BY" ]
      },
      {
        "Id": "card-belkart-by",
        "Kind": "Transfer",
        "Card": "9112382050030103",
        "Holder": "VITALY FILATENKO",
        "Countries": [ "BY" ]
      },
      {
        // The Russian Belkart keeps the old id: released clients only show the ids they know.
        "Id": "card-belkart",
        "Kind": "Transfer",
        "Card": "9112382050226289",
        "Holder": "VITALY FILATENKO",
        "Countries": [ "RU" ]
      },
      {
        "Id": "card-mastercard",
        "Kind": "Transfer",
        "Card": "5489529626678988",
        "Holder": "VITALY FILATENKO",
        "ExceptCountries": [ "BY" ]
      }
      // Switched off for now; the client still supports it.
      //{
      //  "Id": "boosty",
      //  "Kind": "External",
      //  "Url": "https://boosty.to/ttar.app/donate"
      //}
    ]
  },

  "AuthOptions": {
    "Issuer": "Matroskin inc. :)",
    "Audience": "ttar-mobile",
    "SecretKey": "sorokTysiahObez'yanITakDaleePoTekstu...(c)S.L.",
    "TokenExpirationMinutes": 1200, // 20 hours
    "RefreshTokenExpirationDays": 15,
    "TokenGracePeriodSeconds": 30,
    "UnusedReplacementGraceSeconds": 600,
    "SessionIdLifetimeDays": 365,
    "PasswordResetTokenExpirationMinutes": 60,
    "EmailConfirmationTokenExpirationMinutes": 1440, // 24 hours
    "LoginExchangeTokenExpirationSeconds": 60
  },

  // Telegram Login (OpenID Connect) of tt_rating_bot. Staging/Development override it with tt_rating_dev_bot.
  "Authentication": {
    "Telegram": {
      "ClientId": "5487138946",
      "ClientSecret": "cokhqhobfQqFH_eab4916zRr9Uyb9YK05TltChvc5peNWLpgVG4Y8w"
    }
  },

  // "Login with TTAR" OpenID Connect provider (OpenIddict server). Cert files live in
  // /home/ttar.app/oidc-keys/prod/ on the server (outside the deploy target). Passwords stored here
  // for convenience; move to a secret store when hardening further.
  "OpenIddict": {
    "Issuer": "https://api.ttar.app",
    "WebLoginUrl": "https://ttar.app/oidc/login",
    "WebPostLogoutRedirectUris": [ "https://ttar.app/login" ],
    "AccessTokenLifetimeMinutes": 60,
    "RefreshTokenLifetimeDays": 14,
    "SigningCertificatePath": "/home/ttar.app/oidc-keys/prod/signing.pfx",
    "SigningCertificatePassword": "oidcProd$4pwd",
    "EncryptionCertificatePath": "/home/ttar.app/oidc-keys/prod/encryption.pfx",
    "EncryptionCertificatePassword": "oidcProd$4pwd",
    "DataProtectionKeysPath": "/home/ttar.app/oidc-keys/prod/dp-keys",
    "Clients": [
      {
        "ClientId": "ttar-prospin",
        "DisplayName": "ProSpin Georgia",
        "RedirectUris": [
          "https://prospin-api-194894830109.europe-central2.run.app/integrations/ttar/callback"
        ]
      }
    ]
  },

  "RTTF": {
    "Login": "TTAR",
    "Password": "TTartarary",
    "HttpClientTimeout": 30,
    "UseProxy": true,
    "Proxy": {
      "Address": "http://138.59.5.113:9855",
      "Username": "xUwx8h",
      "Password": "TX7vWa"
    }
  },

  "TtarConfiguration": {
    "WinsDivider": 2,
    "DefaultRatingType": "Main",
    "WebAppUrl": "https://ttar.app",
    "ApiBaseUrl": "http://localhost:5000",
    "InternalBroadcastKey": "ibbQRE20Je_zCsTQg-Dne0wHPHUvWCotjPe4Fnntbyo=",
    "ApiPublicUrl": "https://api.ttar.app",
    "EmailPreferencesKey": "-wbjqsyTmCj9HME9J-wMpIZqmHWGx6V2t0tROgM4eO0=",
    "StartRatingElo": 1000,
    "InactiveQualificationDays": 178,
    "InactiveQualificationWarningDays": 148,
    "InactiveQualificationPoints": 6,
    "TopIntervalInChat": "Monthly",
    "TopLimitInChat": 20,
    "TopLimitInPM": 100,
    "TopLimitChats": 7,
    "ConfirmTimeout": "3.00:00:00",
    "ConfirmReminderInterval": "20:00:00",
    "TournamentImportTimeout": "30.00:00:00",
    "ChatUpdateInterval": "1.00:00:00",
    "QualificationTimeout": "30.00:00:00",
    "Rating400Timeout": "15.00:00:00",
    "DailyScoreLimit": 100,
    "MinimalChatMemberCount": 20,
    "RevertTimeoutDays": 1,
    "TournamentEditTimeoutDays": 3,
    "MaxAllowedScore": 30,
    "SuperAdmin": 186239614,
    "SuperAdminLanguageCode": "ru",
    "MaxGamesPerMessage": 20,
    "DialogTimeout": 5,
    "GeoSearchPrecisionInMeters": 500,
    "VenueTravelBufferMinutes": 40,
    "VenueSoonWindowHours": 2,
    "AvatarUpdateInterval": "15.00:00:00",
    "AvatarsPath": "/home/ttar.app/api/Images/Avatars",
    "AvatarMaxSize": 256,
    "PhotosPath": "/home/ttar.app/api/Images/Photos"
  },

  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft": "Warning",
      "Microsoft.AspNetCore": "Warning",
      "Microsoft.Hosting.Lifetime": "Information",
      "System.Net.Http.HttpClient": "Warning",
      "Polly": "Warning"
    },
    // Prints the request scopes under each entry: RequestPath/TraceId, and ClientApp/ClientVersion (ClientLogScopeMiddleware).
    "Console": {
      "FormatterOptions": {
        "IncludeScopes": true
      }
    }
  },
  "Kestrel": {
    "Endpoints": {
      "MyHttpEndpoint": {
        "Url": "http://*:5000"
      }
    }
  },
  "AllowedHosts": "*",

  "EmailConfiguration": {
    "SmtpHost": "scooterclub.by",
    "SmtpPort": 587,
    "SmtpUser": "kot@ttar.app",
    "SmtpPassword": "ttarFakeKot!1",
    "Sender": "TTAR <ttar@ttar.app>",
    "SecureSocketOptions": "StartTls"
  }
}