# Example configuration for xworkmate-bridge public ingress and provider sync.
#
# Usage:
#   BRIDGE_CONFIG_PATH=config.yaml ./xworkmate-bridge serve

# Upstream provider endpoints
# Priority: YAML > Environment Variable (e.g. CODEX_RPC_URL) > Default Constants
upstream:
  codex_url: "ws://127.0.0.1:9001"
  gemini_url: "ws://127.0.0.1:8791"
  hermes_url: "ws://127.0.0.1:3920"
  gateway_url: "ws://127.0.0.1:18789/"
  opencode_url: "ws://127.0.0.1:38992"

openclaw_gateway:
  max_active: 5
  max_queued: 20
  queue_timeout: "10m"

# Lightweight distributed bridge task router.
# Public domains are ingress only. Bridge-to-bridge forwarding must use HTTP
# loopback/private/link-local endpoints protected by WireGuard over VLESS or an
# equivalent private transport.
distributed:
  topology: "dual-node"
  local_node_id: "cn-xworkmate-bridge"
  # Dual-node shorthand. Equivalent to a forwarding rule that sends
  # session.start/session.message to xworkmate-bridge.
  task_forward_peer_id: "xworkmate-bridge"
  nodes:
    - id: "xworkmate-bridge"
      role: "primary"
      zone: "global"
      public_base_url: "https://xworkmate-bridge.svc.plus"
      bridge_endpoint: "http://172.29.10.1:8787"
      capabilities: ["openclaw", "codex"]
    - id: "cn-xworkmate-bridge"
      role: "edge"
      zone: "cn"
      public_base_url: "https://cn-xworkmate-bridge.svc.plus"
      bridge_endpoint: "http://172.29.10.2:8787"
      capabilities: ["ingress"]
  forwarding:
    hop_limit: 3
    default_action: "execute_local"
    # For multi-node/star/mesh mode, prefer explicit rules over task_forward_peer_id:
    # rules:
    #   - methods: ["session.start", "session.message"]
    #     target:
    #       selector:
    #         role: "executor"
    #         capability: "openclaw"
    #       strategy: "round_robin"
    # routes:
    #   - target_node_id: "worker-eu"
    #     next_hop_node_id: "xworkmate-bridge"
  # Optional. Defaults to BRIDGE_AUTH_TOKEN when omitted.
  task_forward_token: ""

# Legacy/Reference structure (Normally managed via code constants or environment)
bridge:
  listenAddr: 127.0.0.1:8787
  # Token should be set via BRIDGE_AUTH_TOKEN env for security
  allowedOrigins:
    - https://xworkmate.svc.plus
    - http://localhost:*
    - http://127.0.0.1:*

notes:
  - The bridge reads its own auth token from BRIDGE_AUTH_TOKEN.
  - Upstream URLs can include sub-paths which will be preserved during WebSocket handshake.
  - Multi-agent and Single-agent modes will use these endpoints to delegate tasks.
  - Distributed task forwarding rejects public endpoints; bridge_endpoint must be private/VPN HTTP.
  - task_forward_peer_id is the dual-node shorthand; forwarding.rules/routes express multi-node, star, and mesh topologies.