# =============================================================================
# cluster.p3.yml — Skenario P3: komponen EXISTING milik PIHAK LAIN (host/IP sendiri)
#                 + DUA OpenLDAP independen (existing utk keycloak, cluster utk trino/starrocks).
# -----------------------------------------------------------------------------
# Kondisi client (nyata):
#   - keycloak, minio, nessie  : EXISTING, dikelola pihak lain — masing-masing bisa di
#                                host/IP SENDIRI (di sini ditandai `components.<c>.address`).
#   - openldap                 : DUA instance independen (analog postgres):
#                                  · sisi existing : openldap LOKAL (untuk Keycloak) — DI LUAR
#                                    inventory ini (setup single-host existing; JANGAN set LDAP_URL).
#                                  · cluster       : openldap di `control` (tier identity) →
#                                    group-provider Trino/StarRocks.
#   - postgres (utk keycloak/nessie): sisi existing, BUKAN milik cluster → tak di inventory.
#   - postgres cluster         : milik sendiri di `state`.
#
# Perbedaan dari P1: di P1 identity (keycloak+openldap+nessie) ada di host existing; di P3
# `keycloak`+`nessie` eksternal (per-host) sementara `openldap` ada di KEDUA sisi (independen).
# Penanda eksternal kini `components.<c>.address` (tanpa entri host) → tak dijalankan cluster.
#
# SIMULASI: ketiga komponen existing boleh dijalankan di SATU host (docker compose +
# network sendiri) → isi `address` sama (mis. 100.93.54.108). REAL: isi alamat berbeda.
#
# .env cluster — override `*_INTERNAL_PORT` HANYA untuk komponen EKSTERNAL:
#   KEYCLOAK_INTERNAL_PORT=12080   MINIO_INTERNAL_PORT=12900   NESSIE_INTERNAL_PORT=12120
# JANGAN override OPENLDAP_INTERNAL_PORT — openldap cluster LOKAL (di `control`), port 389.
# (Plus: samakan secret existing — 5× *_CLIENT_SECRET, MINIO_ROOT_*; LDAP_ADMIN_PASSWORD
#  per-sisi, TIDAK perlu disamakan.)
#
# Langkah lengkap simulasi: docs/sicabe-p3-simulation-runbook.md
#
# Verifikasi (tanpa akses admin): hanya memeriksa apakah keycloak/minio/nessie memenuhi
# kebutuhan (issuer, TLS, S3, secret) — lihat docs/sicabe-p1-existing-runbook.md §7.
# =============================================================================

version: 1
cluster:
  name: sicabe-p3
  env: simulation

tls:
  mode: none

preset: a3

hosts:
  # control mengelola OPENLDAP cluster (tier identity) — keycloak/nessie di-override eksternal.
  control:
    address: 100.112.76.124
    tiers: [identity, policy, pipeline, governance]
  compute:
    address: 100.123.123.71
    tiers: [coord, engine]
  state:
    address: 100.73.229.107
    tiers: [state]

components:
  # EXISTING (pihak lain) — TANPA host; endpoint = alamat ini di semua host.
  keycloak:  { address: 100.93.54.108 }
  minio:     { address: 100.93.54.108 }
  nessie:    { address: 100.93.54.108 }
  dremio:    { enabled: false }