quarkus:
  jackson:
    # Quarkus 3.37 stopped tolerating empty response beans; AWS StartApplication/
    # StopApplication legitimately return {}, so keep the pre-3.37 behaviour.
    fail-on-empty-beans: false
  log:
    console:
      format: "%d{yyyy-MM-dd HH:mm:ss,SSS} %-5p [%c{3.}] %s%e%n"
    category:
      "io.apicurio":
        level: WARN

  http:
    port: ${floci.port}
    # Loopback by default. Any other address (0.0.0.0, a LAN IP) also needs
    # floci.security.allow-unsafe-network-exposure, or Floci refuses to start.
    # Env var: QUARKUS_HTTP_HOST=0.0.0.0
    host: 127.0.0.1
    # Quarkus 3.38 added a Host-header validation filter (DNS-rebinding protection for a dev server)
    # that it switches on by itself whenever the server is bound to loopback, which Floci is by
    # default. In TLS mode Quarkus listens on 127.0.0.1:4510/4511 behind the TCP proxy on 4566, and
    # the proxy passes the client's Host header through untouched. The filter is an exact-match set with no
    # wildcard support, and with require-localhost it admits only localhost, 127.0.0.1 and [::1].
    # An emulator has to answer under the names it documents and puts in its certificate
    # (localhost.floci.io, *.localhost.floci.io, *.execute-api.localhost.floci.io,
    # host.docker.internal) and under whatever a compose file calls it (FLOCI_HOSTNAME), none of
    # which an exact-match allow-list can express. Disabling the check restores the behaviour of
    # every release before Quarkus 3.39; the access boundary of a local emulator is the IAM and
    # signature enforcement configuration.
    host-validation:
      require-localhost: false
    limits:
      max-body-size: ${floci.protocols.max-request-size}M
  shutdown:
    # Enables the pre-shutdown phase so stop hooks run before the HTTP server stops.
    # No 'delay' value is set - observers run synchronously, no artificial sleep is introduced.
    delay-enabled: true
  native:
    # quarkus-jdbc-mysql used to force this. Without it the image has only UTF-8, UTF-16,
    # ISO-8859-1 and US-ASCII, which breaks latin1 MySQL columns and non-UTF-8 mail bodies.
    add-all-charsets: true
    resources:
      # The Pricing service reads its bundled snapshot, EC2 reads its image
      # catalog (ec2/image-catalog.yaml), SageMaker reads its instance type
      # catalog (sagemaker/instance-type-catalog.yaml), AppSync's GraphQL
      # parser reads its message bundles, and API Gateway's Velocity engine
      # reads its default properties at runtime via
      # ClassLoader#getResourceAsStream. Quarkus's static resource analysis
      # cannot detect these dynamically-built paths, so they are registered
      # explicitly to ensure GraalVM includes every file in the native image.
      # The IAM managed-policy catalog (iam/*) is not listed on purpose.
      # AwsManagedPolicies parses it while the image is built and the parsed
      # catalog lives in the image heap, so the 3.5 MB of source files would
      # only be a second copy of the same data.
      includes:
        - pricing-snapshots/**
        - ui/*.html
        - ec2/*.yaml
        - sagemaker/*.yaml
        - eks/*.json
        - i18n/*.properties
        - org/apache/velocity/runtime/defaults/*.properties
        # DriverManager finds the JDBC drivers through ServiceLoader, and the MySQL
        # driver reads its time zone table at connect time.
        - META-INF/services/java.sql.Driver
        - com/mysql/cj/util/TimeZoneMapping.properties
      # snappy-java registers 27 JNI libraries, one per platform. Only the one
      # for the running platform loads, so 23 are dropped. Linux x86_64 and
      # aarch64 cover the published images, Mac covers a local native build.
      excludes:
        - org/xerial/snappy/native/AIX/**
        - org/xerial/snappy/native/FreeBSD/**
        - org/xerial/snappy/native/SunOS/**
        - org/xerial/snappy/native/Windows/**
        - org/xerial/snappy/native/Linux/android-aarch64/**
        - org/xerial/snappy/native/Linux/android-arm/**
        - org/xerial/snappy/native/Linux/arm/**
        - org/xerial/snappy/native/Linux/armv6/**
        - org/xerial/snappy/native/Linux/armv7/**
        - org/xerial/snappy/native/Linux/loongarch64/**
        - org/xerial/snappy/native/Linux/ppc/**
        - org/xerial/snappy/native/Linux/ppc64/**
        - org/xerial/snappy/native/Linux/ppc64le/**
        - org/xerial/snappy/native/Linux/riscv64/**
        - org/xerial/snappy/native/Linux/s390x/**
        - org/xerial/snappy/native/Linux/x86/**
        - org/xerial/snappy/native/Linux/x86_64-musl/**
    # No --allow-incomplete-classpath and no --report-unsupported-elements-at-runtime: both have
    # been no-ops since GraalVM 22.1 (incomplete classpaths are the default, and Quarkus passes
    # --link-at-build-time itself, so a reachable class missing from the classpath fails the build).
    additional-build-args:
      - --enable-url-protocols=http,https
      - --initialize-at-run-time=io.vertx.ext.mail.impl.sasl.NTLMEngineImpl
      - --initialize-at-run-time=com.github.dockerjava.transport.NamedPipeSocket$Kernel32
      - --initialize-at-run-time=io.github.hectorvent.floci.services.acm.AcmService
      - --initialize-at-run-time=io.github.hectorvent.floci.services.acm.CertificateGenerator
      - --initialize-at-run-time=io.github.hectorvent.floci.config.TlsConfigSource
      - --initialize-at-run-time=io.github.hectorvent.floci.services.cognito.CognitoSrpHelper
      - --initialize-at-run-time=io.github.hectorvent.floci.services.route53.Route53Service
      - --initialize-at-run-time=io.github.hectorvent.floci.services.kms.KmsService
      - --initialize-at-run-time=io.github.hectorvent.floci.services.bedrockagentcore.BedrockAgentCoreEventService
      - --initialize-at-run-time=io.github.hectorvent.floci.services.cloudfront.CloudFrontService
      - --initialize-at-run-time=io.github.hectorvent.floci.services.emr.EmrService
      - --initialize-at-run-time=io.github.hectorvent.floci.services.elasticbeanstalk.ElasticBeanstalkService
      - --initialize-at-run-time=io.github.hectorvent.floci.services.elb.ElbClassicService
      - --initialize-at-run-time=io.github.hectorvent.floci.services.datasync.DataSyncService
      - --initialize-at-run-time=io.github.hectorvent.floci.services.lambda.launcher.LambdaExecutionRoleCredentials
      - --initialize-at-run-time=io.github.hectorvent.floci.services.ssoportal.SsoPortalService
      - --initialize-at-run-time=io.github.hectorvent.floci.services.redshift.proxy.S3CopySimulator
      # snappy-java (Firehose Snappy/HADOOP_SNAPPY delivery) extracts and loads a
      # bundled JNI library from the static initializers of these two classes.
      - --initialize-at-run-time=org.xerial.snappy.Snappy
      - --initialize-at-run-time=org.xerial.snappy.SnappyLoader
      - --initialize-at-run-time=org.postgresql.util.PasswordUtil$SecureRandomHolder
      - --initialize-at-run-time=org.postgresql.util.LazyCleanerImpl
      # Build-time property. The MySQL driver's AbandonedConnectionCleanupThread starts an
      # executor thread in its static initializer unless this is set, and a started thread
      # in the image heap fails the build.
      - -J-Dcom.mysql.cj.disableAbandonedConnectionCleanup=true


floci:
  port: 4566
  base-url: "http://localhost:4566"
  network:
    security-group-enforcement:
      enabled: false
      helper-image: floci/network-helper:local
  # hostname: ""  # When set, overrides the hostname in response URLs (e.g. SQS QueueUrl).
                   # Needed for multi-container Docker setups. Example: FLOCI_HOSTNAME=floci
  default-region: us-east-1
  default-account-id: "000000000000"
  # Shared mock-response config for Textract/Comprehend/Rekognition/Translate. See AiMockConfigLoader.
  ai-mock-config-file: ${AI_MOCK_CONFIG:}
  storage:
    # Supported modes: memory, persistent, hybrid, wal
    mode: memory
    persistent-path: ./data
    host-persistent-path: ./data
    prune-volumes-on-delete: false
    # EFS access-point emulation for the shared local Docker volumes that stand in for EFS file
    # systems. All opt-in; with the defaults below (and no owner/permission overrides) volumes are
    # plain named volumes, so existing behaviour is unchanged. Emulates an access point's
    # RootDirectory.CreationInfo (owner-uid/owner-gid/root-permissions) and PosixUser
    # (mount-user/mount-group-add).
    efs:
      # owner-uid:            # RootDirectory.CreationInfo.OwnerUid applied to the volume root (set with owner-gid)
      # owner-gid:            # RootDirectory.CreationInfo.OwnerGid applied to the volume root (set with owner-uid)
      # root-permissions:     # CreationInfo.Permissions, 3-4 octal digits; e.g. "0777", or "2775" for setgid
      init-image: busybox:stable
      # mount-user:           # run mounting containers as "uid[:gid]" (access point PosixUser)
      # mount-group-add:      # supplementary gid added to mounting containers
    wal:
      compaction-interval-ms: 30000
    services:
      ssm:
        flush-interval-ms: 5000
      kafkaconnect:
        flush-interval-ms: 5000
      dynamodb:
        flush-interval-ms: 5000
      sns:
        flush-interval-ms: 5000
      lambda:
        flush-interval-ms: 5000
      cloudwatchlogs:
        flush-interval-ms: 15000
      cloudwatchmetrics:
        flush-interval-ms: 5000
      secretsmanager:
        flush-interval-ms: 5000
      acm:
        flush-interval-ms: 5000
      opensearch:
        flush-interval-ms: 5000
      sagemaker:
        flush-interval-ms: 5000
      batch:
        flush-interval-ms: 5000
      lightsail:
        flush-interval-ms: 5000
      codepipeline:
        flush-interval-ms: 5000
      s3vectors:
        flush-interval-ms: 5000
      s3tables:
        flush-interval-ms: 5000
      ecs:
        flush-interval-ms: 5000
      codebuild:
        flush-interval-ms: 5000
      config:
        flush-interval-ms: 5000
      transcribe:
        flush-interval-ms: 5000
      codedeploy:
        flush-interval-ms: 5000
      tagging:
        flush-interval-ms: 5000
      elasticbeanstalk:
        flush-interval-ms: 5000
      rds:
        # Override storage mode for RDS (memory = no Docker volumes; hybrid/persistent = named volume per instance)
        # mode: memory
      ec2:
        # Override storage mode for EC2 (defaults to the global storage mode). EC2 networking and
        # instance metadata persist so CloudFormation-created VPC/subnet ids survive a restart (#1297).
        # mode: memory
      appsync:
        flush-interval-ms: 5000
      rum:
        flush-interval-ms: 5000
      resourceexplorer2:
        mode: hybrid
        flush-interval-ms: 5000
      fis:
        flush-interval-ms: 5000
      guardduty:
        flush-interval-ms: 5000
      emrserverless:
        flush-interval-ms: 5000
      lakeformation:
        flush-interval-ms: 5000

  dns:
    # Extra hostname suffixes resolved to Floci's container IP by the embedded DNS server.
    # Useful when migrating from LocalStack — add localhost.localstack.cloud to avoid
    # changing Lambda endpoint environment variables.
    # Via env var (comma-separated): FLOCI_DNS_EXTRA_SUFFIXES=localhost.localstack.cloud,other.internal
    # extra-suffixes:
    #   - localhost.localstack.cloud

    # Public resolvers appended after Floci's embedded DNS on spawned containers' HostConfig.Dns,
    # and used as the fallback upstream for Floci's own DNS forwarder. Lets Lambda/CodeBuild
    # resolve public hostnames even if the embedded forwarder cannot answer.
    # Disable in offline/locked-down networks where these resolvers are blocked.
    container-fallback-enabled: true              # FLOCI_DNS_CONTAINER_FALLBACK_ENABLED
    container-fallback-servers:                   # FLOCI_DNS_CONTAINER_FALLBACK_SERVERS=1.1.1.1,1.0.0.1
      - 8.8.8.8
      - 8.8.4.4

  auth:
    validate-signatures: false
    presign-secret: local-emulator-secret

  security:
    # Comma-separated browser origins allowed by the global CORS filter.
    # Env var: EXTRA_CORS_ALLOWED_ORIGINS=http://localhost:3000
    extra-cors-allowed-origins: ${EXTRA_CORS_ALLOWED_ORIGINS:}
    # Extra request/response CORS header names for browser clients.
    extra-cors-allowed-headers: ${EXTRA_CORS_ALLOWED_HEADERS:}
    extra-cors-expose-headers: ${EXTRA_CORS_EXPOSE_HEADERS:}
    disable-cors-headers: false
    # Grant Private Network Access preflights (Access-Control-Allow-Private-Network)
    # so a page on a public/secure origin can reach this loopback backend.
    cors-allow-private-network: false
    # Allow quarkus.http.host, and the TLS proxy that uses it, to listen outside loopback
    # (127.0.0.0/8, ::1, localhost). Anyone who can reach that address can call Floci's APIs.
    # The Docker images set it, since they listen on 0.0.0.0 inside the container.
    # Env var: FLOCI_SECURITY_ALLOW_UNSAFE_NETWORK_EXPOSURE=true
    allow-unsafe-network-exposure: false
    allow-private-jwt-targets: false

  tls:
    enabled: false                     # FLOCI_TLS_ENABLED (default: false)
    # cert-path: ""                    # FLOCI_TLS_CERT_PATH (PEM certificate file)
    # key-path: ""                     # FLOCI_TLS_KEY_PATH (PEM private key file)
    self-signed: true                  # FLOCI_TLS_SELF_SIGNED: auto-generate a server cert signed by Floci's local CA if no cert-path provided
    aws-https-port: 443                # FLOCI_TLS_AWS_HTTPS_PORT — also bind 443 so CDK cfn-response/AWS-on-443 callbacks reach Floci (0 disables)

  protocols:
    max-request-size: 2048             # FLOCI_PROTOCOLS_MAX_REQUEST_SIZE: max HTTP request body size in MB (legacy: floci.max-request-size / FLOCI_MAX_REQUEST_SIZE)
    strict-claiming: false             # FLOCI_PROTOCOLS_STRICT_CLAIMING — reject RPC-signaled requests that no supported wire protocol claims
    reject-unknown-service-scope: true # FLOCI_PROTOCOLS_REJECT_UNKNOWN_SERVICE_SCOPE — reject REST requests signed for a service Floci does not implement

  docker:
    log-max-size: "10m"
    log-max-file: "3"
    docker-host: unix:///var/run/docker.sock
    resource-namespace: ""          # FLOCI_DOCKER_RESOURCE_NAMESPACE; scopes child container/volume names
    docker-config-path: ""
    # extra-labels:                 # Extra Docker labels applied to every Floci-created container and volume
    #   - key: "com.example.project"  #   (FLOCI_DOCKER_EXTRA_LABELS_0__KEY / _0__VALUE; increment the index for more;
    #     value: my-project           #   reserved keys floci, floci_emulator, floci_namespace are ignored)
    #   - key: environment
    #     value: dev

  services:
    ssm:
      enabled: true
      max-parameter-history: 5
    sqs:
      enabled: true
      default-visibility-timeout: 30
      max-message-size: 1048576
      clear-fifo-deduplication-cache-on-purge: false
    s3:
      enabled: true
      enforce-auth: false
      default-presign-expiry-seconds: 3600
      global-bucket-namespace: false
    dynamodb:
      enabled: true
    sns:
      enabled: true
    lambda:
      enabled: true
      ephemeral: false
      # Extra Docker create flags for Lambda containers, for example: --env KEY=VALUE --volume /host:/container:ro
      docker-flags: ""
      ecr-base-uri: public.ecr.aws            # FLOCI_SERVICES_LAMBDA_ECR_BASE_URI — registry for Lambda runtime images (legacy: floci.ecr-base-uri / FLOCI_ECR_BASE_URI)
      honour-architectures: false             # Select the Lambda architecture for Docker pull and create
      default-memory-mb: 128
      default-timeout-seconds: 3
      # 500 ports, not the former 100 (9200-9299): one port is held per running Lambda
      # container, so this is the concurrent-execution ceiling, and a multi-account LZA needs
      # ~112 at once. See EmulatorConfig.runtimeApiBasePort for why 12000 and not a wider 9200.
      # Keep in step with the @WithDefault there — a value set here WINS over the annotation,
      # so changing only the default silently does nothing (the issue #2225 trap).
      runtime-api-base-port: 12000
      runtime-api-max-port: 12499
      code-path: ./data/lambda-code
      zip-max-entries: 100000
      poll-interval-ms: 1000
      container-idle-timeout-seconds: 300
      region-concurrency-limit: 1000
      unreserved-concurrency-min: 100
      accept-external-layer-arns: false       # FLOCI_SERVICES_LAMBDA_ACCEPT_EXTERNAL_LAYER_ARNS - accept a Layers ARN from another account (content is never mounted). AWS answers these through the layer resource policy, which Floci does not model, so the default refuses them like AWS refuses a non-public one. Turn on to attach public layers such as Powertools.
      # aws-config-path:                      # Host path to bind-mount (read-only) at /opt/aws-config for real credential discovery
      # extra-hosts:                          # Extra /etc/hosts entries for Lambda containers, "hostname:ip" ("host-gateway" allowed as ip)
      # container-name-prefix: floci          # FLOCI_SERVICES_LAMBDA_CONTAINER_NAME_PREFIX — base name prefix for spawned containers and code volumes ([A-Za-z0-9][A-Za-z0-9_.-]*; invalid values fall back to "floci")
      # code-volume-populate-concurrency:     # FLOCI_SERVICES_LAMBDA_CODE_VOLUME_POPULATE_CONCURRENCY — max concurrent first-time code-volume populates (default max(2, cpus/2), which a CPU-constrained container collapses to 2)
      executor: docker                        # docker | kubernetes (run Lambda environments as pods)
      # kubernetes:
      #   namespace: default                  # Namespace Lambda pods are created in
      #   labels:                             # Extra pod labels, key=value entries
      #     - team=platform
      #   floci-address:                      # Host/IP pods use to reach Floci; auto-detected in-cluster
      #   init-image: busybox:1.36            # Init container image (needs sh, wget, unzip)
      hot-reload:
        enabled: false
    apigateway:
      enabled: true
      vtl-max-loops: 10000                 # Maximum #foreach iterations a VTL mapping template may execute (truncates the loop, does not fail the template)
      vtl-max-output-chars: 1048576        # Maximum characters a VTL mapping template may render before it fails
      vtl-timeout-millis: 5000             # Maximum wall-clock time a VTL mapping template may spend evaluating before it fails
    apigatewayv2:
      enabled: true
    iam:
      enabled: true
      enforcement-enabled: false
      seed-deployer-principal: false
      # account-alias: ""  # When set, seeds the account alias at startup so callers can read one
                           # without creating it first. Unset means the account has no alias,
                           # matching AWS. Example: FLOCI_SERVICES_IAM_ACCOUNT_ALIAS=my-account
    msk:
      enabled: true
      mock: false
      default-image: "redpandadata/redpanda:latest"
      kafka-host-port-base: 9300
      kafka-host-port-max: 9399
    kafkaconnect:
      enabled: true
      mock: false
      worker-image: apache/kafka:3.9.0
    amazonmq:
      enabled: true
      mock: false
      default-image: "rabbitmq:3-management"
      amqp-host-port-base: 5672
      amqp-host-port-max: 5699
      console-host-port-base: 15672
      console-host-port-max: 15699
    kinesis-analytics:
      enabled: true
      mock: false
      # default-image: optional override; uncomment to pin every application to a single image
      # (e.g. a private registry mirror). When unset, the image is chosen from the requested
      # RuntimeEnvironment (KinesisAnalyticsRuntimes.imageFor, e.g. FLINK-1_19 -> apache/flink:1.19).
      # default-image: "apache/flink:1.18"
    elasticache:
      enabled: true
      proxy-base-port: 6379
      proxy-max-port: 6399
      default-image: "valkey/valkey:8"
      default-memcached-image: "memcached:1.6"
    memorydb:
      enabled: true
      mock: false
      proxy-base-port: 6400
      proxy-max-port: 6419
      default-image: "valkey/valkey:8"
    redshift:
      enabled: true
      default-port: 5439
      image-version: postgres:15-alpine
      poll-interval-ms: 1000
      proxy-base-port: 7100
      proxy-max-port: 7199
      default-credential-duration-seconds: 900   # GetClusterCredentials default lifetime (900-3600)
      # endpoint-host: localhost                 # Hostname clients use; empty -> DockerHostResolver
      proxy-handshake-timeout-millis: 10000       # Max time a client has to complete the startup/auth handshake
      proxy-backend-connect-timeout-millis: 5000  # Max time to wait for the backend TCP connect
      proxy-max-connections: 100                  # Max concurrent proxy connections before new ones are refused
    rds:
      enabled: true
      mock: false                                 # FLOCI_SERVICES_RDS_MOCK — true = metadata only, no Docker (useful for CI)
      proxy-base-port: 7001
      proxy-max-port: 7099
      # endpoint-host: localhost                 # Hostname clients use; enables published-port translation in Docker
      # Omit image overrides to adapt Floci's built-in images to EngineVersion.
      # Uncomment an override to pin that engine to an exact image.
      # default-postgres-image: "registry.example.com/postgres:16-alpine"
      # default-mysql-image: "registry.example.com/mysql:8.0"
      # default-mariadb-image: "registry.example.com/mariadb:11"
      default-sql-server-image: "mcr.microsoft.com/mssql/server:2022-latest"
      proxy-handshake-timeout-millis: 10000       # Max time a client has to complete the startup/auth handshake
      proxy-backend-connect-timeout-millis: 5000  # Max time to wait for the backend TCP connect
      proxy-max-connections: 100                  # Max concurrent proxy connections before new ones are refused
    rds-data:
      enabled: true
      transaction-ttl-seconds: 180
    redshift-data:
      enabled: true
      result-ttl-hours: 24
    neptune:
      enabled: true
      proxy-base-port: 8182
      proxy-max-port: 8282
      db-type: "gremlin"
      default-image: "tinkerpop/gremlin-server:3.7.3"
      default-neo4j-image: "neo4j:5-community"
    eventbridge:
      enabled: true
    cloudmap:
      enabled: true
    emr:
      enabled: true
    wafv2:
      enabled: true
    scheduler:
      enabled: true
    cloudwatchlogs:
      enabled: true
      max-events-per-query: 10000
      max-stored-events: 20000
    cloudwatchmetrics:
      enabled: true
    secretsmanager:
      enabled: true
      default-recovery-window-days: 30
      scheduled-rotation-enabled: true
      rotation-tick-seconds: 60
    kinesis:
      enabled: true
    firehose:
      enabled: true
      tick-interval-seconds: 10
      flush-record-count: 0
      staging-bucket: floci-firehose-staging
    kms:
      enabled: true
    cognito:
      enabled: true
    stepfunctions:
      enabled: true
      allow-plaintext-http: false
      mock-config-file: ${SFN_MOCK_CONFIG:}
    swf:
      enabled: true
      timeout-sweep-enabled: true
      timeout-sweep-interval-seconds: 1
    cloudformation:
      enabled: true
      # Fail an AWS::Lambda::Function whose S3 code cannot be read, as real CloudFormation
      # does. Set true to fall back to the built-in stub handler instead (issue #2648).
      allow-stub-lambda-code: false
      # Stub a resource whose type has no provisioner: synthetic physical id, arn:aws:stub:::
      # ARN attribute, CREATE_COMPLETE, reported at warn with a resource status reason. Set
      # false to fail such a resource instead, which rolls the stack back.
      allow-stub-unsupported-resource-types: true
    acm:
      enabled: true
      validation-wait-seconds: 0
    athena:
      enabled: true
      mock: false
    duck:
      # url: http://floci-duck:3000   # set to skip container management
      default-image: "floci/floci-duck:latest"
    glue:
      enabled: true
    ses:
      enabled: true
      # smtp-host: mailpit          # SMTP server for email relay (empty = store only)
      # smtp-port: 1025
      # smtp-user: ""
      # smtp-pass: ""
      # smtp-starttls: DISABLED     # DISABLED, OPTIONAL, or REQUIRED
    opensearch:
      enabled: true
      mock: false
      # default-image: optional override; uncomment to lock every domain to a
      # single image (e.g. private registry mirror). When unset, the image is
      # picked from OpenSearchVersions.imageFor(EngineVersion).
      # default-image: "registry.example.com/opensearch:2.19.5"
      proxy-base-port: 9400
      proxy-max-port: 9499
      keep-running-on-shutdown: false
    ec2:
      enabled: true
      imds-port: 9169
      # Sweep EC2 containers left on the daemon by a previous run that died mid-launch or
      # mid-terminate (SIGKILL, OOM, docker kill), which no surviving record refers to.
      # Scoped to this deployment's own containers; stopped instances are never swept.
      reconcile-containers-on-startup: true
      ssh-port-range-start: 2200
      ssh-port-range-end: 2299
      publish-security-group-ports: true
      app-port-range-start: 30000
      app-port-range-end: 30999
      max-published-ports-per-instance: 20
      socat-image: alpine/socat
      mock: false
      aws-faithful-private-ip: false
      # container-ips-routable: true  # Auto-detected by default (a throwaway TCP probe toward
                                       # the container network). Set explicitly when the probe
                                       # can't speak for your clients, e.g. Floci itself running
                                       # containerized. FLOCI_SERVICES_EC2_CONTAINER_IPS_ROUTABLE
      # Each VPC gets a real Docker network, so an instance's private IP is an address its
      # container actually holds and instances in different VPCs are on different bridges.
      vpc-networks:
        enabled: true                             # FLOCI_SERVICES_EC2_VPC_NETWORKS_ENABLED
        # Used only when a declared VPC CIDR cannot be honoured: absent, malformed, outside
        # RFC 1918, or already claimed on this Docker daemon. Substitutions are logged at WARN;
        # a reported private IP that does not match the declared CIDR is never silent.
        fallback-pool: 10.240.0.0/12              # FLOCI_SERVICES_EC2_VPC_NETWORKS_FALLBACK_POOL
        fallback-prefix-length: 16                # FLOCI_SERVICES_EC2_VPC_NETWORKS_FALLBACK_PREFIX_LENGTH
        # Remove VPC networks left behind by a previous run of THIS emulator (scoped by API port,
        # so Floci instances sharing a daemon never reconcile each other's networks).
        reconcile-on-startup: true                # FLOCI_SERVICES_EC2_VPC_NETWORKS_RECONCILE_ON_STARTUP
        driver: bridge                            # FLOCI_SERVICES_EC2_VPC_NETWORKS_DRIVER
    ecs:
      enabled: true
      mock: false
      publish-awsvpc-ports-to-host: false
      host-volume-roots: []
      allow-unsafe-host-volumes: false
    appconfig:
      enabled: true
    appconfigdata:
      enabled: true
    ecr:
      enabled: true
      registry-image: "registry:2"
      registry-container-name: floci-ecr-registry
      registry-base-port: 5100
      registry-max-port: 5199
      data-path: ./data/ecr
      tls-enabled: false
      keep-running-on-shutdown: true
      uri-style: hostname
      prefer-local-images: true
    ui:
      enabled: true
      image: "floci/floci-ui:latest"
      container-name: floci-ui
      port: 4500
      keep-running-on-shutdown: false
      # endpoint: unset by default — Floci derives the sidecar's callback address automatically.
      # Set an absolute http:// or https:// URL here only to override that derivation.
      insecure-skip-tls-verify: false
      # The console-contract keys below are deliberately unset. Floci reads the console's own
      # io.floci.console.* image labels first, then a built-in profile, then the contract defaults
      # (/api/health, port 4500, status: ok). Setting a value here overrides all of that, so only
      # do it for a console that describes itself neither way. See docs/ui/console-contract.md.
      # internal-port: 4500
      # endpoint-env: AWS_ENDPOINT_URL
      # status-path: /api/health
      # status-ready-field: status      # "none" means any 200 counts as ready
      # status-ready-value: ok
      # status-unavailable-value: unavailable
      # extra-env:                     # PORT and AWS_ENDPOINT_URL are ignored here: use
      #   - MY_CONSOLE_FLAG=true       # internal-port and endpoint above instead
    bedrock:
      enabled: true
    bedrock-runtime:
      enabled: true
      backend: stub
      proxy:
        passthrough: false
        # url: http://localhost:11434/v1
        # api-key: sk-...
        # default-model: llama3
        # model-mapping: "anthropic.claude-3-sonnet-20240229-v1:0=claude-3-sonnet"
    eks:
      enabled: true
      mock: false
      provider: k3s
      default-image: "rancher/k3s:latest"
      # image-template: "myregistry.io/k3s:v%s" # optional custom image format template taking cluster version
      api-server-base-port: 6500
      api-server-max-port: 6599
      data-path: ./data/eks
      keep-running-on-shutdown: false
      endpoint-mode: host          # host = https://localhost:<hostPort> (host-reachable); network = container DNS name
      iam-auth-webhook: true       # validate `aws eks get-token` SigV4 tokens through a k3s webhook
      ecr-registry-mirror: true    # inject a registries.yaml so pods can pull images pushed to Floci ECR
      disable-cni: false           # start k3s without its bundled flannel/kube-proxy so a real CNI (e.g. Cilium) can take over
      imds: false                  # expose link-local IMDS (169.254.169.254) inside the cluster container
      imds-pod-network: false      # route link-local IMDS traffic from ordinary pod network namespaces (requires imds: true)
      irsa-signing-key: true       # sign k3s service account tokens with the cluster OIDC key
      pod-identity-webhook: true   # register a mutating webhook that injects pod identity credentials (needs floci.tls.enabled)
    mwaa:
      enabled: true
      mock: false
      default-postgres-image: "postgres:16-alpine"
      supported-versions: "2.10.5,2.9.3,2.8.4"
      default-version: "2.10.5"
      proxy-base-port: 8700
      proxy-max-port: 8799
      data-path: ./data/mwaa
      keep-running-on-shutdown: false
      dag-sync-interval-seconds: 30
      install-requirements: true
    elb:
      enabled: true
      mock: false
    elbv2:
      enabled: true
      mock: false
      listener-forwarder-image: alpine/socat:1.8.1.3
    codebuild:
      enabled: true
      # docker-network: floci-network
    sagemaker:
      enabled: true
      # docker-network: floci-network
      gpu:
        # Off by default: an existing deployment keeps launching CPU-only
        # containers. How many GPUs an ml.* type has is shipped in
        # sagemaker/instance-type-catalog.yaml; this is only about which of
        # this machine's devices Floci may hand out.
        enabled: false
        # cdi | device-ids | count. Podman resolves only cdi, and accepts
        # count while attaching no device, so cdi fails loudly instead.
        mode: cdi
        # Required for cdi and device-ids modes; unset allows no device.
        # devices:
        #   - nvidia.com/gpu=GPU-<uuid>
    batch:
      enabled: true
      runner-mode: immediate
      # docker-network: floci-network
    codedeploy:
      enabled: true
    codepipeline:
      enabled: true
    autoscaling:
      enabled: true
    applicationautoscaling:
      enabled: true
    elasticbeanstalk:
      enabled: true
    backup:
      enabled: true
      job-completion-delay-seconds: 3
    fis:
      enabled: true
    route53:
      enabled: true
      vpc-association-control-plane-delay-ms: 0
    transfer:
      enabled: true
    textract:
      enabled: true
    comprehend:
      enabled: true
    rekognition:
      enabled: true
    translate:
      enabled: true
    pricing:
      enabled: true
    transcribe:
      enabled: true
    ce:
      enabled: true
      credit-usd-monthly: 0.0
    cur:
      enabled: true
      emit-mode: synchronous
      staging-bucket: floci-cur-staging
    bcm-pricing-calculator:
      enabled: true
    timestream-influxdb:
      enabled: true
      mock: false                                 # FLOCI_SERVICES_TIMESTREAM_INFLUXDB_MOCK: true = metadata only, no Docker
      default-image: "influxdb:2.7"
      host-port-base: 8086
      host-port-max: 8185
      readiness-timeout-seconds: 120
      # docker-network: my-network               # Docker network to attach InfluxDB containers to
    bcm-data-exports:
      enabled: true
      emit-mode: synchronous
    oam:
      enabled: true
    cloudtrail:
      enabled: true
    lightsail:
      enabled: true
    cloudcontrol:
      enabled: true
    resourceexplorer2:
      enabled: true
    cloudfront:
      enabled: true
      allowed-private-origin-hosts: []
    appsync:
      enabled: true
      schema-worker-threads: 4
      schema-worker-shutdown-timeout-seconds: 30
      vtl-max-loops: 10000                 # Maximum #foreach iterations a VTL resolver template may execute (truncates the loop, does not fail the template)
      vtl-max-output-chars: 1048576        # Maximum characters a VTL resolver template may render before it fails
      vtl-timeout-millis: 5000             # Maximum wall-clock time a VTL resolver template may spend evaluating before it fails
      # graphql-url: http://floci-graphql:8181  # set to skip sidecar container management
      # Exact version on purpose: a cached :latest is never re-pulled. Published from floci-io/floci-sidecars.
      graphql-image: "floci/floci-sidecar-graphql:0.2.0"
    s3vectors:
      enabled: true
    s3tables:
      enabled: true
    iot:
      enabled: true
      rule-sql-strict: false
      # endpoint-address: ""  # DescribeEndpoint value when the AWS IoT ports (8883, 443, 8443) reach Floci; default: host and port of base-url
      mqtt:
        enabled: true
        auto-start: false
        host: 0.0.0.0
        port: 1883
        tls-port: 8883
    iotdata:
      enabled: true
    cloudhsmv2:
      enabled: true
    efs:
      enabled: true
      nfs-servers: true                              # serve each mount target over NFSv4.1 for EC2 instances
      nfs-server-image: floci/efs-nfs-server:local   # built locally on first use
    organizations:
      enabled: true
      # management-account-email: ""  # When set, overrides the management-account email reported by DescribeOrganization and account listings.
    rum:
      enabled: true
    networkfirewall:
      enabled: true
    servicecatalog:
      enabled: true
    guardduty:
      enabled: true
    emrserverless:
      enabled: true
    ssoadmin:
      enabled: true
    ssooidc:
      enabled: true
      local-principal-id: ${FLOCI_SERVICES_SSOOIDC_LOCAL_PRINCIPAL_ID:}
    macie2:
      enabled: true
    account:
      enabled: true
    controlcatalog:
      enabled: true
    accessanalyzer:
      enabled: true
    identitystore:
      enabled: true
      scim-bearer-token: ${FLOCI_SERVICES_IDENTITYSTORE_SCIM_BEARER_TOKEN:floci-scim-token}
    budgets:
      enabled: true
    inspector2:
      enabled: true
    securityhub:
      enabled: true
    detective:
      enabled: true
    controltower:
      enabled: true
      seed-landing-zone: false
    route53resolver:
      enabled: true
    connect:
      enabled: true
    appintegrations:
      enabled: true
    cognitoidentity:
      enabled: true
    globalaccelerator:
      enabled: true
    datasync:
      enabled: true
    aps:
      enabled: true
    lakeformation:
      enabled: true
    tagging:
      enabled: true
    pipes:
      enabled: true
      kafka-rest-bridge:
        default-image: "ghcr.io/aiven-open/karapace:latest"
        host-port-base: 9500
        host-port-max: 9599
    configservice:
      enabled: true
    docdb:
      enabled: true
      mock: false
      default-image: "mongo:7.0"
    bedrock-agent-core:
      enabled: true
      # invoke-response: '{"output":"yes"}'   # Body returned by InvokeAgentRuntime
      # validate-runtime-exists: false        # true = reject unknown runtime ARNs
      # harness-echo-prefix: 'You said: '      # Prefix on the reply InvokeHarness streams back
      # harness-empty-reply: 'No user message was supplied.'
    bedrock-agent-core-control:
      enabled: true
    servicequotas:
      enabled: true
    verifiedpermissions:
      enabled: true
      # cedar-url: http://floci-cedar:8180  # set to skip sidecar container management
      # Exact version on purpose: a cached :latest is never re-pulled. Published from floci-io/floci-sidecars.
      cedar-image: "floci/floci-sidecar-cedar:1.1.0"
    ram:
      enabled: true
    codegurureviewer:
      enabled: true
    codeartifact:
      enabled: true
      # maven-url: http://floci-reposilite:8080  # set to skip Reposilite sidecar container management
      maven-image: "dzikoysk/reposilite:3.6.3"
    marketplace:
      enabled: true
    dms:
      enabled: true