---
name: cf
update:
  canaries: 1
  canary_watch_time: 30000-1200000
  max_in_flight: 5
  serial: false
  update_watch_time: 5000-1200000
instance_groups:
- name: smoke-tests
  lifecycle: errand
  azs:
  - z1
  instances: 1
  vm_type: m3.medium
  stemcell: default
  update:
    max_in_flight: 1
    serial: true
  networks:
  - name: default
  jobs:
  - name: smoke_tests
    release: cf-smoke-tests
    properties:
      smoke_tests:
        api: "https://api.((system_domain))"
        apps_domain: "((system_domain))"
        user: admin
        password: "((cf_admin_password))"
        org: cf_smoke_tests_org
        space: cf_smoke_tests_space
        cf_dial_timeout_in_seconds: 300
        skip_ssl_validation: true
- name: consul
  azs:
  - z1
  - z2
  - z3
  instances: 3
  persistent_disk_type: 5GB
  vm_type: m3.medium
  stemcell: default
  update:
    max_in_flight: 1
    serial: true
  networks:
  - name: default
  jobs:
  - name: consul_agent
    release: consul
    consumes:
      consul_common: {from: consul_common_link}
      consul_server: {from: consul_server_link}
      consul_client: {from: consul_client_link}
    provides:
      consul_common: {as: consul_common_link, shared: true}
      consul_server: {as: consul_server_link, shared: true}
      consul_client: {as: consul_client_link, shared: true}
    properties:
      consul:
        agent:
          mode: server
          domain: cf.internal
        encrypt_keys:
        - "((consul_encrypt_key))"
        agent_cert: "((consul_agent.certificate))"
        agent_key: "((consul_agent.private_key))"
        ca_cert: "((consul_agent.ca))"
        server_cert: "((consul_server.certificate))"
        server_key: "((consul_server.private_key))"
  - name: metron_agent
    release: loggregator
    properties: &metron_agent_properties
      metron_agent:
        deployment: "((system_domain))"
      metron_endpoint:
        shared_secret: "((dropsonde_shared_secret))"
      loggregator:
        tls:
          ca_cert: "((loggregator_tls_metron.ca))"
          metron:
            cert: "((loggregator_tls_metron.certificate))"
            key: "((loggregator_tls_metron.private_key))"
- name: nats
  azs:
  - z1
  - z2
  instances: 2
  vm_type: c3.large
  vm_extensions:
  - 10GB_ephemeral_disk
  stemcell: default
  networks:
  - name: default
  jobs:
  - name: consul_agent
    release: consul
    consumes:
      consul_common: {from: consul_common_link}
      consul_server: nil
      consul_client: {from: consul_client_link}
  - name: nats
    release: nats
    provides:
      nats: {as: nats, shared: true}
    properties:
      nats:
        password: "((nats_password))"
        user: nats
        monitor_port: 9222
        prof_port: 6060
  - name: metron_agent
    release: loggregator
    properties: *metron_agent_properties
- name: etcd
  azs:
  - z1
  - z2
  - z3
  instances: 3
  persistent_disk_type: 5GB
  vm_type: m3.medium
  vm_extensions:
  - 10GB_ephemeral_disk
  stemcell: default
  update:
    serial: true
    max_in_flight: 1
  networks:
  - name: default
  jobs:
  - name: consul_agent
    release: consul
    consumes:
      consul_common: {from: consul_common_link}
      consul_server: nil
      consul_client: {from: consul_client_link}
    properties:
      consul:
        agent:
          services:
            etcd:
              name: cf-etcd
  - name: etcd
    release: etcd
    consumes:
      etcd: nil
    properties:
      etcd:
        advertise_urls_dns_suffix: cf-etcd.service.cf.internal
        cluster:
        - instances: 3
          name: etcd
        peer_require_ssl: true
        require_ssl: true
        ca_cert: "((etcd_client.ca))"
        client_cert: "((etcd_client.certificate))"
        client_key: "((etcd_client.private_key))"
        server_cert: "((etcd_server.certificate))"
        server_key: "((etcd_server.private_key))"
        peer_ca_cert: "((etcd_peer.ca))"
        peer_cert: "((etcd_peer.certificate))"
        peer_key: "((etcd_peer.private_key))"
  - name: etcd_metrics_server
    release: etcd
    properties:
      etcd_metrics_server:
        etcd:
          dns_suffix: cf-etcd.service.cf.internal
          require_ssl: true
          ca_cert: "((etcd_server.ca))"
          client_cert: "((etcd_client.certificate))"
          client_key: "((etcd_client.private_key))"
  - name: metron_agent
    release: loggregator
    properties: *metron_agent_properties
- name: doppler
  azs:
  - z1
  - z2
  instances: 2
  vm_type: m3.medium
  vm_extensions:
  - 10GB_ephemeral_disk
  stemcell: default
  networks:
  - name: default
  jobs:
  - name: consul_agent
    release: consul
    consumes:
      consul_common: {from: consul_common_link}
      consul_server: nil
      consul_client: {from: consul_client_link}
    properties:
      consul:
        agent:
          services:
            doppler:
              name: doppler
  - name: doppler
    release: loggregator
    properties:
      doppler:
        etcd:
          client_cert: "((etcd_client.certificate))"
          client_key: "((etcd_client.private_key))"
      loggregator:
        tls:
          ca_cert: "((loggregator_tls_doppler.ca))"
          doppler:
            cert: "((loggregator_tls_doppler.certificate))"
            key: "((loggregator_tls_doppler.private_key))"
        etcd:
          require_ssl: true
          ca_cert: "((etcd_server.ca))"
          machines:
          - cf-etcd.service.cf.internal
      doppler_endpoint:
        shared_secret: "((dropsonde_shared_secret))"
  - name: syslog_drain_binder
    release: loggregator
    properties:
      loggregator:
        tls:
          syslogdrainbinder:
            cert: "((loggregator_tls_syslogdrainbinder.certificate))"
            key: "((loggregator_tls_syslogdrainbinder.private_key))"
        etcd:
          require_ssl: true
          ca_cert: "((etcd_server.ca))"
          machines:
          - cf-etcd.service.cf.internal
      syslog_drain_binder:
        etcd:
          client_cert: "((etcd_client.certificate))"
          client_key: "((etcd_client.private_key))"
      system_domain: "((system_domain))"
      cc:
        mutual_tls:
          ca_cert: "((loggregator_tls_syslogdrainbinder.ca))"
        srv_api_uri: https://api.((system_domain))
      ssl: &ssl
        skip_cert_verify: true
  - name: metron_agent
    release: loggregator
    properties: *metron_agent_properties
- name: mysql
  azs:
  - z1
  persistent_disk_type: 10GB
  instances: 1
  vm_type: m3.large
  vm_extensions:
  - 10GB_ephemeral_disk
  stemcell: default
  update:
    serial: true
  networks:
  - name: default
  jobs:
  - name: consul_agent
    release: consul
    consumes:
      consul_common: {from: consul_common_link}
      consul_server: nil
      consul_client: {from: consul_client_link}
  - name: mysql
    release: cf-mysql
    properties:
      network_name: default
      cf_mysql:
        mysql:
          admin_password: "((cf_mysql_mysql_admin_password))"
          port: 33306
          binlog_enabled: false
          cluster_health:
            password: "((cf_mysql_mysql_cluster_health_password))"
          galera_healthcheck:
            db_password: "((cf_mysql_mysql_galera_healthcheck_password))"
            endpoint_username: galera_healthcheck
            endpoint_password: "((cf_mysql_mysql_galera_healthcheck_endpoint_password))"
          seeded_databases:
          - name: cloud_controller
            username: cloud_controller
            password: "((cc_database_password))"
          - name: diego
            username: diego
            password: "((diego_database_password))"
          - name: network_connectivity
            username: network_connectivity
            password: "((network_connectivity_database_password))"
          - name: network_policy
            username: network_policy
            password: "((network_policy_database_password))"
          - name: routing-api
            username: routing-api
            password: "((routing_api_database_password))"
          - name: uaa
            username: uaa
            password: "((uaa_database_password))"
  - name: proxy
    release: cf-mysql
    properties:
      cf_mysql:
        external_host: "((system_domain))"
        proxy:
          api_password: "((cf_mysql_proxy_api_password))"
          consul_enabled: true
          consul_service_name: "sql-db"
  - name: metron_agent
    release: loggregator
    properties: *metron_agent_properties
- name: diego-api
  migrated_from:
  - name: diego-bbs
  azs:
  - z1
  - z2
  instances: 2
  vm_type: m3.large
  stemcell: default
  update:
    serial: true
  networks:
  - name: default
  jobs:
  - name: consul_agent
    release: consul
    consumes:
      consul_common: {from: consul_common_link}
      consul_server: nil
      consul_client: {from: consul_client_link}
    properties:
      consul:
        agent:
          services:
            silk-controller:
              name: silk-controller
  - name: cfdot
    release: diego
    properties:
      diego:
        cfdot:
          bbs: &diego_bbs_client_properties
            ca_cert: "((diego_bbs_client.ca))"
            client_cert: "((diego_bbs_client.certificate))"
            client_key: "((diego_bbs_client.private_key))"
  - name: bbs
    release: diego
    properties:
      diego:
        bbs:
          active_key_label: key-2016-06
          encryption_keys:
          - label: key-2016-06
            passphrase: "((diego_bbs_encryption_keys_passphrase))"
          sql:
            db_host: sql-db.service.cf.internal
            db_port: 3306
            db_schema: diego
            db_username: diego
            db_password: "((diego_database_password))"
            db_driver: mysql
          etcd:
            machines: []
            ca_cert: nil
            client_cert: nil
            client_key: nil
          ca_cert: "((diego_bbs_server.ca))"
          auctioneer: &diego_auctioneer_client_properties
            ca_cert: "((diego_auctioneer_client.ca))"
            client_cert: "((diego_auctioneer_client.certificate))"
            client_key: "((diego_auctioneer_client.private_key))"
          server_cert: "((diego_bbs_server.certificate))"
          server_key: "((diego_bbs_server.private_key))"
          rep:
            require_tls: true
            ca_cert: "((diego_rep_client.ca))"
            client_cert: "((diego_rep_client.certificate))"
            client_key: "((diego_rep_client.private_key))"
  - name: metron_agent
    release: loggregator
    properties: *metron_agent_properties
  - name: silk-controller
    release: cf-networking
    properties:
      cf_networking:
        silk_controller:
          ca_cert: ((silk_controller.ca))
          server_cert: ((silk_controller.certificate))
          server_key: ((silk_controller.private_key))
          database:
            type: mysql
            username: network_connectivity
            password: ((network_connectivity_database_password))
            host: sql-db.service.cf.internal
            port: 3306
            name: network_connectivity
        silk_daemon:
          ca_cert: ((silk_daemon.ca))
          client_cert: ((silk_daemon.certificate))
          client_key: ((silk_daemon.private_key))
- name: uaa
  azs:
  - z1
  - z2
  instances: 2
  vm_type: m3.medium
  vm_extensions:
  - 10GB_ephemeral_disk
  stemcell: default
  networks:
  - name: default
  jobs:
  - name: consul_agent
    release: consul
    consumes:
      consul_common: {from: consul_common_link}
      consul_server: nil
      consul_client: {from: consul_client_link}
    properties:
      consul:
        agent:
          services:
            uaa: {}
  - name: uaa
    release: uaa
    properties:
      login:
        saml:
          serviceProviderKey: "((uaa_login_saml.private_key))"
          serviceProviderKeyPassword: ''
          serviceProviderCertificate: "((uaa_login_saml.certificate))"
      uaa:
        sslCertificate: "((uaa_ssl.certificate))"
        sslPrivateKey: "((uaa_ssl.private_key))"
        zones:
          internal:
            hostnames:
            - uaa.service.cf.internal
        url: https://uaa.((system_domain))
        admin:
          client_secret: "((uaa_admin_client_secret))"
        scim:
          users:
          - name: admin
            password: "((cf_admin_password))"
            groups:
            - cloud_controller.admin
            - doppler.firehose
            - network.admin
            - openid
            - routing.router_groups.read
            - routing.router_groups.write
            - scim.read
            - scim.write
        jwt:
          policy:
            active_key_id: key-1
            keys:
              key-1:
                signingKey: "((uaa_jwt_signing_key.private_key))"
        clients:
          cc-service-dashboards:
            authorities: clients.read,clients.write,clients.admin
            authorized-grant-types: client_credentials
            scope: openid,cloud_controller_service_permissions.read
            secret: "((uaa_clients_cc-service-dashboards_secret))"
          cc_routing:
            authorities: routing.router_groups.read
            authorized-grant-types: client_credentials
            secret: "((uaa_clients_cc-routing_secret))"
          cf:
            access-token-validity: 600
            authorities: uaa.none
            authorized-grant-types: password,refresh_token
            override: true
            refresh-token-validity: 2592000
            scope: network.admin,network.write,cloud_controller.read,cloud_controller.write,openid,password.write,cloud_controller.admin,scim.read,scim.write,doppler.firehose,uaa.user,routing.router_groups.read,routing.router_groups.write
            secret: ''
          cloud_controller_username_lookup:
            authorities: scim.userids
            authorized-grant-types: client_credentials
            secret: "((uaa_clients_cloud_controller_username_lookup_secret))"
          doppler:
            authorities: uaa.resource
            override: true
            authorized-grant-types: client_credentials
            secret: "((uaa_clients_doppler_secret))"
          gorouter:
            authorities: routing.routes.read
            authorized-grant-types: client_credentials
            secret: "((uaa_clients_gorouter_secret))"
          ssh-proxy:
            authorized-grant-types: authorization_code
            autoapprove: true
            override: true
            redirect-uri: "https://uaa.((system_domain))/login"
            scope: openid,cloud_controller.read,cloud_controller.write
            secret: "((uaa_clients_ssh-proxy_secret))"
          routing_api_client:
            authorities: routing.routes.write,routing.routes.read,routing.router_groups.read
            authorized-grant-types: client_credentials
            secret: "((uaa_clients_routing_api_client_secret))"
          network-policy:
            authorities: uaa.resource,cloud_controller.admin_read_only
            authorized-grant-types: client_credentials
            secret: ((uaa_clients_network_policy_secret))
          tcp_emitter:
            authorities: routing.routes.write,routing.routes.read,routing.router_groups.read
            authorized-grant-types: client_credentials
            secret: "((uaa_clients_tcp_emitter_secret))"
      uaadb:
        databases:
        - name: uaa
          tag: uaa
        db_scheme: mysql
        port: 3306
        roles:
        - name: uaa
          password: "((uaa_database_password))"
          tag: admin
  - name: route_registrar
    release: routing
    properties:
      route_registrar:
        routes:
        - health_check:
            name: uaa-healthcheck
            script_path: "/var/vcap/jobs/uaa/bin/health_check"
          name: uaa
          port: 8080
          registration_interval: 10s
          tags:
            component: uaa
          uris:
          - uaa.((system_domain))
          - "*.uaa.((system_domain))"
          - login.((system_domain))
          - "*.login.((system_domain))"
  - name: metron_agent
    release: loggregator
    properties: *metron_agent_properties
  - name: statsd_injector
    release: statsd-injector
    properties: &statsd_injector_properties
      statsd_injector:
        deployment: "((system_domain))"
      loggregator:
        tls:
          ca_cert: "((loggregator_tls_statsdinjector.ca))"
          statsd_injector:
            cert: "((loggregator_tls_statsdinjector.certificate))"
            key: "((loggregator_tls_statsdinjector.private_key))"
- name: blobstore
  azs:
  - z1
  instances: 1
  vm_type: m3.large
  vm_extensions:
  - 10GB_ephemeral_disk
  persistent_disk_type: 100GB
  stemcell: default
  networks:
  - name: default
  jobs:
  - name: consul_agent
    release: consul
    consumes:
      consul_common: {from: consul_common_link}
      consul_server: nil
      consul_client: {from: consul_client_link}
    properties:
      consul:
        agent:
          services:
            blobstore: {}
  - name: blobstore
    release: capi
    properties:
      system_domain: "((system_domain))"
      blobstore:
        admin_users:
        - username: blobstore-user
          password: "((blobstore_admin_users_password))"
        secure_link:
          secret: "((blobstore_secure_link_secret))"
        tls:
          cert: "((blobstore_tls.certificate))"
          private_key: "((blobstore_tls.private_key))"
  - name: route_registrar
    release: routing
    properties:
      route_registrar:
        routes:
        - name: blobstore
          port: 8080
          registration_interval: 20s
          tags:
            component: blobstore
          uris:
          - blobstore.((system_domain))
  - name: metron_agent
    release: loggregator
    properties: *metron_agent_properties
- name: api
  azs:
  - z1
  - z2
  instances: 2
  vm_type: m3.large
  vm_extensions:
  - 50GB_ephemeral_disk
  stemcell: default
  networks:
  - name: default
  jobs:
  - name: consul_agent
    release: consul
    consumes:
      consul_common: {from: consul_common_link}
      consul_server: nil
      consul_client: {from: consul_client_link}
    properties:
      consul:
        agent:
          services:
            cloud_controller_ng: {}
            routing-api: {}
            policy-server:
              name: policy-server
  - name: cloud_controller_ng
    release: capi
    provides:
      cloud_controller: {as: cloud_controller, shared: true}
    properties:
      router:
        route_services_secret: "((router_route_services_secret))"
      hm9000:
        port: -1
      system_domain: "((system_domain))"
      app_domains: &app_domains
      - "((system_domain))"
      app_ssh:
        host_key_fingerprint: "((diego_ssh_proxy_host_key.public_key_fingerprint))"
      routing_api: &routing_api
        enabled: true
      ssl:
        skip_cert_verify: true
      uaa:
        ca_cert: "((uaa_ssl.ca))"
        clients:
          cc_routing:
            secret: "((uaa_clients_cc-routing_secret))"
          cloud_controller_username_lookup:
            secret: "((uaa_clients_cloud_controller_username_lookup_secret))"
          cc-service-dashboards:
            secret: "((uaa_clients_cc-service-dashboards_secret))"
        url: https://uaa.((system_domain))
        ssl:
          port: 8443
      cc:
        default_running_security_groups: &cc_default_running_security_groups
        - public_networks
        - dns
        default_staging_security_groups: &cc_default_staging_security_groups
        - public_networks
        - dns
        security_group_definitions: &cc_security_group_definitions
        - name: public_networks
          rules:
          - destination: 0.0.0.0-9.255.255.255
            protocol: all
          - destination: 11.0.0.0-169.253.255.255
            protocol: all
          - destination: 169.255.0.0-172.15.255.255
            protocol: all
          - destination: 172.32.0.0-192.167.255.255
            protocol: all
          - destination: 192.169.0.0-255.255.255.255
            protocol: all
        - name: dns
          rules:
          - destination: 0.0.0.0/0
            ports: '53'
            protocol: tcp
          - destination: 0.0.0.0/0
            ports: '53'
            protocol: udp
        install_buildpacks: &cc_install_buildpacks
        - name: binary_buildpack
          package: binary-buildpack
        - name: dotnet_core_buildpack
          package: dotnet-core-buildpack
        - name: go_buildpack
          package: go-buildpack
        - name: java_buildpack
          package: java-buildpack
        - name: nodejs_buildpack
          package: nodejs-buildpack
        - name: php_buildpack
          package: php-buildpack
        - name: python_buildpack
          package: python-buildpack
        - name: python_buildpack
          package: python-buildpack
        - name: ruby_buildpack
          package: ruby-buildpack
        - name: staticfile_buildpack
          package: staticfile-buildpack
        default_to_diego_backend: true
        db_encryption_key: "((cc_db_encryption_key))"
        bulk_api_password: "((cc_bulk_api_password))"
        internal_api_password: "((cc_internal_api_password))"
        staging_upload_user: staging_user
        staging_upload_password: "((cc_staging_upload_password))"
        quota_definitions: &quota_definitions
          default:
            memory_limit: 102400
            non_basic_services_allowed: true
            total_routes: 1000
            total_services: -1
            total_reserved_route_ports: 100
        buildpacks: &blobstore-properties
          blobstore_type: webdav
          webdav_config:
            ca_cert: "((blobstore_tls.ca))"
            blobstore_timeout: 5
            password: "((blobstore_admin_users_password))"
            private_endpoint: https://blobstore.service.cf.internal:4443
            public_endpoint: https://blobstore.((system_domain))
            username: blobstore-user
        resource_pool: *blobstore-properties
        packages: *blobstore-properties
        droplets: *blobstore-properties
        mutual_tls: &cc_mutual_tls
          ca_cert: "((cc_tls.ca))"
          public_cert: "((cc_tls.certificate))"
          private_key: "((cc_tls.private_key))"
      ccdb: &ccdb
        databases:
        - name: cloud_controller
          tag: cc
        db_scheme: mysql
        port: 3306
        roles:
        - name: cloud_controller
          password: "((cc_database_password))"
          tag: admin
  - name: binary-buildpack
    release: binary-buildpack
  - name: dotnet-core-buildpack
    release: dotnet-core-buildpack
  - name: go-buildpack
    release: go-buildpack
  - name: java-buildpack
    release: java-buildpack
  - name: nodejs-buildpack
    release: nodejs-buildpack
  - name: php-buildpack
    release: php-buildpack
  - name: python-buildpack
    release: python-buildpack
  - name: ruby-buildpack
    release: ruby-buildpack
  - name: staticfile-buildpack
    release: staticfile-buildpack
  - name: route_registrar
    release: routing
    properties:
      route_registrar:
        routes:
        - name: api
          registration_interval: 20s
          port: 9022
          uris:
          - api.((system_domain))
        - name: policy-server
          port: 4002
          registration_interval: 20s
          uris:
          - api.((system_domain))/networking
  - name: metron_agent
    release: loggregator
    properties: *metron_agent_properties
  - name: statsd_injector
    release: statsd-injector
    properties: *statsd_injector_properties
  - name: routing-api
    release: routing
    properties:
      routing_api:
        system_domain: "((system_domain))"
        router_groups:
        - name: default-tcp
          type: tcp
          reservable_ports: 1024-1123
        sqldb:
          host: sql-db.service.cf.internal
          type: mysql
          port: 3306
          schema: routing-api
          username: routing-api
          password: "((routing_api_database_password))"
      uaa:
        ca_cert: "((uaa_ca.certificate))"
        tls_port: 8443
  - name: policy-server
    release: cf-networking
    properties:
      cf_networking:
        policy_server:
          uaa_client_secret: ((uaa_clients_network_policy_secret))
          uaa_ca: ((uaa_ssl.ca))
          ca_cert: ((network_policy_server.ca))
          server_cert: ((network_policy_server.certificate))
          server_key: ((network_policy_server.private_key))
          database:
            type: mysql
            username: network_policy
            password: ((network_policy_database_password))
            host: sql-db.service.cf.internal
            port: 3306
            name: network_policy
- name: cc-worker
  azs:
  - z1
  - z2
  instances: 2
  vm_type: m3.medium
  vm_extensions:
  - 10GB_ephemeral_disk
  stemcell: default
  networks:
  - name: default
  jobs:
  - name: consul_agent
    release: consul
    consumes:
      consul_common: {from: consul_common_link}
      consul_server: nil
      consul_client: {from: consul_client_link}
  - name: metron_agent
    release: loggregator
    properties: *metron_agent_properties
  - name: cloud_controller_worker
    release: capi
    properties:
      hm9000:
        port: -1
      cc:
        db_encryption_key: "((cc_db_encryption_key))"
        default_to_diego_backend: true
        install_buildpacks: *cc_install_buildpacks
        default_running_security_groups: *cc_default_running_security_groups
        default_staging_security_groups: *cc_default_staging_security_groups
        security_group_definitions: *cc_security_group_definitions
        internal_api_password: "((cc_internal_api_password))"
        bulk_api_password: "((cc_bulk_api_password))"
        quota_definitions: *quota_definitions
        staging_upload_user: staging_user
        staging_upload_password: "((cc_staging_upload_password))"
        resource_pool: *blobstore-properties
        packages: *blobstore-properties
        droplets: *blobstore-properties
        buildpacks: *blobstore-properties
        mutual_tls: *cc_mutual_tls
      ccdb: *ccdb
      system_domain: "((system_domain))"
      app_domains: *app_domains
      routing_api: *routing_api
      ssl:
        skip_cert_verify: true
      uaa:
        ca_cert: "((uaa_ssl.ca))"
        clients:
          cc-service-dashboards:
            secret: "((uaa_clients_cc-service-dashboards_secret))"
          cc_routing:
            secret: "((uaa_clients_cc-routing_secret))"

        url: https://uaa.((system_domain))
        ssl:
          port: 8443
- name: router
  azs:
  - z1
  - z2
  instances: 2
  vm_type: m3.medium
  vm_extensions:
  - cf-router-network-properties
  stemcell: default
  update:
    max_in_flight: 1
    serial: true
  networks:
  - name: default
  jobs:
  - name: consul_agent
    release: consul
    consumes:
      consul_common: {from: consul_common_link}
      consul_server: nil
      consul_client: {from: consul_client_link}
    properties:
      consul:
        agent:
          services:
            gorouter: {}
  - name: gorouter
    release: routing
    properties:
      router:
        ssl_skip_validation: true
        enable_ssl: true
        ssl_cert: "((router_ssl.certificate))"
        ssl_key: "((router_ssl.private_key))"
        status:
          password: "((router_status_password))"
          user: router-status
        route_services_secret: "((router_route_services_secret))"
        tracing:
          enable_zipkin: true
      routing_api:
        enabled: true
      uaa:
        clients:
          gorouter:
            secret: "((uaa_clients_gorouter_secret))"
        ca_cert: "((uaa_ssl.ca))"
        ssl:
          port: 8443
  - name: metron_agent
    release: loggregator
    properties: *metron_agent_properties
- name: diego-brain
  azs:
  - z1
  - z2
  instances: 2
  vm_type: m3.medium
  vm_extensions:
  - diego-ssh-proxy-network-properties
  - 10GB_ephemeral_disk
  stemcell: default
  update:
    serial: true
  networks:
  - name: default
  jobs:
  - name: consul_agent
    release: consul
    consumes:
      consul_common: {from: consul_common_link}
      consul_server: nil
      consul_client: {from: consul_client_link}
  - name: cfdot
    release: diego
    properties:
      diego:
        cfdot:
          bbs: *diego_bbs_client_properties
  - name: ssh_proxy
    release: diego
    properties:
      diego:
        ssh_proxy:
          enable_cf_auth: true
          host_key: "((diego_ssh_proxy_host_key.private_key))"
          uaa_secret: "((uaa_clients_ssh-proxy_secret))"
          uaa:
            ca_cert: "((uaa_ssl.ca))"
            port: 8443
          bbs: *diego_bbs_client_properties
  - name: file_server
    release: diego
  - name: auctioneer
    release: diego
    properties:
      diego:
        auctioneer:
          bbs: *diego_bbs_client_properties
          ca_cert: "((diego_auctioneer_server.ca))"
          server_cert: "((diego_auctioneer_server.certificate))"
          server_key: "((diego_auctioneer_server.private_key))"
          rep:
            require_tls: true
            ca_cert: "((diego_rep_client.ca))"
            client_cert: "((diego_rep_client.certificate))"
            client_key: "((diego_rep_client.private_key))"
  - name: metron_agent
    release: loggregator
    properties: *metron_agent_properties
- name: diego-cell
  azs:
  - z1
  - z2
  instances: 2
  vm_type: r3.xlarge
  vm_extensions:
  - 100GB_ephemeral_disk
  stemcell: default
  networks:
  - name: default
  jobs:
  - name: consul_agent
    release: consul
    consumes:
      consul_common: {from: consul_common_link}
      consul_server: nil
      consul_client: {from: consul_client_link}
  - name: cflinuxfs2-rootfs-setup
    release: cflinuxfs2
  - name: garden
    release: garden-runc
    properties:
      garden:
        cleanup_process_dirs_on_wait: true
        debug_listen_address: 127.0.0.1:17019
        default_container_grace_time: 0
        destroy_containers_on_start: true
        graph_cleanup_threshold_in_mb: 0
        deny_networks:
        - 0.0.0.0/0
        persistent_image_list:
        - "/var/vcap/packages/cflinuxfs2/rootfs"
        network_plugin: /var/vcap/packages/runc-cni/bin/garden-external-networker
        network_plugin_extra_args:
        - --configFile=/var/vcap/jobs/garden-cni/config/adapter.json
  - name: rep
    release: diego
    properties:
      diego:
        rep:
          bbs: *diego_bbs_client_properties
          preloaded_rootfses:
          - cflinuxfs2:/var/vcap/packages/cflinuxfs2/rootfs
          require_tls: true
          ca_cert: "((diego_rep_agent.ca))"
          server_cert: "((diego_rep_agent.certificate))"
          server_key: "((diego_rep_agent.private_key))"
          enable_legacy_api_endpoints: false
      tls:
        ca_cert: "((diego_rep_agent.ca))"
        cert: "((diego_rep_agent.certificate))"
        key: "((diego_rep_agent.private_key))"
  - name: metron_agent
    release: loggregator
    properties: *metron_agent_properties
  - name: cfdot
    release: diego
    properties:
      diego:
        cfdot:
          bbs: *diego_bbs_client_properties
  - name: route_emitter
    release: diego
    properties:
      diego:
        route_emitter:
          local_mode: true
          bbs:
            ca_cert: "((diego_bbs_client.ca))"
            client_cert: "((diego_bbs_client.certificate))"
            client_key: "((diego_bbs_client.private_key))"
      tcp:
        enabled: true
      uaa:
        ca_cert: "((uaa_ca.certificate))"
        client_secret: "((uaa_clients_tcp_emitter_secret))"
  - name: garden-cni
    release: cf-networking
  - name: netmon
    release: cf-networking
  - name: vxlan-policy-agent
    release: cf-networking
    properties:
      cf_networking:
        vxlan_policy_agent:
          ca_cert: ((network_policy_client.ca))
          client_cert: ((network_policy_client.certificate))
          client_key: ((network_policy_client.private_key))
  - name: silk-daemon
    release: cf-networking
    properties:
      cf_networking:
        silk_daemon:
          ca_cert: ((silk_daemon.ca))
          client_cert: ((silk_daemon.certificate))
          client_key: ((silk_daemon.private_key))
  - name: silk-cni
    release: cf-networking
- name: cc-clock
  azs:
  - z1
  instances: 1
  vm_type: m3.large
  vm_extensions:
  - 10GB_ephemeral_disk
  stemcell: default
  networks:
  - name: default
  jobs:
  - name: consul_agent
    release: consul
    consumes:
      consul_common: {from: consul_common_link}
      consul_server: nil
      consul_client: {from: consul_client_link}
  - name: cloud_controller_clock
    release: capi
    properties:
      hm9000:
        port: -1
      cc:
        db_encryption_key: "((cc_db_encryption_key))"
        default_to_diego_backend: true
        install_buildpacks: *cc_install_buildpacks
        default_running_security_groups: *cc_default_running_security_groups
        default_staging_security_groups: *cc_default_staging_security_groups
        security_group_definitions: *cc_security_group_definitions
        internal_api_password: "((cc_internal_api_password))"
        bulk_api_password: "((cc_bulk_api_password))"
        quota_definitions: *quota_definitions
        staging_upload_user: staging_user
        staging_upload_password: "((cc_staging_upload_password))"
        resource_pool: *blobstore-properties
        packages: *blobstore-properties
        droplets: *blobstore-properties
        buildpacks: *blobstore-properties
        mutual_tls: *cc_mutual_tls
      ccdb: *ccdb
      system_domain: "((system_domain))"
      app_domains: *app_domains
      routing_api: *routing_api
      uaa:
        ca_cert: "((uaa_ssl.ca))"
        clients:
          cc-service-dashboards:
            secret: "((uaa_clients_cc-service-dashboards_secret))"
          cc_routing:
            secret: "((uaa_clients_cc-routing_secret))"
        url: https://uaa.((system_domain))
        ssl:
          port: 8443
  - name: metron_agent
    release: loggregator
    properties: *metron_agent_properties
  - name: statsd_injector
    release: statsd-injector
    properties: *statsd_injector_properties
- name: cc-bridge
  azs:
  - z1
  - z2
  instances: 2
  vm_type: m3.medium
  vm_extensions:
  - 10GB_ephemeral_disk
  stemcell: default
  networks:
  - name: default
  jobs:
  - name: consul_agent
    release: consul
    consumes:
      consul_common: {from: consul_common_link}
      consul_server: nil
      consul_client: {from: consul_client_link}
  - name: stager
    release: capi
    properties:
      capi:
        stager:
          bbs: *diego_bbs_client_properties
          cc:
            basic_auth_password: "((cc_internal_api_password))"
  - name: nsync
    release: capi
    properties:
      diego:
        ssl: *ssl
      capi:
        nsync:
          bbs: *diego_bbs_client_properties
          cc:
            basic_auth_password: "((cc_internal_api_password))"
            base_url: https://api.((system_domain))
  - name: tps
    release: capi
    properties:
      capi:
        tps:
          bbs: *diego_bbs_client_properties
          cc:
            ca_cert: "((cc_bridge_tps.ca))"
            client_cert: "((cc_bridge_tps.certificate))"
            client_key: "((cc_bridge_tps.private_key))"
  - name: cc_uploader
    release: capi
    properties:
      capi:
        cc_uploader:
          cc:
            ca_cert: "((cc_bridge_cc_uploader.ca))"
            client_cert: "((cc_bridge_cc_uploader.certificate))"
            client_key: "((cc_bridge_cc_uploader.private_key))"
          mutual_tls:
            ca_cert: "((cc_bridge_cc_uploader_server.ca))"
            server_cert: "((cc_bridge_cc_uploader_server.certificate))"
            server_key: "((cc_bridge_cc_uploader_server.private_key))"
  - name: metron_agent
    release: loggregator
    properties: *metron_agent_properties
- name: log-api
  azs:
  - z1
  - z2
  instances: 2
  vm_type: t2.small
  vm_extensions:
  - 10GB_ephemeral_disk
  stemcell: default
  update:
    max_in_flight: 1
    serial: true
  networks:
  - name: default
  jobs:
  - name: consul_agent
    release: consul
    consumes:
      consul_common: {from: consul_common_link}
      consul_server: nil
      consul_client: {from: consul_client_link}
    properties:
      consul:
        agent:
          services:
            loggregator_trafficcontroller: {}
  - name: loggregator_trafficcontroller
    release: loggregator
    properties:
      traffic_controller:
        etcd:
          client_cert: "((etcd_client.certificate))"
          client_key: "((etcd_client.private_key))"
      uaa:
        url: https://uaa.((system_domain))
      loggregator:
        tls:
          ca_cert: "((loggregator_tls_tc.ca))"
          trafficcontroller:
            cert: "((loggregator_tls_tc.certificate))"
            key: "((loggregator_tls_tc.private_key))"
        etcd:
          require_ssl: true
          ca_cert: "((etcd_server.ca))"
          machines:
          - cf-etcd.service.cf.internal
        uaa:
          client_secret: "((uaa_clients_doppler_secret))"
      system_domain: "((system_domain))"
      ssl: *ssl
      cc:
        srv_api_uri: "https://cloud-controller-ng.service.cf.internal:9022"
  - name: route_registrar
    release: routing
    properties:
      route_registrar:
        routes:
        - name: loggregator
          port: 8080
          registration_interval: 20s
          uris:
          - loggregator.((system_domain))
        - name: doppler
          port: 8081
          registration_interval: 20s
          uris:
          - doppler.((system_domain))
          - "*.doppler.((system_domain))"
  - name: metron_agent
    release: loggregator
    properties: *metron_agent_properties

variables:
- name: blobstore_admin_users_password
  type: password
- name: blobstore_secure_link_secret
  type: password
- name: cc_bulk_api_password
  type: password
- name: cc_db_encryption_key
  type: password
- name: cc_internal_api_password
  type: password
- name: cc_staging_upload_password
  type: password
- name: cf_mysql_mysql_admin_password
  type: password
- name: cf_mysql_mysql_cluster_health_password
  type: password
- name: cf_mysql_mysql_galera_healthcheck_endpoint_password
  type: password
- name: cf_mysql_mysql_galera_healthcheck_password
  type: password
- name: cf_mysql_proxy_api_password
  type: password
- name: cc_database_password
  type: password
- name: diego_database_password
  type: password
- name: uaa_database_password
  type: password
- name: routing_api_database_password
  type: password
- name: network_policy_database_password
  type: password
- name: network_connectivity_database_password
  type: password
- name: uaa_clients_network_policy_secret
  type: password
- name: silk_ca
  type: certificate
  options:
    is_ca: true
    common_name: silk-ca
- name: silk_controller
  type: certificate
  options:
    ca: silk_ca
    common_name: silk-controller.service.cf.internal
    extended_key_usage:
    - server_auth
- name: silk_daemon
  type: certificate
  options:
    ca: silk_ca
    common_name: silk-daemon
    extended_key_usage:
    - client_auth
- name: network_policy_ca
  type: certificate
  options:
    is_ca: true
    common_name: networkPolicyCA
- name: network_policy_server
  type: certificate
  options:
    ca: network_policy_ca
    common_name: policy-server.service.cf.internal
    extended_key_usage:
    - server_auth
- name: network_policy_client
  type: certificate
  options:
    ca: network_policy_ca
    common_name: clientName
    extended_key_usage:
    - client_auth
- name: uaa_clients_routing_api_client_secret
  type: password
- name: uaa_clients_tcp_emitter_secret
  type: password
- name: nats_password
  type: password
- name: router_status_password
  type: password
- name: cf_admin_password
  type: password
- name: dropsonde_shared_secret
  type: password
- name: router_route_services_secret
  type: password
- name: uaa_admin_client_secret
  type: password
- name: uaa_clients_cc-routing_secret
  type: password
- name: uaa_clients_cc-service-dashboards_secret
  type: password
- name: uaa_clients_cloud_controller_username_lookup_secret
  type: password
- name: uaa_clients_doppler_secret
  type: password
- name: uaa_clients_gorouter_secret
  type: password
- name: uaa_clients_ssh-proxy_secret
  type: password
- name: diego_bbs_encryption_keys_passphrase
  type: password
- name: consul_encrypt_key
  type: password
- name: diego_ssh_proxy_host_key
  type: ssh
- name: uaa_jwt_signing_key
  type: rsa
- name: service_cf_internal_ca
  type: certificate
  options:
    is_ca: true
    common_name: internalCA
- name: etcd_ca
  type: certificate
  options:
    is_ca: true
    common_name: etcdCA
- name: etcd_server
  type: certificate
  options:
    ca: etcd_ca
    common_name: etcd.service.cf.internal
    alternative_names:
    - "*.etcd.service.cf.internal"
    - etcd.service.cf.internal
    - "*.cf-etcd.service.cf.internal"
    - cf-etcd.service.cf.internal
    extended_key_usage:
    - server_auth
- name: etcd_client
  type: certificate
  options:
    ca: etcd_ca
    common_name: clientName
    extended_key_usage:
    - client_auth
- name: etcd_peer_ca
  type: certificate
  options:
    is_ca: true
    common_name: peerCA
- name: etcd_peer
  type: certificate
  options:
    ca: etcd_peer_ca
    common_name: etcd.service.cf.internal
    alternative_names:
    - "*.etcd.service.cf.internal"
    - etcd.service.cf.internal
    - "*.cf-etcd.service.cf.internal"
    - cf-etcd.service.cf.internal
    extended_key_usage:
    - client_auth
    - server_auth
- name: blobstore_tls
  type: certificate
  options:
    ca: service_cf_internal_ca
    common_name: blobstore.service.cf.internal
- name: consul_agent_ca
  type: certificate
  options:
    is_ca: true
    common_name: consulCA
- name: consul_agent
  type: certificate
  options:
    ca: consul_agent_ca
    common_name: consul_agent
    extended_key_usage:
    - client_auth
    - server_auth
    alternative_names:
    - 127.0.0.1
- name: consul_server
  type: certificate
  options:
    ca: consul_agent_ca
    common_name: server.dc1.cf.internal
    extended_key_usage:
    - client_auth
    - server_auth
- name: diego_auctioneer_client
  type: certificate
  options:
    ca: service_cf_internal_ca
    common_name: auctioneer client
    extended_key_usage:
    - client_auth
- name: diego_auctioneer_server
  type: certificate
  options:
    ca: service_cf_internal_ca
    common_name: auctioneer.service.cf.internal
    extended_key_usage:
    - server_auth
    alternative_names:
    - "*.auctioneer.service.cf.internal"
    - auctioneer.service.cf.internal
- name: diego_bbs_client
  type: certificate
  options:
    ca: service_cf_internal_ca
    common_name: bbs client
    extended_key_usage:
    - client_auth
- name: diego_bbs_server
  type: certificate
  options:
    ca: service_cf_internal_ca
    common_name: bbs.service.cf.internal
    extended_key_usage:
    - server_auth
    - client_auth
    alternative_names:
    - "*.bbs.service.cf.internal"
    - bbs.service.cf.internal
- name: diego_rep_client
  type: certificate
  options:
    ca: service_cf_internal_ca
    common_name: rep client
    extended_key_usage:
    - client_auth
- name: diego_rep_agent
  type: certificate
  options:
    ca: service_cf_internal_ca
    common_name: cell.service.cf.internal
    extended_key_usage:
    - client_auth
    - server_auth
    alternative_names:
    - "*.cell.service.cf.internal"
    - cell.service.cf.internal
- name: loggregator_ca
  type: certificate
  options:
    is_ca: true
    common_name: loggregatorCA
- name: loggregator_tls_statsdinjector
  type: certificate
  options:
    ca: loggregator_ca
    common_name: statsdinjector
    extended_key_usage:
    - client_auth
- name: loggregator_tls_metron
  type: certificate
  options:
    ca: loggregator_ca
    common_name: metron
    extended_key_usage:
    - client_auth
    - server_auth
- name: loggregator_tls_doppler
  type: certificate
  options:
    ca: loggregator_ca
    common_name: doppler
    extended_key_usage:
    - client_auth
    - server_auth
- name: loggregator_tls_tc
  type: certificate
  options:
    ca: loggregator_ca
    common_name: trafficcontroller
    extended_key_usage:
    - client_auth
    - server_auth
- name: loggregator_tls_syslogdrainbinder
  type: certificate
  options:
    ca: service_cf_internal_ca
    common_name: syslogdrainbinder
    extended_key_usage:
    - client_auth
- name: router_ca
  type: certificate
  options:
    is_ca: true
    common_name: routerCA
- name: router_ssl
  type: certificate
  options:
    ca: router_ca
    common_name: routerSSL
    alternative_names:
    - "((system_domain))"
    - "*.((system_domain))"
- name: uaa_ca
  type: certificate
  options:
    is_ca: true
    common_name: uaaCA
- name: uaa_ssl
  type: certificate
  options:
    ca: uaa_ca
    common_name: uaa.service.cf.internal
    alternative_names:
    - uaa.service.cf.internal
- name: uaa_login_saml
  type: certificate
  options:
    ca: uaa_ca
    common_name: uaa_login_saml
- name: cc_tls
  type: certificate
  options:
    ca: service_cf_internal_ca
    common_name: cloud-controller-ng.service.cf.internal
    extended_key_usage:
    - client_auth
    - server_auth
- name: cc_bridge_tps
  type: certificate
  options:
    ca: service_cf_internal_ca
    common_name: tps_watcher
    extended_key_usage:
    - client_auth
- name: cc_bridge_cc_uploader
  type: certificate
  options:
    ca: service_cf_internal_ca
    common_name: cc_uploader
    extended_key_usage:
    - client_auth
- name: cc_bridge_cc_uploader_server
  type: certificate
  options:
    ca: service_cf_internal_ca
    common_name: cc-uploader.service.cf.internal
    extended_key_usage:
    - server_auth

releases:
- name: binary-buildpack
  url: https://bosh.io/d/github.com/cloudfoundry/binary-buildpack-release?v=1.0.13
  version: 1.0.13
  sha1: f894e46d279cd965885f255439ea14188c48306d
- name: capi
  url: https://bosh.io/d/github.com/cloudfoundry/capi-release?v=1.32.0
  version: 1.32.0
  sha1: 46d55d5f3a6858a8dbccfef32de5b95b6fc25294
- name: cf-mysql
  url: https://bosh.io/d/github.com/cloudfoundry/cf-mysql-release?v=36
  version: "36"
  sha1: 746240c005465ffa105ee89e53e401e311b4fbf8
- name: cf-networking
  url: https://bosh.io/d/github.com/cloudfoundry-incubator/cf-networking-release?v=1.2.0
  version: 1.2.0
  sha1: c5a61b8be54e62b6d0eacfe2e0a45880345a3a21
- name: cf-smoke-tests
  url: https://bosh.io/d/github.com/cloudfoundry/cf-smoke-tests-release?v=36
  version: "36"
  sha1: d943166254576036735a43a5ea57728276f83510
- name: cflinuxfs2
  url: https://bosh.io/d/github.com/cloudfoundry/cflinuxfs2-release?v=1.137.0
  version: 1.137.0
  sha1: d89d3d31987c463768972678d7de8f94c439f6dc
- name: consul
  url: https://bosh.io/d/github.com/cloudfoundry-incubator/consul-release?v=170
  version: "170"
  sha1: 9a3d8138e785088f586bcedcc32fb82abdab120b
- name: diego
  url: https://bosh.io/d/github.com/cloudfoundry/diego-release?v=1.22.0
  version: 1.22.0
  sha1: 5cb13b43347cb8e8a90a048aa72bf9e6f999398d
- name: dotnet-core-buildpack
  url: https://bosh.io/d/github.com/cloudfoundry/dotnet-core-buildpack-release?v=1.0.20
  version: 1.0.20
  sha1: 2df8c20d16642f44fa78efce92d6d096bb80f390
- name: etcd
  url: https://bosh.io/d/github.com/cloudfoundry-incubator/etcd-release?v=112
  version: "112"
  sha1: c912b285e6f0ea2d3f84b73ab582f02778499a24
- name: garden-runc
  url: https://bosh.io/d/github.com/cloudfoundry/garden-runc-release?v=1.9.0
  version: 1.9.0
  sha1: 77bfe8bdb2c3daec5b40f5116a6216badabd196c
- name: go-buildpack
  url: https://bosh.io/d/github.com/cloudfoundry/go-buildpack-release?v=1.8.5
  version: 1.8.5
  sha1: e38c66d8bc1e9af917e083724f1bb1f9f0f3210f
- name: java-buildpack
  url: https://bosh.io/d/github.com/cloudfoundry/java-buildpack-release?v=3.18
  version: "3.18"
  sha1: 8311ef3ce3936e30d3c90259660ea856c0aaffaf
- name: loggregator
  url: https://bosh.io/d/github.com/cloudfoundry/loggregator?v=91
  version: "91"
  sha1: 5acc47a70f5fa24eda85e72e72390eac968882f0
- name: nats
  url: https://bosh.io/d/github.com/cloudfoundry/nats-release?v=21
  version: "21"
  sha1: 2ac57ef37af7bc96243d06b4becaa32f2ce109fd
- name: nodejs-buildpack
  url: https://bosh.io/d/github.com/cloudfoundry/nodejs-buildpack-release?v=1.5.36
  version: 1.5.36
  sha1: 759ec20ed42e4795dc0a49022e6a605cb9af2bec
- name: php-buildpack
  url: https://bosh.io/d/github.com/cloudfoundry/php-buildpack-release?v=4.3.35
  version: 4.3.35
  sha1: 1991c9990c9548a5bc494214fb93c1a3f06d75b3
- name: python-buildpack
  url: https://bosh.io/d/github.com/cloudfoundry/python-buildpack-release?v=1.5.19
  version: 1.5.19
  sha1: 4ab0f8d0fc0f93adbb2cfde53f1c93dc3c41a283
- name: routing
  url: https://bosh.io/d/github.com/cloudfoundry-incubator/cf-routing-release?v=0.159.0
  version: 0.159.0
  sha1: 739f663f976fea826595880cfd58470bc8d49172
- name: ruby-buildpack
  url: https://bosh.io/d/github.com/cloudfoundry/ruby-buildpack-release?v=1.6.41
  version: 1.6.41
  sha1: 6ed806abf2b3754506aecdcb72de5cdaaedfa4a7
- name: staticfile-buildpack
  url: https://bosh.io/d/github.com/cloudfoundry/staticfile-buildpack-release?v=1.4.9
  version: 1.4.9
  sha1: b05357c7de4adb910a14f07a5eec6acdcc525e45
- name: statsd-injector
  url: https://bosh.io/d/github.com/cloudfoundry/statsd-injector-release?v=1.0.28
  version: 1.0.28
  sha1: 655c86c44731fb88c10dc3628d77dfb8ebd9da26
- name: uaa
  url: https://bosh.io/d/github.com/cloudfoundry/uaa-release?v=41
  version: "41"
  sha1: a1b1818fb4f5e722a6c3073d364ce4c400e5fb31
stemcells:
- alias: default
  os: ubuntu-trusty
  version: "3421.11"
