Configuration

supergraph:
  listen: 127.0.0.1:4000
  introspection: true
  path: /graphql

sandbox:
  enabled: true

homepage:
  enabled: false

cors:
  allow_any_origin: true  # development only

headers:
  all:
    request:
      - propagate:
          matching: ".*"

telemetry:
  # ... telemetry config

cors:
  origins:
    - "*"

supergraph:
  # Address to listen on
  listen: 127.0.0.1:4000

  # GraphQL endpoint path
  path: /graphql

  # Enable introspection queries
  introspection: true

  # Query planning options
  query_planning:
    # Enable query plan caching
    cache:
      in_memory:
        limit: 512

# Apollo Sandbox (GraphQL IDE)
sandbox:
  enabled: true  # Disabled by default in production

# Introspection (required for Sandbox)
supergraph:
  introspection: true  # Disabled by default in production

cors:
  origins:
    - http://localhost:3000
    - https://studio.apollographql.com
  allow_headers:
    - Content-Type
    - Authorization
  methods:
    - GET
    - POST
    - OPTIONS
  allow_credentials: true
  max_age: 24h  # duration string

cors:
  allow_credentials: true
  methods:
    - GET
    - POST
    - OPTIONS
  max_age: 24h  # duration string, not integer
  policies:
    - origins:
        - http://localhost:3000
        - https://studio.apollographql.com
      allow_headers:
        - Content-Type
        - Authorization

# Override subgraph URLs (useful for local development)
override_subgraph_url:
  products: http://localhost:4001/graphql
  reviews: http://localhost:4002/graphql

# Subgraph-specific settings
traffic_shaping:
  all:
    timeout: 30s
  subgraphs:
    products:
      timeout: 60s  # Override for slow subgraph

traffic_shaping:
  # Apply to all subgraphs
  all:
    # Request timeout
    timeout: 30s

    # Rate limiting
    global_rate_limit:
      capacity: 1000
      interval: 1s

  # Router-level settings
  router:
    timeout: 60s

  # Per-subgraph settings
  subgraphs:
    slow-service:
      timeout: 120s

authentication:
  router:
    jwt:
      jwks:
        - url: https://auth.example.com/.well-known/jwks.json
          issuer: https://auth.example.com/  # singular string

authorization:
  require_authentication: true

authentication:
  router:
    jwt:
      jwks:
        - url: https://auth.example.com/.well-known/jwks.json
          issuers:                              # plural array
            - https://auth.example.com/

authorization:
  require_authentication: true

authorization:
  directives:
    enabled: false   # default is true — only set this to turn directives OFF

extend schema
  @link(url: "https://specs.apollo.dev/federation/v2.6",
        import: ["@authenticated", "@requiresScopes", "@policy"])

type Query {
  me: User @authenticated
  users: [User!]! @requiresScopes(scopes: [["read:others"]])
}

type User {
  id: ID!
  email: String @requiresScopes(scopes: [["read:email"]])
  creditCard: String @policy(policies: [["read_credit_card"]])
}

# Minimal response caching setup
response_cache:
  enabled: true
  subgraph:
    all:
      enabled: true
      ttl: 5m
      redis:
        urls: ["redis://localhost:6379"]

apq:
  enabled: true
  router:
    cache:
      in_memory:
        limit: 512
      # Or Redis
      # redis:
      #   urls:
      #     - redis://localhost:6379

persisted_queries:
  enabled: true
  log_unknown: true

persisted_queries:
  enabled: true
  safelist:
    enabled: true
apq:
  enabled: false   # REQUIRED: APQ and safelisting are mutually exclusive

persisted_queries:
  enabled: true
  safelist:
    enabled: true
    require_id: true
apq:
  enabled: false

persisted_queries:
  enabled: true
  local_manifests:
    - ./persisted-query-manifest.json
  hot_reload: true   # optional: reload the manifest file on change (local_manifests only)

limits:
  # Maximum request body size
  http_max_request_bytes: 2000000  # 2MB

  # Query complexity limits
  max_depth: 15
  max_height: 200
  max_aliases: 30
  max_root_fields: 20

# Control which subgraph errors are exposed to clients
include_subgraph_errors:
  all: true  # Include all subgraph errors (development)

  # Or selectively
  # all: false
  # subgraphs:
  #   products: true  # Only expose products errors

subscription:
  enabled: true
  mode:
    # WebSocket-based subscriptions
    passthrough:
      all:
        path: /ws

    # Or callback-based
    # callback:
    #   public_url: https://router.example.com/callback

# router.dev.yaml
supergraph:
  introspection: true

sandbox:
  enabled: true

include_subgraph_errors:
  all: true

telemetry:
  exporters:
    logging:
      stdout:
        enabled: true
        format: text

# router.prod.yaml
supergraph:
  listen: 0.0.0.0:4000
  introspection: false

sandbox:
  enabled: false

homepage:
  enabled: false

health_check:
  enabled: true
  listen: 0.0.0.0:8088
  path: /health

include_subgraph_errors:
  all: false

# CORS — use v1 or v2 format as appropriate (see CORS section above)
cors:
  origins:
    - https://app.example.com

telemetry:
  exporters:
    tracing:
      otlp:
        enabled: true
        endpoint: http://collector:4317

supergraph:
  listen: ${env.ROUTER_LISTEN_ADDRESS:-127.0.0.1:4000}

override_subgraph_url:
  products: ${env.PRODUCTS_URL}

authentication:
  router:
    jwt:
      jwks:
        - url: ${env.JWKS_URL}

router config validate router.yaml