# Kong API Gateway Configuration

_format_version: "3.0"

services:
  - name: example-service
    url: http://example-service:8080
    routes:
      - name: example-route
        paths:
          - /api/example
        methods:
          - GET
          - POST
          - PUT
          - DELETE
        strip_path: false
        preserve_host: true

plugins:
  - name: rate-limiting
    service: example-service
    config:
      minute: 100
      hour: 1000
      policy: local
      fault_tolerant: true
      hide_client_headers: false

  - name: cors
    service: example-service
    config:
      origins:
        - "*"
      methods:
        - GET
        - POST
        - PUT
        - DELETE
        - OPTIONS
      headers:
        - Accept
        - Accept-Version
        - Content-Length
        - Content-MD5
        - Content-Type
        - Date
        - Authorization
      exposed_headers:
        - X-Auth-Token
      credentials: true
      max_age: 3600

  - name: jwt
    service: example-service
    config:
      uri_param_names:
        - token
      cookie_names:
        - jwt
      claims_to_verify:
        - exp
        - iat
      secret_is_base64: false
      run_on_preflight: true

consumers:
  - username: api-consumer
    custom_id: api-consumer-001

jwt_secrets:
  - consumer: api-consumer
    key: api-key-001
    secret: your-secret-key-here