luci_notify/frontend/app.yaml

service: default
runtime: go122
app_engine_apis: true

instance_class: F4_1G

luci_gae_vars:
  luci-notify-dev:
    AUTH_SERVICE_HOST: chrome-infra-auth-dev.appspot.com
    CONFIG_SERVICE_HOST: config.luci.app
    CRON_AUTHORIZED_CALLER: cloud-scheduler-jobs@luci-notify-dev.iam.gserviceaccount.com
    PUBSUB_AUTHORIZED_CALLER: cloud-pubsub-pusher@luci-notify-dev.iam.gserviceaccount.com
    SPANNER_DB: projects/luci-notify-dev/instances/dev/databases/luci-notify-dev
    TQ_PUSH_AS: cloud-tasks-pusher@luci-notify-dev.iam.gserviceaccount.com
    TQ_TARGET_HOST: staging.notify.api.luci.app
    TS_MON_ACCOUNT: app-engine-metric-publishers@prodx-mon-chrome-infra.google.com.iam.gserviceaccount.com

handlers:
# Pubsub Handler.  This is strictly necessary because the default module
# contains a /.* routing rule, so if it was targeted directly, we still want
# login:admin to apply.
- url: /_ah/push-handlers/.*
  script: auto
  secure: always
  login: admin

# Everything else goes here.
- url: /.*
  script: auto
  secure: always

entrypoint: >
  main
  -auth-service-host ${AUTH_SERVICE_HOST}
  -config-service-host ${CONFIG_SERVICE_HOST}
  -cron-authorized-caller ${CRON_AUTHORIZED_CALLER}
  -pubsub-authorized-caller ${PUBSUB_AUTHORIZED_CALLER}
  -spanner-database ${SPANNER_DB}
  -tq-default-target-host ${TQ_TARGET_HOST}
  -tq-push-as ${TQ_PUSH_AS}
  -tq-sweep-initiation-launcher ${CRON_AUTHORIZED_CALLER}
  -ts-mon-account ${TS_MON_ACCOUNT}