# Global Properties
quarkus.native.resources.includes=io/apicurio/registry/storage/impl/sql/h2.ddl,i18n/*.properties


## Additional index dependencies
quarkus.index-dependency.jaxrs.group-id=jakarta.ws.rs
quarkus.index-dependency.jaxrs.artifact-id=jakarta.ws.rs-api

## Name and description
registry.id=apicurio-registry
registry.name=Apicurio Registry (In Memory)
registry.description=High performance, runtime registry for schemas and API designs.
registry.version=${project.version}
registry.date=${timestamp}

## Legacy mode for ccompat API
registry.ccompat.legacy-id-mode.enabled=${ENABLE_CCOMPAT_LEGACY_ID_MODE:false}

## Make ccompat use canonical hash
registry.ccompat.use-canonical-hash=${ENABLE_CCOMPAT_CANONICAL_HASH_MODE:false}

##Auth - disabled by default

## Support some legacy ENV variables.
registry-legacy.auth.enabled=${AUTH_ENABLED:false}
registry-legacy.auth.anonymous-read-access.enabled=${ANONYMOUS_READ_ACCESS_ENABLED:false}
registry-legacy.auth.owner-only-authorization=${OWNER_ONLY_AUTHZ_ENABLED:false}
registry-legacy.auth.role-based-authorization=${ROLE_BASED_AUTHZ_ENABLED:false}
registry-legacy.auth.role-source=${ROLE_BASED_AUTHZ_SOURCE:token}

registry.keycloak.url=${KEYCLOAK_URL:http://localhost:8090/auth}
registry.keycloak.realm=${KEYCLOAK_REALM:apicurio-local}

registry.auth.url.configured=${registry.keycloak.url}/realms/${registry.keycloak.realm}
registry.auth.token.endpoint=${TOKEN_ENDPOINT:${registry.keycloak.url}/realms/${registry.keycloak.realm}/protocol/openid-connect/token}
registry.auth.client-secret=${KEYCLOAK_API_CLIENT_SECRET:}

## Consistent naming of auth related ENV vars.
registry.auth.enabled=${REGISTRY_AUTH_ENABLED:${registry-legacy.auth.enabled}}
registry.auth.basic-auth-client-credentials.enabled=${CLIENT_CREDENTIALS_BASIC_AUTH_ENABLED:false}
registry.auth.basic-auth-client-credentials.cache-expiration=${CLIENT_CREDENTIALS_BASIC_CACHE_EXPIRATION:10}
registry.auth.role-based-authorization=${REGISTRY_AUTH_RBAC_ENABLED:${registry-legacy.auth.role-based-authorization}}
registry.auth.owner-only-authorization=${REGISTRY_AUTH_OBAC_ENABLED:${registry-legacy.auth.owner-only-authorization}}
registry.auth.owner-only-authorization.limit-group-access=${REGISTRY_AUTH_OBAC_LIMIT_GROUP_ACCESS:false}
registry.auth.anonymous-read-access.enabled=${REGISTRY_AUTH_ANONYMOUS_READS_ENABLED:${registry-legacy.auth.anonymous-read-access.enabled}}
registry.auth.authenticated-read-access.enabled=${REGISTRY_AUTH_AUTHENTICATED_READS_ENABLED:false}
registry.auth.roles.readonly=${REGISTRY_AUTH_ROLES_READONLY:sr-readonly}
registry.auth.roles.developer=${REGISTRY_AUTH_ROLES_DEVELOPER:sr-developer}
registry.auth.roles.admin=${REGISTRY_AUTH_ROLES_ADMIN:sr-admin}
registry.auth.role-source=${REGISTRY_AUTH_ROLE_SOURCE:${registry-legacy.auth.role-source}}
registry.auth.tenant-owner-is-admin.enabled=${REGISTRY_AUTH_TENANT_OWNER_IS_ADMIN:true}
registry.auth.role-source.header.name=X-Registry-Role


quarkus.oidc.enabled=true
quarkus.oidc.tenant-enabled=${registry.auth.enabled}
quarkus.oidc.auth-server-url=${REGISTRY_AUTH_URL_CONFIGURED:${registry.keycloak.url}/realms/${registry.keycloak.realm}
quarkus.oidc.client-id=${KEYCLOAK_API_CLIENT_ID:registry-api}

# Admin override indicates whether the existence of a role somewhere
# other than the primary role source can override the 'isAdmin' logic.  This
# is useful when using role-source=application to bypass the DB check when the
# user has some existing role or other claim in their token.
registry.auth.admin-override.enabled=${REGISTRY_AUTH_ADMIN_OVERRIDE_ENABLED:false}
registry.auth.admin-override.from=${REGISTRY_AUTH_ADMIN_OVERRIDE_FROM:token}
registry.auth.admin-override.type=${REGISTRY_AUTH_ADMIN_OVERRIDE_TYPE:role}
registry.auth.admin-override.role=${REGISTRY_AUTH_ADMIN_OVERRIDE_ROLE:sr-admin}
registry.auth.admin-override.claim=${REGISTRY_AUTH_ADMIN_OVERRIDE_CLAIM:org-admin}
registry.auth.admin-override.claim-value=${REGISTRY_AUTH_ADMIN_OVERRIDE_CLAIM_VALUE:true}

registry.ui.config.auth.type=${REGISTRY_UI_AUTH_TYPE:none}

registry.ui.config.auth.keycloak.url=${registry.keycloak.url}
registry.ui.config.auth.keycloak.realm=${registry.keycloak.realm}
registry.ui.config.auth.keycloak.clientId=${KEYCLOAK_UI_CLIENT_ID:apicurio-registry}
registry.ui.config.auth.keycloak.onLoad=login-required

registry.ui.config.auth.oidc.url=${REGISTRY_AUTH_URL_CONFIGURED:http://localhost:8090}
registry.ui.config.auth.oidc.client-id=${REGISTRY_OIDC_UI_CLIENT_ID:default_client}
registry.ui.config.auth.oidc.redirect-url=${REGISTRY_OIDC_UI_REDIRECT_URL:http://localhost:8080}
registry.ui.config.auth.oidc.scope=${REGISTRY_OIDC_UI_SCOPE:openid email profile}


quarkus.http.non-application-root-path=/

## Logging
quarkus.log.console.format=%d{YYYY-MM-dd HH:mm:ss} %p <%X{tenantId}> [%C] (%t) %m%n
quarkus.log.console.color=false
quarkus.log.min-level=TRACE
quarkus.log.category."io.quarkus.oidc.runtime.OidcProvider".level=DEBUG

## Max HTTP request body size (large files needed to support Import functionality)
## (Set to 50MB)
quarkus.http.limits.max-body-size=52428800

## Config properties
registry.config.refresh.every=1m
registry.config.cache.enabled=true

## Dynamic config properties
registry.config.dynamic.allow-all=${REGISTRY_ALLOW_DYNAMIC_CONFIG:true}
registry.auth.owner-only-authorization.dynamic.allow=${registry.config.dynamic.allow-all}
registry.auth.owner-only-authorization.limit-group-access.dynamic.allow=${registry.config.dynamic.allow-all}
registry.auth.anonymous-read-access.enabled.dynamic.allow=${registry.config.dynamic.allow-all}
registry.ccompat.legacy-id-mode.enabled.dynamic.allow=${registry.config.dynamic.allow-all}
registry.download.href.ttl.dynamic.allow=${registry.config.dynamic.allow-all}
registry.ui.features.readOnly.dynamic.allow=${registry.config.dynamic.allow-all}
registry.rest.artifact.deletion.enabled.dynamic.allow=${registry.config.dynamic.allow-all}

# Access logs
quarkus.http.access-log.enabled=${ENABLE_ACCESS_LOG:false}
quarkus.http.access-log.pattern="apicurio-registry.access method="%{METHOD}" path="%{REQUEST_URL}" response_code="%{RESPONSE_CODE}" response_time="%{RESPONSE_TIME}" remote_ip="%{REMOTE_IP}" remote_user="%{REMOTE_USER}" user_agent="%{i,User-Agent}""
#this property will be used by Quarkus 2.X
quarkus.http.access-log.exclude-pattern=/health/.*

# Sentry - the rest of the sentry configuration is picked from sentry own env vars
registry.enable.sentry=${ENABLE_SENTRY:false}

## UI location override
registry.ui.root=/ui/
registry.ui.config.uiContextPath=${registry.ui.root}

# Redirects
registry.enable-redirects=${REGISTRY_ENABLE_REDIRECTS:true}
registry.redirects.root=/,${REGISTRY_ROOT_REDIRECT:${registry.ui.root}}
#registry.redirects.ui=/ui,${REGISTRY_UI_REDIRECT:/ui/}

# Override the hostname used for generating externally-accessible URLs.
# The host and port overrides are useful when deploying Registry with HTTPS passthrough Ingress or Route.
# In cases like these, the request URL (and port) that is then re-used for redirection
# does not belong to actual external URL used by the client, because the request is proxied.
# The redirection then fails because the target URL is not reachable.
registry.url.override.host=${REGISTRY_URL_OVERRIDE_HOST}
# Override the port used for generating externally-accessible URLs.
registry.url.override.port=${REGISTRY_URL_OVERRIDE_PORT}

quarkus.http.proxy.proxy-address-forwarding=${REGISTRY_PROXY_ADDRESS_FORWARDING:false}

## UI Features
registry.ui.features.readOnly=${REGISTRY_UI_FEATURES_READONLY:false}
registry.ui.features.settings=true

## Disable IBM API by default
registry.disable.apis=/apis/ibmcompat/.*

## Include or exclude the stack trace in REST API error responses.
registry.api.errors.include-stack-in-response=${REGISTRY_API_ERRORS_INCLUDE_STACKTRACE:false}

## Enable CORS always
quarkus.http.cors=true
quarkus.http.cors.origins=${CORS_ALLOWED_ORIGINS:http://localhost:8080}
quarkus.http.cors.methods=${CORS_ALLOWED_METHODS:GET,PUT,POST,PATCH,DELETE,OPTIONS}
quarkus.http.cors.headers=${CORS_ALLOWED_HEADERS:x-registry-name,x-registry-name-encoded,x-registry-description,x-registry-description-encoded,x-registry-version,x-registry-artifactid,x-registry-artifacttype,x-registry-hash-algorithm,x-registry-content-hash,access-control-request-method,access-control-allow-credentials,access-control-allow-origin,access-control-allow-headers,authorization,content-type}

## Disable Quarkus proactive authentication
quarkus.http.auth.proactive=false

## Disable OpenAPI class scanning
mp.openapi.scan.disable=true
mp.openapi.servers=/api

registry.organization-id.claim-name=${ORGANIZATION_ID_CLAIM:rh-org-id,org_id}

# Multitenancy

registry.enable.multitenancy=false
registry.enable.multitenancy.standalone=false
registry.multitenancy.authorization.enabled=true
registry.multitenancy.types.context-path.enabled=true
registry.multitenancy.types.subdomain.enabled=false
registry.multitenancy.types.request-header.enabled=true
registry.multitenancy.types.context-path.base-path=t
registry.multitenancy.types.subdomain.location=header
registry.multitenancy.types.subdomain.header-name=Host
registry.multitenancy.types.subdomain.pattern=(\w[\w\d\-]*)\.localhost\.local
registry.multitenancy.types.request-header.name=X-Tenant-Id
registry.multitenancy.reaper.period-seconds=10800
registry.tenant.manager.ssl.ca.path=

## Tenant Manager
registry.tenant.manager.url=${TENANT_MANAGER_URL:http://localhost:8585}
registry.tenant.manager.auth.enabled=${TENANT_MANAGER_AUTH_ENABLED:${registry.auth.enabled}}
registry.tenant.manager.auth.realm=${TENANT_MANAGER_REALM:registry}
registry.tenant.manager.auth.url=${TENANT_MANAGER_AUTH_URL:http://localhost:8090/auth}
registry.tenant.manager.auth.url.configured=${TENANT_MANAGER_TOKEN_ENDPOINT:${registry.tenant.manager.auth.url}/realms/${registry.tenant.manager.auth.realm}/protocol/openid-connect/token}

registry.tenant.manager.auth.client-id=${TENANT_MANAGER_CLIENT_ID:registry-api}
registry.tenant.manager.auth.client-secret=${TENANT_MANAGER_CLIENT_SECRET:default_secret}
registry.tenant.manager.auth.token.expiration.reduction.ms=${TENANT_MANAGER_AUTH_TOKEN_EXP_REDUCTION_MS:}

registry.storage.metrics.cache.check-period=30000
registry.limits.config.cache.check-period=30000
registry.tenants.context.cache.max-size=${REGISTRY_TENANTS_CONTEXT_CACHE_MAX_SIZE:1000}
registry.storage.metrics.cache.max-size=${REGISTRY_STORAGE_METRICS_CACHE_MAX_SIZE:1000}
registry.tenants.context.cache.check-period=60000


registry.downloads.reaper.every=60s

quarkus.native.additional-build-args=--initialize-at-run-time=org.apache.kafka.common.security.authenticator.SaslClientAuthenticator,\
  --allow-incomplete-classpath

# Artifact download
registry.rest.artifact.download.maxSize=1000000
registry.rest.artifact.download.skipSSLValidation=false

# Artifact version deletion
registry.rest.artifact.deletion.enabled=false


# Api date format
registry.apis.v2.date-format=yyyy-MM-dd'T'HH:mm:ssZ
registry.apis.v2.date-format-timezone=UTC

# Common components properties
app.name=${registry.id}
app.description=${registry.description}
app.version=${registry.version}
app.date=${registry.date}

app.authn.enabled=${registry.auth.enabled}
app.authn.basic-auth-client-credentials.enabled=${registry.auth.basic-auth-client-credentials.enabled}
app.authn.basic-auth-client-credentials.cache-expiration=${registry.auth.basic-auth-client-credentials.cache-expiration}
app.authn.basic-auth.scope=${registry.auth.basic-auth.scope}
app.authn.audit.log.prefix=registry.audit
app.authn.token.endpoint=${registry.auth.token.endpoint}
app.authn.client-secret=${registry.auth.client-secret}
app.authn.client-id=${quarkus.oidc.client-id}

app.enable.sentry=${registry.enable.sentry}
app.authn.basic-auth-client-credentials.enabled.dynamic.allow=${registry.config.dynamic.allow-all}

app.enable.multitenancy=${registry.enable.multitenancy}
app.enable.multitenancy.standalone=${registry.enable.multitenancy.standalone}
app.multitenancy.authorization.enabled=${registry.multitenancy.authorization.enabled}
app.multitenancy.types.context-path.enabled=${registry.multitenancy.types.context-path.enabled}
app.multitenancy.types.subdomain.enabled=${registry.multitenancy.types.subdomain.enabled}
app.multitenancy.types.request-header.enabled=${registry.multitenancy.types.request-header.enabled}
app.multitenancy.types.context-path.base-path=${registry.multitenancy.types.context-path.base-path}
app.multitenancy.types.subdomain.location=${registry.multitenancy.types.subdomain.location}
app.multitenancy.types.subdomain.header-name=${registry.multitenancy.types.subdomain.header-name}
app.multitenancy.types.subdomain.pattern=${registry.multitenancy.types.subdomain.pattern}
app.multitenancy.types.request-header.name=${registry.multitenancy.types.request-header.name}
app.multitenancy.reaper.period-seconds=${registry.multitenancy.reaper.period-seconds}
app.multitenancy.tenant.token-claim.names=${registry.organization-id.claim-name}

app.tenant.manager.url=${registry.tenant.manager.url}
app.tenant.manager.auth.enabled=${registry.tenant.manager.auth.enabled}
app.tenant.manager.auth.url.configured=${registry.tenant.manager.auth.url.configured}
app.tenant.manager.auth.client-id=${registry.tenant.manager.auth.client-id}
app.tenant.manager.auth.client-secret=${registry.tenant.manager.auth.client-secret}
app.tenant.manager.auth.token.expiration.reduction.ms=${registry.tenant.manager.auth.token.expiration.reduction.ms}
app.tenant.manager.ssl.ca.path=${registry.tenant.manager.ssl.ca.path}
app.tenants.context.cache.max-size=${registry.tenants.context.cache.max-size}
app.tenants.context.cache.check-period=${registry.tenants.context.cache.check-period}
