# --------------------------------------------------------------------
# Copyright (c) 2020, WSO2 Inc. (http://wso2.com) All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# -----------------------------------------------------------------------

# Config map containing config.toml file for adapter

apiVersion: v1
kind: ConfigMap
metadata:
  name: config-toml
data:
  config.toml: |
    # The configuration file for mgw
    [adapter] # --------------------------------------------------------

    # server: configuration related to REST API
    [adapter.server]
      enabled = true
      host = "0.0.0.0"
      port = "9843"
      tokenTTL = "1h"
      tokenPrivateKeyPath = "/home/wso2/security/keystore/mg.key"
      [[adapter.server.users]]
        username = "admin"
        password = "$env{adapter_admin_pwd}"

    # default vhosts mapping for standalone mode
    [[adapter.vhostMapping]]
      environment = "Default"
      vhost = "gw.wso2.com"

    [adapter.keystore]
      certPath = "/home/wso2/security/keystore/mg.pem"
      keyPath = "/home/wso2/security/keystore/mg.key"

    [adapter.truststore]
      location = "/home/wso2/security/truststore"

    [adapter.consul]
      enable = false
      url = "https://169.254.1.1:8501" # scheme + host ip + port
      pollInterval = 5 # seconds
      aclToken = "d3a2a719-4221-8c65-5212-58d4727427ac"
      mgwServiceName = "wso2"
      serviceMeshEnabled = false
      # certs for tls
      caCertFile = "/home/wso2/security/truststore/consul/consul-agent-ca.pem"
      certFile = "/home/wso2/security/truststore/consul/local-dc-client-consul-0.pem"
      keyFile = "/home/wso2/security/truststore/consul/local-dc-client-consul-0-key.pem"


    [router] # --------------------------------------------------------
      listenerHost = "0.0.0.0"
      listenerPort = 9090
      securedListenerHost = "0.0.0.0"
      securedListenerPort = 9095
      clusterTimeoutInSeconds = 20
      enforcerResponseTimeoutInSeconds = 20
      # system hostname for system API resources (eg: /testkey and /health)
      systemHost = "gw.wso2.com"

    [router.keystore]
      certPath = "/home/wso2/security/keystore/mg.pem"
      keyPath = "/home/wso2/security/keystore/mg.key"

    [router.cors]
    enabled = true
    allowOrigins = ["*"]
    allowMethods = ["GET","PUT","POST","DELETE","PATCH","OPTIONS"]
    allowHeaders = ["authorization","Access-Control-Allow-Origin","Content-Type","SOAPAction","apikey", "testKey", "Internal-Key"]
    exposeHeaders = []
    allowCredentials = false

    [router.upstream]
    [router.upstream.tls]
      minimumProtocolVersion = "TLS1_1"
      maximumProtocolVersion = "TLS1_2"
      ciphers = "ECDHE-ECDSA-AES128-GCM-SHA256, ECDHE-RSA-AES128-GCM-SHA256, ECDHE-ECDSA-AES128-SHA, ECDHE-RSA-AES128-SHA, AES128-GCM-SHA256, AES128-SHA, ECDHE-ECDSA-AES256-GCM-SHA384, ECDHE-RSA-AES256-GCM-SHA384, ECDHE-ECDSA-AES256-SHA, ECDHE-RSA-AES256-SHA, AES256-GCM-SHA384, AES256-SHA"
      # the default endpoint certificates
      trustedCertPath = "/etc/ssl/certs/ca-certificates.crt"
      verifyHostName = true
      disableSslVerification = false

    [enforcer] # --------------------------------------------------------

    [enforcer.authService]
      port = 8081
      maxMessageSize = 1000000000
      maxHeaderLimit = 8192
      #keep alive time of the external authz connection
      keepAliveTime = 600
      [enforcer.authService.threadPool]
        coreSize = 400
        maxSize = 500
        #keep alive time of threads in seconds
        keepAliveTime = 600
        queueSize = 1000

    [enforcer.apimCredentials]
      username="admin"
      password="$env{apim_admin_pwd}"

    [enforcer.cache]
      enabled = true
      maximumSize = 10000
      expiryTime = 15

    [enforcer.jwtGenerator]
      enable = false
      encoding = "base64" # base64,base64url
      claimDialect = "http://wso2.org/claims"
      convertDialect = false
      header = "X-JWT-Assertion"
      signingAlgorithm = "SHA256withRSA"
      enableUserClaims = false
      gatewayGeneratorImpl = "org.wso2.carbon.apimgt.common.gateway.jwtgenerator.APIMgtGatewayJWTGeneratorImpl"
      claimsExtractorImpl = "org.wso2.carbon.apimgt.impl.token.ExtendedDefaultClaimsRetriever"
      publicCertificatePath = "/home/wso2/security/truststore/mg.pem"
      privateKeyPath = "/home/wso2/security/keystore/mg.key"

    [enforcer.jwtIssuer]
      enabled = true
      issuer = "https://gw.wso2.com/testkey"
      encoding = "base64" # base64,base64url
      claimDialect = ""
      signingAlgorithm = "SHA256withRSA"
      publicCertificatePath = "/home/wso2/security/truststore/mg.pem"
      privateKeyPath = "/home/wso2/security/keystore/mg.key"
      validityPeriod = 3600 # seconds
      [[enforcer.jwtIssuer.jwtUser]]
        username = "admin"
        password = "$env{enforcer_admin_pwd}"

    # Throttling configurations
    [enforcer.throttling]
      # Connect with the central traffic manager
      enableGlobalEventPublishing = true
      # Enable global advanced throttling based on request header conditions
      enableHeaderConditions = false
      # Enable global advanced throttling based on request query parameter conditions
      enableQueryParamConditions = false
      # Enable global advanced throttling based on jwt claim conditions
      enableJwtClaimConditions = false
      # The message broker context factory
      jmsConnectionInitialContextFactory = "org.wso2.andes.jndi.PropertiesFileInitialContextFactory"
      # The message broker connection URL
      jmsConnectionProviderUrl = "amqp://admin:admin@carbon/carbon?brokerlist='tcp://wso2apim:5672'"
      # Throttling configurations related to event publishing using a binary connection
      [enforcer.throttling.publisher]
        # Credentials required to establish connection between Traffic Manager
        username = "admin"
        password = "$env{tm_admin_pwd}"
        # Receiver URL and the authentication URL of the Traffic manager node/nodes
        [[enforcer.throttling.publisher.urlGroup]]
          receiverURLs = ["tcp://wso2apim:9611"]
          authURLs = ["ssl://wso2apim:9711"]
        # Data publisher object pool configurations
        [enforcer.throttling.publisher.pool]
          maxIdleDataPublishingAgents = 1000
          initIdleObjectDataPublishingAgents = 200
          # Data publisher thread pool configurations
          publisherThreadPoolCoreSize = 200
          publisherThreadPoolMaximumSize = 1000
          publisherThreadPoolKeepAliveTime = 200
        [enforcer.throttling.publisher.agent]
          # SSL Protocols
          sslEnabledProtocols = "TLSv1.2"
          # ciphers
          ciphers="TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256,TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256  ,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_DSS_WITH_AES_128_GCM_SHA256  ,TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA,TLS_EMPTY_RENEGOTIATION_INFO_SCSV"
          # The size of the queue event disruptor which handles events before they are published.
          # The value specified should always be the result of an exponent with 2 as the base.
          queueSize = 32768
          # The maximum number of events in a batch sent to the queue event disruptor at a given time
          batchSize = 200
          # The number of threads that will be reserved to handle events at the time you start
          corePoolSize = 1
          # Socket timeout
          socketTimeoutMS = 30000
          # The maximum number of threads that should be reserved at any given time to handle events
          maxPoolSize = 1
          # The amount of time which threads in excess of the core pool size may remain idle before being terminated.
          keepAliveTimeInPool = 20
          # The time interval between reconnection
          reconnectionInterval = 30
          # TCP connection pool configurations (for data publishing)
          maxTransportPoolSize = 250
          maxIdleConnections = 250
          evictionTimePeriod = 5500
          minIdleTimeInPool = 5000
          # SSL connection pool configurations (for authentication)
          secureMaxTransportPoolSize = 250
          secureMaxIdleConnections = 250
          secureEvictionTimePeriod = 5500
          secureMinIdleTimeInPool = 5000

    [enforcer.security]

    [enforcer.security.authHeader]
    enableOutboundAuthHeader = false
    authorizationHeader = "authorization"

    # JWT token authorization configurations. You can provide multiple JWT issuers
    # Issuer 1
    [[enforcer.security.tokenService]]
      name="Resident Key Manager"
      issuer = "https://apim.wso2.com/oauth2/token"
      certificateAlias = "wso2carbon"
      # URL of the JWKs endpoint
      jwksURL = ""
      # Validate subscribed APIs
      validateSubscription = false
      # The claim in which the consumer key of the application is coming
      consumerKeyClaim = "azp"
      # Certificate Filepath within enforcer
      certificateFilePath = "/home/wso2/security/truststore/wso2carbon.pem"

    # Issuer 2
    [[enforcer.security.tokenService]]
        name="MGW"
        issuer = "https://gw.wso2.com/testkey"
        certificateAlias = "mgw"
        # URL of the JWKs endpoint
        jwksURL = ""
        # Validate subscribed APIs
        validateSubscription = false
        # The claim in which the consumer key of the application is coming
        consumerKeyClaim = ""
        # Certificate Filepath within enforcer
        certificateFilePath = "/home/wso2/security/truststore/mg.pem"

    # Issuer 3
    [[enforcer.security.tokenService]]
        name="APIM Publisher"
        issuer = "https://apim.wso2.com/publisher"
        certificateAlias = ""
        certificateFilePath = "/home/wso2/security/truststore/wso2carbon.pem"

    [analytics]
      enabled = false
      [analytics.adapter]
        bufferFlushInterval = "1s"
        bufferSizeBytes = 16384
        gRPCRequestTimeout = "20s"

      [analytics.enforcer]
        [analytics.enforcer.configProperties]
          authURL = "$env{analytics_authURL}"
          authToken = "$env{analytics_authToken}"

        [analytics.enforcer.LogReceiver]
          port = 18090
          maxMessageSize = 1000000000
          maxHeaderLimit = 8192
          #keep alive time of the external authz connection
          keepAliveTime = 600

          [analytics.enforcer.LogReceiver.threadPool]
            coreSize = 10
            maxSize = 100
            #keep alive time of threads in seconds
            keepAliveTime = 600
            queueSize = 1000

    [controlPlane]
      enabled = true
      serviceUrl = "https://wso2apim:9443/"
      username="admin"
      password="$env{cp_admin_pwd}"
      environmentLabels = ["Default"]
      retryInterval = 5
      skipSSLVerification=true
      # Message broker connection URL of the control plane
      [controlPlane.jmsConnectionParameters]
        eventListeningEndpoints = ["amqp://admin:$env{cp_admin_pwd}@wso2apim:5672?retries='10'&connectdelay='30'"]
