#Copyright (c)  WSO2 Inc. (http://www.wso2.org) All Rights Reserved.
#
# WSO2 Inc. licenses this file to you under the Apache License,
# Version 2.0 (the "License"); you may not use this file except
# in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

apiVersion: v1
kind: ConfigMap
metadata:
  name: mgw-conf-mustache
  namespace: wso2-system
data:
  mgwConf.gotmpl: |

    #Copyright (c)  WSO2 Inc. (http://www.wso2.org) All Rights Reserved.
    #
    # WSO2 Inc. licenses this file to you under the Apache License,
    # Version 2.0 (the "License"); you may not use this file except
    # in compliance with the License.
    # You may obtain a copy of the License at
    #
    # http://www.apache.org/licenses/LICENSE-2.0
    #
    # Unless required by applicable law or agreed to in writing,
    # software distributed under the License is distributed on an
    # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
    # KIND, either express or implied.  See the License for the
    # specific language governing permissions and limitations
    # under the License.

    # Transport listener Configurations
    [listenerConfig]
      # Microgateway exposed IP / Host
      host = "0.0.0.0"
      # HTTP port that is used to make APIs available to the outside.
      httpPort = {{httpPort}}
      # HTTPs port that is used to make APIs available to the outside and for endpoints(/token, /authorize, /revoke/, userinfo) of Key Manager.
      httpsPort = {{httpsPort}}
      # HTTP port for endpoints(/token, /authorize, /revoke/, userinfo) of Key Manager
      tokenListenerPort = 9096
      # Internal keystore
      keyStorePath = "{{keystorePath}}"
      keyStorePassword = "{{keystorePassword}}"
      # Truststore
      trustStorePath = "{{truststorePath}}"
      trustStorePassword = "{{truststorePassword}}"

    # API Authorization security for the gateway and the backend
    [authConfig]
      # Authorization header expected by the Microgateway. Can be overridden at API level using the extension
      authorizationHeader = "Authorization"
      # Remove authorization header from the backend request
      removeAuthHeaderFromOutMessage = true

    # API JWT Authorization security for backend
    [jwtConfig]
      # JWT header when forwarding the request to the backend
      header = "X-JWT-Assertion"

    # Key manager configurations
    [keyManager]
      # Connection URL of the Key Manager server
      serverUrl = "{{keymanagerServerurl}}"
      # The token endpoint context of the Key Manager server
      tokenContext = "oauth2"
      # timestamp skew in seconds which added when checking the token validity period
      timestampSkew = 5000
      # External Key Manager
      external = false
      # Basic security configurations
      [keymanager.security.basic]
        enabled = true
        username = "{{keymanagerUsername}}"
        password = "{{keymanagerPassword}}"
      # Oauth2 security configurations
      [keymanager.security.oauth2]
        enabled = false
        # Authentication credentials should be sent via (AUTH_HEADER_BEARER/POST_BODY_BEARER/NO_BEARER)?
        credentialBearer = "AUTH_HEADER_BEARER"
        # Token URL for the authorization endpoint
        tokenUrl = ""
        # Oauth2 security grants
        [keymanager.security.oauth2.clientCredential]
          enabled = false
          clientId = ""
          clientSecret = ""
          scopes = ""
        [keymanager.security.oauth2.password]
          enabled = false
          clientId = ""
          clientSecret = ""
          scopes = ""
          username = ""
          password = ""
        [keymanager.security.oauth2.directToken]
          enabled = false
          accessToken = ""
        [keymanager.security.oauth2.refresh]
          enabled = false
          refreshUrl = ""
          scopes = ""
          refreshToken = ""
          clientId = ""
          clientSecret = ""

    # JWT token authorization configurations. You can provide multiple JWT issuers
    [[jwtTokenConfig]]
      issuer = "{{issuer}}"
      audience = "{{audience}}"
      certificateAlias = "{{certificateAlias}}"
      # Validate subscribed APIs
      validateSubscription = false

    # JWT token revocation configurations
    [tokenRevocationConfig]
    # Real time revocation configurations
      [tokenRevocationConfig.realtime]
        enableRealtimeMessageRetrieval = {{enableRealtimeMessageRetrieval}}
        # The JMS Message Broker that identify messages related to revoked tokens
        jmsConnectionTopic = "tokenRevocation"
        # The message broker context factory
        jmsConnectioninitialContextFactory = "wso2mbInitialContextFactory"
        # The message broker connection URL
        jmsConnectionProviderUrl= "amqp://admin:admin@carbon/carbon?brokerlist='tcp://{{jmsConnectionProvider}}"
        # The username used to establish  the message broker connection
        jmsConnectionUsername = ""
        # The password used to establish  the message broker connection
        jmsConnectionPassword = ""
      # Persistent revocation configurations
      [tokenRevocationConfig.persistent]
        enablePersistentStorageRetrieval = false
        # Use etcd as the default persistent storage
        useDefault = true
        # The hostname of your persistent storage server (e.g.: <etcd-server-access-URL>/<service>/keys/jti/)
        hostname = "https://127.0.0.1:2379/v2/keys/jti/"
        # The username of your persistent storage server
        username = "root"
        # The password of your persistent storage server
        password = "root"

    # token cache configurations
    [caching]
      # Expiry time of the cache in seconds
      tokenCacheExpiryTime = 900000
      # The size of the cache in MB
      tokenCacheCapacity = 10000
      # The factor of the cache that will be cleared when the cache is full.
      tokenCacheEvictionFactor = 0.25

    # Analytics configurations
    [analytics]
      # Configurations for file upload analytics
      [analytics.fileUpload]
        enable = {{analyticsEnabled}}
        # Time interval in milliseconds for file uploading task
        uploadingTimeSpanInMillis = {{uploadingTimeSpanInMillis}}
        # Initial time delay in milliseconds for file upload analytics
        initialDelayInMillis = 5000
        # Endpoint configured to accept file upload analytics
        uploadingEndpoint = "https://{{hostname}}:{{port}}/analytics/v1.0/usage/upload-file"
        # File rotating period in milliseconds
        rotatingPeriod = {{rotatingPeriod}}
        # To enable file upload task
        taskUploadFiles = {{uploadFiles}}
        # Username used in analytics server
        username = "{{analyticsUsername}}"
        # Password used in in analytics server
        password = "{{analyticsPassword}}"
      [analytics.gRPCAnalytics]
        enable = false
        # APIM Analytics endpoint configured to accept gRPC analytics
        endpointURL = "https://localhost:9806"
        # Time interval in milliseconds for gRPC connection recovery task
        reconnectTimeInMillies = 6000

    # User configuration for Basic auth
    [b7a.users]
      [b7a.users.{{basicUsername}}]
          # password should be sha1 encrypted by default
          password = "{{basicPassword}}"

    # Request and response validation configurations
    [validationConfig]
      enableRequestValidation = {{enableRequestValidation}}
      enableResponseValidation = {{enableResponseValidation}}

    # Enable http2
    [http2]
      enable = true

    # HTTP client configuration
    [httpClients]
      # Hostname verification
      verifyHostname={{verifyHostname}}

    # Mutual SSL configuration
    [mutualSSLConfig]
      # SSL Protocol to be used
      protocolName = "TLS"
      # SSL/TLS protocols to be enabled
      protocolVersions = "TLSv1.2,TLSv1.1"
      # List of ciphers to be used
      ciphers="TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256,TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256  ,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_DSS_WITH_AES_128_GCM_SHA256  ,TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA,TLS_EMPTY_RENEGOTIATION_INFO_SCSV"
      # The type of client certificate verification. (e.g.: "require" or "optional")
      sslVerifyClient = "optional"

    # Throttling configurations
    [throttlingConfig]
      # Configurations related to node local throttling.
      [throttlingConfig.nodeLocal]
        # Core number of threads in the thread pool.
        processThreadPoolCoreSize = 200
        # Maximum number of threads in the thread pool.
        processThreadPoolMaximumSize = 1000
        # Keep alive time of the threads in seconds
        processThreadPoolKeepAliveTime = 200
        # Throttle data cleanup task frequency in seconds.
        cleanUpFrequency = 3600

      # Connect with the central traffic manager
      enabledGlobalTMEventPublishing = {{enabledGlobalTMEventPublishing}}
      # The message broker context factory
      jmsConnectioninitialContextFactory = "wso2mbInitialContextFactory"
      # The message broker connection URL
      jmsConnectionProviderUrl = "amqp://admin:admin@carbon/carbon?brokerlist='tcp://{{jmsConnectionProvider}}'"
      # The username used to establish  the message broker connection
      jmsConnectionUsername = ""
      # The password used to establish  the message broker connection
      jmsConnectionPassword = ""
      # The central traffic management solution URL
      throttleEndpointUrl = "https://{{throttleEndpoint}}/endpoints"
      # username:password to create the connection to the central traffic manager
      throttleEndpointbase64Header = "admin:admin"

    # ballerina logs
    [b7a.log]
      level="{{logLevel}}"