chore(run): add default configuration for both configuration files

related to CAM-11298

distro/run/assembly/resources/default.yml

@@ -1,11 +1,20 @@
+# Find more available configuration properties on the following pages of the documentaion.
+# https://docs.camunda.org/manual/latest/user-guide/camunda-bpm-run/#configure-camunda-bpm-run
+# https://docs.camunda.org/manual/latest/user-guide/spring-boot-integration/configuration/#camunda-engine-properties
+
 camunda.bpm:
   admin-user:
     id: demo
     password: demo
+  run:
+# https://docs.camunda.org/manual/latest/user-guide/camunda-bpm-run/#cross-origin-resource-sharing
+    cors:
+      enabled: true
+      allowed-origins: "*"
 
 # datasource configuration is required
 spring.datasource:
-  url: jdbc:h2:./camunda-h2-dbs/process-engine;TRACE_LEVEL_FILE=0;DB_CLOSE_ON_EXIT=FALSE
+  url: jdbc:h2:./camunda-h2-default/process-engine;TRACE_LEVEL_FILE=0;DB_CLOSE_ON_EXIT=FALSE
   driver-class-name: org.h2.Driver
   username: sa
   password: sa

distro/run/assembly/resources/production.yml

@@ -1,6 +1,61 @@
+# This configuration is intended for production use and was created with respect to the security guide.
+# The provided links to documentation guides for each property will give more information about the purpose of each property.
+# security guide: https://docs.camunda.org/manual/latest/user-guide/security/
+
+camunda.bpm:
+# https://docs.camunda.org/manual/latest/user-guide/security/#http-header-security-in-webapps
+# https://docs.camunda.org/manual/latest/webapps/shared-options/header-security/
+  webapp.csrf:
+    enable-same-site-cookie: true
+    same-site-cookie-option: STRICT
+
+# https://docs.camunda.org/manual/latest/user-guide/security/#authorization
+# https://docs.camunda.org/manual/latest/user-guide/process-engine/authorization-service/
+  authorization.enabled: true
+
+  generic-properties.properties:
+# https://docs.camunda.org/manual/latest/user-guide/security/#variable-values-from-untrusted-sources
+    deserializationTypeValidationEnabled: true
+    deserializationAllowedPackages:
+    deserializationAllowedClasses:
+# https://docs.camunda.org/manual/latest/user-guide/security/#password-policy
+# https://docs.camunda.org/manual/latest/user-guide/process-engine/password-policy/
+    enablePasswordPolicy: true
+
+  run:
+# https://docs.camunda.org/manual/latest/user-guide/security/#authentication
+# https://docs.camunda.org/manual/latest/user-guide/camunda-bpm-run/#authentication
+    auth.enabled: true
+
+server:
+# https://docs.camunda.org/manual/latest/user-guide/camunda-bpm-run/#https
+# do not use the provided certificate in production
+  ssl:
+    key-store: classpath:keystore.p12
+    key-store-password: camunda
+    key-store-type: pkcs12
+    key-alias: camunda
+    key-password: camunda
+  port: 8443
+
+# https://docs.camunda.org/manual/latest/user-guide/security/#http-header-security-in-webapps
+# https://docs.camunda.org/manual/latest/webapps/shared-options/header-security/
+  servlet.session.cookie:
+    secure: true
+    http-only: true
+
+# https://docs.camunda.org/manual/latest/user-guide/camunda-bpm-run/#logging
+# https://docs.camunda.org/manual/latest/user-guide/logging/#process-engine
+logging:
+   level.root: INFO
+   file: logs/camunda-bpm-run.log
+
 # datasource configuration is required
+# do not use the H2 databse in production
+# https://docs.camunda.org/manual/latest/user-guide/camunda-bpm-run/#connect-to-a-database
+# https://docs.camunda.org/manual/latest/user-guide/camunda-bpm-run/#database
 spring.datasource:
-  url: jdbc:h2:./camunda-h2-dbs/process-engine;TRACE_LEVEL_FILE=0;DB_CLOSE_ON_EXIT=FALSE
+  url: jdbc:h2:./camunda-h2-test-production/process-engine;TRACE_LEVEL_FILE=0;DB_CLOSE_ON_EXIT=FALSE
   driver-class-name: org.h2.Driver
   username: sa
   password: sa

distro/run/core/src/main/java/org/camunda/bpm/run/property/CamundaBpmRunAuthenticationProperties.java

@@ -25,7 +25,7 @@ public class CamundaBpmRunAuthenticationProperties {
   public static final String DEFAULT_AUTH = "basic";
   public static final List<String> AUTH_METHODS = Arrays.asList(DEFAULT_AUTH);
 
-  boolean enabled = true;
+  boolean enabled;
   String authentication = DEFAULT_AUTH;
 
   public boolean isEnabled() {