deployment.toml

# Copyright (c) 2024, WSO2 LLC. (https://www.wso2.com) All Rights Reserved.
#
# WSO2 LLC. licenses this file to you under the Apache License,
# Version 2.0 (the "License"); you may not use this file except
# in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied. See the License for the
# specific language governing permissions and limitations
# under the License.

[server]
hostname = {{ .Values.deployment.ingress.hostName | quote }}
node_ip = "$env{NODE_IP}"
base_path = "https://$ref{server.hostname}:${carbon.management.port}"
offset = {{ .Values.deploymentToml.server.offset | quote }}

[transport.https.properties]
proxyPort = 443
server = {{ .Values.deploymentToml.transport.https.properties.server | quote }}

[transport.https.sslHostConfig.properties]
protocols={{ .Values.deploymentToml.transport.https.sslHostConfig.properties.protocols | quote }}
ciphers={{ .Values.deploymentToml.transport.https.sslHostConfig.properties.ciphers | quote }}

[super_admin]
{{- if .Values.deployment.secretStore.enabled }}
username = "$secret{super_admin_username}"
password = "$secret{super_admin_password}"
{{- else }}
username = {{ .Values.deploymentToml.superAdmin.username | quote }}
password = {{ .Values.deploymentToml.superAdmin.password | quote }}
{{- end }}
create_admin_account = {{ .Values.deploymentToml.superAdmin.createAdminAccount }}

[user_store]
type = {{ .Values.deploymentToml.userStore.type | quote }}

[database.identity_db]
type = {{ .Values.deploymentToml.database.identity.type | quote }}
url = {{ .Values.deploymentToml.database.identity.url | quote }}
{{- if .Values.deployment.secretStore.enabled }}
username = "$secret{database_identity_username}"
password = "$secret{database_identity_password}"
{{- else }}
username = {{ .Values.deploymentToml.database.identity.username | quote }}
password = {{ .Values.deploymentToml.database.identity.password | quote }}
{{- end }}
driver = {{ .Values.deploymentToml.database.identity.driver | quote }}
{{- if .Values.deploymentToml.database.identity.poolOptions }}
[database.identity_db.pool_options]
{{- range $key, $value := .Values.deploymentToml.database.identity.poolOptions }}
{{ $key }} = {{ $value | quote }}
{{- end }}
{{- end }}

[database.shared_db]
type = {{ .Values.deploymentToml.database.shared.type | quote }}
url = {{ .Values.deploymentToml.database.shared.url | quote }}
{{- if .Values.deployment.secretStore.enabled }}
username = "$secret{database_shared_username}"
password = "$secret{database_shared_password}"
{{- else }}
username = {{ .Values.deploymentToml.database.shared.username | quote }}
password = {{ .Values.deploymentToml.database.shared.password | quote }}
{{- end }}
driver = {{ .Values.deploymentToml.database.shared.driver | quote }}
{{- if .Values.deploymentToml.database.shared.poolOptions }}
[database.shared_db.pool_options]
{{- range $key, $value := .Values.deploymentToml.database.shared.poolOptions }}
{{ $key }} = {{ $value | quote }}
{{- end }}
{{- end }}

[datasource.WSO2ConsentDS]
id="WSO2CONSENT_DB"
url = {{ .Values.deploymentToml.database.consent.url | quote }}
type = {{ .Values.deploymentToml.database.consent.type | quote }}
{{- if .Values.deployment.secretStore.enabled }}
username = "$secret{database_consent_username}"
password = "$secret{database_consent_password}"
{{- else }}
username = {{ .Values.deploymentToml.database.consent.username | quote }}
password = {{ .Values.deploymentToml.database.consent.password | quote }}
{{- end }}
driver = {{ .Values.deploymentToml.database.consent.driver | quote }}
jmx_enable=false
{{- if .Values.deploymentToml.database.consent.poolOptions }}
[datasource.WSO2ConsentDS.pool_options]
{{- range $key, $value := .Values.deploymentToml.database.consent.poolOptions }}
{{ $key }} = {{ $value | quote }}
{{- end }}
{{- end }}

[authentication.consent]
data_source="jdbc/WSO2CONSENT_DB"

[realm_manager]
data_source = "WSO2USER_DB"

[database.user]
type = {{ .Values.deploymentToml.database.user.type | quote }}
url = {{ .Values.deploymentToml.database.user.url | quote }}
{{- if .Values.deployment.secretStore.enabled }}
username = "$secret{database_user_username}"
password = "$secret{database_user_password}"
{{- else }}
username = {{ .Values.deploymentToml.database.user.username | quote }}
password = {{ .Values.deploymentToml.database.user.password | quote }}
{{- end }}
driver = {{ .Values.deploymentToml.database.user.driver | quote }}
{{- if .Values.deploymentToml.database.user.poolOptions }}
[database.user.pool_options]
{{- range $key, $value := .Values.deploymentToml.database.user.poolOptions }}
{{ $key }} = {{ $value | quote }}
{{- end }}
{{- end }}

[keystore.tls]
file_name =  {{ .Values.deploymentToml.keystore.tls.fileName | quote }}
type =  {{ .Values.deploymentToml.keystore.tls.type | quote }}
{{- if .Values.deployment.secretStore.enabled }}
password = "$secret{keystore_tls_password}"
{{- else }}
password = {{ .Values.deploymentToml.keystore.tls.password | quote }}
{{- end }}
alias = {{ .Values.deploymentToml.keystore.tls.alias | quote }}
{{- if .Values.deployment.secretStore.enabled }}
key_password = "$secret{keystore_tls_key_password}"
{{- else }}
key_password = {{ .Values.deploymentToml.keystore.tls.keyPassword | quote }}
{{- end }}

[keystore.primary]
file_name =  {{ .Values.deploymentToml.keystore.primary.fileName | quote }}
type =  {{ .Values.deploymentToml.keystore.primary.type | quote }}
{{- if .Values.deployment.secretStore.enabled }}
password = "$secret{keystore_primary_password}"
{{- else }}
password = {{ .Values.deploymentToml.keystore.primary.password | quote }}
{{- end }}
alias = {{ .Values.deploymentToml.keystore.primary.alias | quote }}
{{- if .Values.deployment.secretStore.enabled }}
key_password = "$secret{keystore_primary_key_password}"
{{- else }}
key_password = {{ .Values.deploymentToml.keystore.primary.keyPassword | quote }}
{{- end }}

[keystore.internal]
file_name =  {{ .Values.deploymentToml.keystore.internal.fileName | quote }}
type =  {{ .Values.deploymentToml.keystore.internal.type | quote }}
{{- if .Values.deployment.secretStore.enabled }}
password = "$secret{keystore_internal_password}"
{{- else }}
password = {{ .Values.deploymentToml.keystore.internal.password | quote }}
{{- end }}
alias = {{ .Values.deploymentToml.keystore.internal.alias | quote }}
{{- if .Values.deployment.secretStore.enabled }}
key_password = "$secret{keystore_internal_key_password}"
{{- else }}
key_password ={{ .Values.deploymentToml.keystore.internal.keyPassword | quote }}
{{- end }}

[truststore]
file_name =  {{ .Values.deploymentToml.truststore.fileName | quote }}
type =  {{ .Values.deploymentToml.truststore.type | quote }}
{{- if .Values.deployment.secretStore.enabled }}
password = "$secret{keystore_truststore_password}"
{{- else }}
password = {{ .Values.deploymentToml.truststore.password | quote }}
{{- end }}
[account_recovery.endpoint.auth]
hash= {{ .Values.deploymentToml.account.recovery.endpoint.auth.hash | quote }}

[identity.auth_framework.endpoint]
{{- if .Values.deployment.secretStore.enabled }}
app_password= "$secret{app_password}"
{{- else }}
app_password= {{ .Values.deploymentToml.identity.authFramework.endpoint.appPassword | quote }}
{{- end }}

{{- if .Values.deploymentToml.clustering.enabled }}
[clustering]
membership_scheme={{.Values.deploymentToml.clustering.membershipScheme | quote }}
domain= {{.Values.deploymentToml.clustering.domain | quote }}
local_member_port={{.Values.deploymentToml.clustering.localMemberPort | quote }}
properties.KUBERNETES_NAMESPACE={{ .Release.Namespace | quote }}
properties.KUBERNETES_SERVICES={{ include "..fullname" . | quote }}
{{- end }}

[oauth.token_cleanup]
enable = {{.Values.deploymentToml.oauth.tokenCleanup }}

[oauth.token_generation]
include_username_in_access_token = {{.Values.deploymentToml.oauth.tokenGeneration.includeUsernameInAccessToken }}

# Block all unused fileupload with super tenant permissions (SECURITYINTERNAL-1738)
[[resource.access_control]]
context="(.*)/fileupload/service(.*)"
secure=true
http_method = "all"
permissions = ["/permission/admin/manage/identity/applicationmgt/create"]

[[resource.access_control]]
context="(.*)/fileupload(.*)"
secure=true
http_method = "all"
permissions = ["/permission/protected/manage/monitor/tenants"]

{{- if .Values.deploymentToml.recaptcha.enabled }}
#Google reCAPTCHA settings.

[recaptcha]
enabled = true
api_url = {{ .Values.deploymentToml.recaptcha.apiUrl | quote }}
verify_url = {{ .Values.deploymentToml.recaptcha.verifyUrl | quote }}
{{- if .Values.deployment.secretStore.enabled }}
site_key = "$secret{recaptcha_site_key}"
secret_key = "$secret{recaptcha_secret_key}"
{{- else }}
site_key = {{ .Values.deploymentToml.recaptcha.siteKey | quote }}
secret_key = {{ .Values.deploymentToml.recaptcha.secretKey | quote }}
{{- end }}

{{- end }}

{{- if .Values.deploymentToml.outputAdapter.email.enabled }}
# SMTP email sender settings.
[output_adapter.email]
from_address= {{ .Values.deploymentToml.outputAdapter.email.fromAddress | quote }}
username= {{ .Values.deploymentToml.outputAdapter.email.username | quote }}
{{- if .Values.deployment.secretStore.enabled }}
password= "$secret{output_adapter_email_password}"
{{- else }}
password= {{ .Values.deploymentToml.outputAdapter.email.password | quote }}
{{- end }}
hostname= {{ .Values.deploymentToml.outputAdapter.email.hostname | quote }}
port= {{ .Values.deploymentToml.outputAdapter.email.port }}
enable_start_tls= {{ .Values.deploymentToml.outputAdapter.email.enableStartTls }}
enableAuthentication= {{ .Values.deploymentToml.outputAdapter.email.enableAuthentication }}
{{- end }}

# Configuring user account locking. Ref: https://is.docs.wso2.com/en/latest/guides/identity-lifecycles/lock-account/
{{- if .Values.deploymentToml.userAccountLock.enabled }}
[event.default_listener.identity_mgt]
priority= "50"
enable = false
[event.default_listener.governance_identity_mgt]
priority= "95"
enable = true

[identity_mgt.account_locking]
allowed_failed_attempts={{ .Values.deploymentToml.userAccountLock.loginAttempts.allowedFailedAttempts }}
auto_unlock_time_increment_ratio={{ .Values.deploymentToml.userAccountLock.loginAttempts.autoUnlockTimeIncrementRatio }}
auto_unlock_after={{ .Values.deploymentToml.userAccountLock.loginAttempts.autoUnlockAfter }}
enable_account_locking=true
{{- end }}

[authentication.authenticator.email_otp]
enable={{ .Values.deploymentToml.otp.email.enabled }}

[authentication.authenticator.email_otp.parameters]
EMAILOTPAuthenticationEndpointURL = {{ .Values.deploymentToml.otp.email.authenticationEndpointURL | quote }}
EmailOTPAuthenticationEndpointErrorPage = {{ .Values.deploymentToml.otp.email.authenticationEndpointErrorPage | quote }}
EmailAddressRequestPage = {{ .Values.deploymentToml.otp.email.addressRequestPage | quote }}
usecase = {{ .Values.deploymentToml.otp.email.usecase | quote }}
secondaryUserstore = {{ .Values.deploymentToml.otp.email.secondaryUserstore | quote }}
EMAILOTPMandatory = {{ .Values.deploymentToml.otp.email.mandatory }}
sendOTPToFederatedEmailAttribute = {{ .Values.deploymentToml.otp.email.sendOTPToFederatedEmailAttribute }}
federatedEmailAttributeKey = {{ .Values.deploymentToml.otp.email.federatedEmailAttributeKey | quote }}
EmailOTPEnableByUserClaim = {{ .Values.deploymentToml.otp.email.enableByUserClaim }}
CaptureAndUpdateEmailAddress = {{ .Values.deploymentToml.otp.email.captureAndUpdateEmailAddress }}
showEmailAddressInUI = {{ .Values.deploymentToml.otp.email.showEmailAddressInUI }}
useEventHandlerBasedEmailSender = {{ .Values.deploymentToml.otp.email.useEventHandlerBasedEmailSender }}
emailAddressRegex = {{ .Values.deploymentToml.otp.email.emailAddressRegex | squote }}
tokenExpirationTime = {{ .Values.deploymentToml.otp.email.tokenExpirationTime }}
EnableAccountLockingForFailedAttempts = {{ .Values.deploymentToml.otp.email.userAccountLockEnabled }}

[authentication.authenticator.sms_otp]
enable={{ .Values.deploymentToml.otp.sms.enabled }}

[authentication.authenticator.sms_otp.parameters]
SMSOTPAuthenticationEndpointURL= {{ .Values.deploymentToml.otp.sms.authenticationEndpointURL | quote }}
SMSOTPAuthenticationEndpointErrorPage= {{ .Values.deploymentToml.otp.sms.authenticationEndpointErrorPage | quote }}
MobileNumberRegPage = {{ .Values.deploymentToml.otp.sms.mobileNumberRegPage | quote }}
RetryEnable = {{ .Values.deploymentToml.otp.sms.retryEnable }}
ResendEnable = {{ .Values.deploymentToml.otp.sms.resendEnable }}
BackupCode = {{ .Values.deploymentToml.otp.sms.backupCode }}
SMSOTPEnableByUserClaim = {{ .Values.deploymentToml.otp.sms.enableByUserClaim }}
usecase = {{ .Values.deploymentToml.otp.sms.usecase | quote }}
secondaryUserstore = {{ .Values.deploymentToml.otp.sms.secondaryUserstore | quote }}
SMSOTPMandatory = {{ .Values.deploymentToml.otp.sms.mandatory }}
SendOtpToFederatedMobile = {{ .Values.deploymentToml.otp.sms.federatedMobile  }}
federatedMobileAttributeKey = {{ .Values.deploymentToml.otp.sms.federatedMobileAttributeKey | quote }}
CaptureAndUpdateMobileNumber = {{ .Values.deploymentToml.otp.sms.captureAndUpdateMobileNumber }}
SendOTPDirectlyToMobile = {{ .Values.deploymentToml.otp.sms.directlyToMobile }}
redirectToMultiOptionPageOnFailure = {{ .Values.deploymentToml.otp.sms.redirectToMultiOptionPageOnFailure }}
EnableAccountLockingForFailedAttempts = {{ .Values.deploymentToml.otp.sms.userAccountLockEnabled }}

[authentication.authenticator.totp]
enable={{ .Values.deploymentToml.totp.enabled }}

[authentication.authenticator.totp.parameters]
encodingMethod={{ .Values.deploymentToml.totp.encodingMethod | quote }}
timeStepSize={{ .Values.deploymentToml.totp.timeStepSize | quote }}
windowSize={{ .Values.deploymentToml.totp.windowSize | quote }}
authenticationMandatory={{ .Values.deploymentToml.totp.authenticationMandatory }}
enrolUserInAuthenticationFlow={{ .Values.deploymentToml.totp.enrolUserInAuthenticationFlow }}
usecase={{ .Values.deploymentToml.totp.usecase | quote }}
secondaryUserstore={{ .Values.deploymentToml.totp.secondaryUserstore | quote }}
TOTPAuthenticationEndpointURL={{ .Values.deploymentToml.totp.authenticationEndpointURL | quote }}
TOTPAuthenticationEndpointErrorPage={{ .Values.deploymentToml.totp.authenticationEndpointErrorPage | quote }}
TOTPAuthenticationEndpointEnableTOTPPage={{ .Values.deploymentToml.totp.authenticationEndpointEnableTOTPPage | quote }}
Issuer={{ .Values.deploymentToml.totp.issuer | quote }}
UseCommonIssuer={{ .Values.deploymentToml.totp.useCommonIssuer }}
EnableAccountLockingForFailedAttempts = {{ .Values.deploymentToml.totp.userAccountLockEnabled }}

{{- if .Values.deploymentToml.extraConfigs }}
{{ .Values.deploymentToml.extraConfigs }}
{{- end }}

[encryption]
{{- if .Values.deployment.secretStore.enabled }}
key= "$secret{symmetric_key}"
{{- else }}
key= {{ .Values.deploymentToml.encryption.key | quote }}
{{- end }}

{{- if .Values.deployment.secretStore.enabled }}
# Secure vault encryted secrets
[secrets]
# Super admin creds
super_admin_username = {{ .Values.deploymentToml.superAdmin.username | quote }}
super_admin_password = {{ .Values.deploymentToml.superAdmin.password | quote }}
# Database creds
database_identity_username = {{ .Values.deploymentToml.database.identity.username | quote }}
database_identity_password = {{ .Values.deploymentToml.database.identity.password | quote }}
database_shared_username = {{ .Values.deploymentToml.database.shared.username | quote }}
database_shared_password = {{ .Values.deploymentToml.database.shared.password | quote }}
database_user_username = {{ .Values.deploymentToml.database.user.username | quote }}
database_user_password = {{ .Values.deploymentToml.database.user.password | quote }}
database_consent_username = {{ .Values.deploymentToml.database.consent.username | quote }}
database_consent_password = {{ .Values.deploymentToml.database.consent.password | quote }}
# Keystores
keystore_tls_password = {{ .Values.deploymentToml.keystore.tls.password | quote }}
keystore_tls_key_password = {{ .Values.deploymentToml.keystore.tls.keyPassword | quote }}
keystore_primary_password = {{ .Values.deploymentToml.keystore.primary.password | quote }}
keystore_primary_key_password = {{ .Values.deploymentToml.keystore.primary.keyPassword | quote }}
keystore_internal_password = {{ .Values.deploymentToml.keystore.internal.password | quote }}
keystore_internal_key_password = {{ .Values.deploymentToml.keystore.internal.keyPassword | quote }}
# Truststore
keystore_truststore_password = {{ .Values.deploymentToml.truststore.password | quote }}
# App password
app_password = {{ .Values.deploymentToml.identity.authFramework.endpoint.appPassword | quote }}
# Symmetric key
symmetric_key = {{ .Values.deploymentToml.encryption.key | quote }}
{{- if .Values.deploymentToml.recaptcha.enabled }}
# Recaptcha creds
recaptcha_site_key = {{ .Values.deploymentToml.recaptcha.siteKey | quote }}
recaptcha_secret_key = {{ .Values.deploymentToml.recaptcha.secretKey | quote }}
{{- end }}

{{- if .Values.deploymentToml.outputAdapter.email.enabled }}
output_adapter_email_password = {{ .Values.deploymentToml.outputAdapter.email.password | quote }}
{{- end }}

{{- end }}