default.yaml

# Copyright (c) 2016, WSO2 Inc. (http://www.wso2.org) All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

---
classes:
  - wso2am

wso2::template_list:
  - repository/conf/datasources/am-datasources.xml
  - repository/conf/api-manager.xml
  - repository/conf/identity/identity.xml
  - repository/conf/identity/application-authentication.xml
  - repository/conf/identity/EndpointConfig.properties
#  - repository/conf/security/cipher-text.properties
#  - repository/conf/security/cipher-tool.properties
#  - bin/ciphertool.sh

wso2::service_name: wso2am
wso2::hostname: wso2am-default
wso2::mgt_hostname: wso2am-default

wso2::clustering:
  enabled: true
  domain: am.wso2.domain
  sub_domain: worker
  membership_scheme: kubernetes
  local_member_port: 4000
  kubernetes:
    kubernetes_namespace: default
    kubernetes_services: wso2am-default

# In Kubernetes proxy ports need to be configured to match with node ports.
# Following ports have been defined for servlet HTTP and HTTPS transports.
wso2::ports:
  proxyPort:
    http: 32003
    https: 32004

wso2::apim_keymanager:
  host: wso2am-default
# Gateway component calls Key-Manager component internally (via K8S service) for access token validation and token generation
# Therefore, admin service port should point to corresponding K8S service target port
  port: 9443
  username: "%{hiera('wso2::super_admin::username')}"
  password: "%{hiera('wso2::super_admin::password')}"

wso2::apim_gateway:
  host: wso2am-default
# Publisher component calls Gateway admin service internally (via K8S service) to create Synapse artifacts
# Therefore, admin service port should point to corresponding K8S service target port
  port: 9443
  api_endpoint_host: wso2am-default
# In single-JVM mode, API endpoint ports should point to corresponding K8S service NodePorts which is shown to the user in Store Jaggery app
# This is because users can only access the API via NodePort (K8S services are not accessible externally)
  api_endpoint_port: 32001
  secure_api_endpoint_port: 32002
# Store and Gateway components may call revoke API internally (via K8S service) to invalidate access tokens
# Therefore, API token revoke port should point to corresponding K8S service target port
  api_token_revoke_endpoint_port: 8280
  secure_api_token_revoke_endpoint_port: 8243
  username: "%{hiera('wso2::super_admin::username')}"
  password: "%{hiera('wso2::super_admin::password')}"

wso2::apim_store:
  host: wso2am-default
# This port is used to generate the Store app URL to which the browser is redirected when accessing the Store from Publisher
# Therefore, it should point to the corresponding K8S service NodePort
  port: 32004

wso2::apim_publisher:
  host: wso2am-default
# This port is used to generate the Publisher app URL. It should point to the corresponding K8S service NodePort since it is accessed externally
  port: 32004

wso2::registry_mounts:
  wso2_config_db:
    path: /_system/config
    target_path: /_system/config/apim
    read_only: false
    registry_root: /
    enable_cache: true

  wso2_gov_db:
    path: /_system/governance
    target_path: /_system/governance
    read_only: false
    registry_root: /
    enable_cache: true

wso2::usermgt_datasource: wso2_user_db
wso2::is_datasource: wso2_am_db
wso2::am_datasource: wso2_am_db

wso2::am_datasources:
  wso2_am_db:
    name: WSO2_AM_DB
    description: The datasource used for API Manager database
    driver_class_name: "%{hiera('wso2::datasources::mysql::driver_class_name')}"
    url: jdbc:mysql://mysql-apim-db:3306/APIM_DB?autoReconnect=true
    username: "%{hiera('wso2::datasources::mysql::username')}"
    password: "%{hiera('wso2::datasources::mysql::password')}"
    jndi_config: jdbc/WSO2AM_DB
    max_active: "%{hiera('wso2::datasources::common::max_active')}"
    max_wait: "%{hiera('wso2::datasources::common::max_wait')}"
    test_on_borrow: "%{hiera('wso2::datasources::common::test_on_borrow')}"
    default_auto_commit: "%{hiera('wso2::datasources::common::default_auto_commit')}"
    validation_query: "%{hiera('wso2::datasources::mysql::validation_query')}"
    validation_interval: "%{hiera('wso2::datasources::common::validation_interval')}"

wso2::master_datasources:
  wso2_config_db:
    name: WSO2_CONFIG_DB
    description: The datasource used for config registry
    driver_class_name: "%{hiera('wso2::datasources::mysql::driver_class_name')}"
    url: jdbc:mysql://mysql-apim-db:3306/APIM_DB?autoReconnect=true
    username: "%{hiera('wso2::datasources::mysql::username')}"
    password: "%{hiera('wso2::datasources::mysql::password')}"
    jndi_config: jdbc/WSO2_CONFIG_DB
    max_active: "%{hiera('wso2::datasources::common::max_active')}"
    max_wait: "%{hiera('wso2::datasources::common::max_wait')}"
    test_on_borrow: "%{hiera('wso2::datasources::common::test_on_borrow')}"
    validation_query: "%{hiera('wso2::datasources::mysql::validation_query')}"
    validation_interval: "%{hiera('wso2::datasources::common::validation_interval')}"

  wso2_gov_db:
    name: WSO2_GOV_DB
    description: The datasource used for gov registry
    driver_class_name: "%{hiera('wso2::datasources::mysql::driver_class_name')}"
    url: jdbc:mysql://mysql-govdb:3306/WSO2_GOV_DB?autoReconnect=true
    username: "%{hiera('wso2::datasources::mysql::username')}"
    password: "%{hiera('wso2::datasources::mysql::password')}"
    jndi_config: jdbc/WSO2_GOV_DB
    max_active: "%{hiera('wso2::datasources::common::max_active')}"
    max_wait: "%{hiera('wso2::datasources::common::max_wait')}"
    test_on_borrow: "%{hiera('wso2::datasources::common::test_on_borrow')}"
    validation_query: "%{hiera('wso2::datasources::mysql::validation_query')}"
    validation_interval: "%{hiera('wso2::datasources::common::validation_interval')}"

  wso2_user_db:
    name: WSO2_USER_DB
    description: The datasource is used for user mangement and userstore
    driver_class_name: "%{hiera('wso2::datasources::mysql::driver_class_name')}"
    url: jdbc:mysql://mysql-userdb:3306/WSO2_USER_DB?autoReconnect=true
    username: "%{hiera('wso2::datasources::mysql::username')}"
    password: "%{hiera('wso2::datasources::mysql::password')}"
    jndi_config: jdbc/WSO2_USER_DB
    max_active: "%{hiera('wso2::datasources::common::max_active')}"
    max_wait: "%{hiera('wso2::datasources::common::max_wait')}"
    test_on_borrow: "%{hiera('wso2::datasources::common::test_on_borrow')}"
    default_auto_commit: "%{hiera('wso2::datasources::common::default_auto_commit')}"
    validation_query: "%{hiera('wso2::datasources::mysql::validation_query')}"
    validation_interval: "%{hiera('wso2::datasources::common::validation_interval')}"

  jagh2:
    name: JAGH2
    description: The datasource used for by the Jaggery Storage Manager
    driver_class_name: "%{hiera('wso2::datasources::mysql::driver_class_name')}"
    url: jdbc:mysql://mysql-apim-db:3306/APIM_DB?autoReconnect=true
    username: "%{hiera('wso2::datasources::mysql::username')}"
    password: "%{hiera('wso2::datasources::mysql::password')}"
    jndi_config: jdbc/ES_STORAGE
    max_active: "%{hiera('wso2::datasources::common::max_active')}"
    max_wait: "%{hiera('wso2::datasources::common::max_wait')}"

# Secure vault configuration
#wso2::enable_secure_vault: true
#wso2::secure_vault_configs:
#  key_store_password:
#    secret_alias: Carbon.Security.KeyStore.Password
#    secret_alias_value: repository/conf/carbon.xml//Server/Security/KeyStore/Password,false
#    password: "%{hiera('wso2::key_stores::key_store::password')}"
#
#  key_store_key_password:
#    secret_alias: Carbon.Security.KeyStore.KeyPassword
#    secret_alias_value: repository/conf/carbon.xml//Server/Security/KeyStore/KeyPassword,false
#    password: "%{hiera('wso2::key_stores::key_store::key_password')}"
#
#  trust_store_password:
#    secret_alias: Carbon.Security.TrustStore.Password
#    secret_alias_value: repository/conf/carbon.xml//Server/Security/TrustStore/Password,false
#    password: "%{hiera('wso2::key_stores::trust_store::password')}"
#
#  user_manager_admin_password:
#    secret_alias: UserManager.AdminUser.Password
#    secret_alias_value: repository/conf/user-mgt.xml//UserManager/Realm/Configuration/AdminUser/Password,false
#    password: "%{hiera('wso2::super_admin::password')}"
#
#  wso2_carbon_db_password:
#    secret_alias: Datasources.WSO2_CARBON_DB.Configuration.Password
#    secret_alias_value: repository/conf/datasources/master-datasources.xml//datasources-configuration/datasources/datasource[name='WSO2_CARBON_DB']/definition[@type='RDBMS']/configuration/password,false
#    password: "%{hiera('wso2::datasources::common::password')}"
#
#  connector_key_store_password:
#    secret_alias: Server.Service.Connector.keystorePass
#    secret_alias_value: repository/conf/tomcat/catalina-server.xml//Server/Service/Connector[@keystorePass],true
#    password: "%{hiera('wso2::key_stores::connector_key_store::password')}"
#
#  registry_key_store_password:
#    secret_alias: Carbon.Security.RegistryKeyStore.Password
#    secret_alias_value: repository/conf/carbon.xml//Server/Security/RegistryKeyStore/Password,false
#    password: "%{hiera('wso2::key_stores::registry_key_store::password')}"
#
#  registry_key_store_key_password:
#    secret_alias: Carbon.Security.RegistryKeyStore.KeyPassword
#    secret_alias_value: repository/conf/carbon.xml//Server/Security/RegistryKeyStore/KeyPassword,false
#    password: "%{hiera('wso2::key_stores::registry_key_store::key_password')}"
#
#  wso2_am_db_password:
#    secret_alias: Datasource.WSO2_AM_DB.configuration.password
#    secret_alias_value: repository/conf/datasources/am-datasources.xml//datasources-configuration/datasources/datasource[name='WSO2_AM_DB']/definition[@type='RDBMS']/configuration/password,false
#    password: "%{hiera('wso2::datasources::mysql::password')}"
#
#  wso2_config_db_password:
#    secret_alias: Datasources.WSO2_CONFIG_DB.Configuration.Password
#    secret_alias_value: repository/conf/datasources/master-datasources.xml//datasources-configuration/datasources/datasource[name='WSO2_CONFIG_DB']/definition[@type='RDBMS']/configuration/password,false
#    password: "%{hiera('wso2::datasources::mysql::password')}"
#
#  wso2_gov_db_password:
#    secret_alias: Datasources.WSO2_GOV_DB.Configuration.Password
#    secret_alias_value: repository/conf/datasources/master-datasources.xml//datasources-configuration/datasources/datasource[name='WSO2_GOV_DB']/definition[@type='RDBMS']/configuration/password,false
#    password: "%{hiera('wso2::datasources::mysql::password')}"
#
#  wso2_user_db_password:
#    secret_alias: Datasources.WSO2_USER_DB.Configuration.Password
#    secret_alias_value: repository/conf/datasources/master-datasources.xml//datasources-configuration/datasources/datasource[name='WSO2_USER_DB']/definition[@type='RDBMS']/configuration/password,false
#    password: "%{hiera('wso2::datasources::mysql::password')}"
#
#  auth_manager_password:
#    secret_alias: AuthManager.Password
#    secret_alias_value: repository/conf/api-manager.xml//APIManager/AuthManager/Password,false
#    password: "%{hiera('wso2::super_admin::password')}"
#
#  api_gateway_password:
#    secret_alias: APIGateway.Password
#    secret_alias_value: repository/conf/api-manager.xml//APIManager/APIGateway/Environments/Environment/Password,false
#    password: "%{hiera('wso2::super_admin::password')}"
#
#  api_key_validator_password:
#    secret_alias: APIKeyValidator.Password
#    secret_alias_value: repository/conf/api-manager.xml//APIManager/APIKeyValidator/Password,false
#    password: "%{hiera('wso2::super_admin::password')}"
#
#  api_store_password:
#    secret_alias: APIStore.Password
#    secret_alias_value: repository/conf/api-manager.xml//APIManager/APIStore/Password,false
#    password: "%{hiera('wso2::super_admin::password')}"
#
#  xmpp_password:
#    secret_alias: MultifactorAuthentication.XMPPSettings.XMPPConfig.XMPPPassword
#    secret_alias_value: repository/conf/identity/identity.xml//MultifactorAuthentication/XMPPSettings/XMPPConfig/XMPPPassword,false
#    password: wso2carbon
#
#  axis2_https_listener_trust_store_password:
#    secret_alias: Axis2.Https.Listener.TrustStore.Password
#    secret_alias_value: repository/conf/axis2/axis2.xml//axisconfig/transportReceiver[@name='https']/parameter[@name='truststore']/TrustStore/Password,false
#    password: "%{hiera('wso2::key_stores::trust_store::password')}"
#
#  axis2_https_listener_key_store_password:
#    secret_alias: Axis2.Https.Listener.KeyStore.Password
#    secret_alias_value: repository/conf/axis2/axis2.xml//axisconfig/transportReceiver[@name='https']/parameter[@name='keystore']/KeyStore/Password,false
#    password: "%{hiera('wso2::key_stores::key_store::password')}"
#
#  axis2_https_listener_key_store_key_password:
#    secret_alias: Axis2.Https.Listener.KeyStore.KeyPassword
#    secret_alias_value: repository/conf/axis2/axis2.xml//axisconfig/transportReceiver[@name='https']/parameter[@name='keystore']/KeyStore/KeyPassword,false
#    password: "%{hiera('wso2::key_stores::key_store::key_password')}"
#
#  axis2_https_sender_trust_store_password:
#    secret_alias: Axis2.Https.Sender.TrustStore.Password
#    secret_alias_value: repository/conf/axis2/axis2.xml//axisconfig/transportSender[@name='https']/parameter[@name='truststore']/TrustStore/Password,false
#    password: "%{hiera('wso2::key_stores::trust_store::password')}"
#
#  axis2_https_sender_key_store_password:
#    secret_alias: Axis2.Https.Sender.KeyStore.Password
#    secret_alias_value: repository/conf/axis2/axis2.xml//axisconfig/transportSender[@name='https']/parameter[@name='keystore']/KeyStore/Password,false
#    password: "%{hiera('wso2::key_stores::key_store::password')}"
#
#  axis2_https_sender_key_store_key_password:
#    secret_alias: Axis2.Https.Sender.KeyStore.KeyPassword
#    secret_alias_value: repository/conf/axis2/axis2.xml//axisconfig/transportSender[@name='https']/parameter[@name='keystore']/KeyStore/KeyPassword,false
#    password: "%{hiera('wso2::key_stores::key_store::key_password')}"
#
#  authenticator_config_trust_store_password:
#    secret_alias: AuthenticatorConfig.TrustStore.Password
#    secret_alias_value: repository/conf/identity/application-authentication.xml//ApplicationAuthentication/AuthenticatorConfigs/AuthenticatorConfig[@name='OpenIDAuthenticator']/Parameter[@name='TrustStorePassword'],false
#    password: "%{hiera('wso2::key_stores::trust_store::password')}"
#
#  dep_sync_svn_password:
#    secret_alias: Carbon.DeploymentSynchronizer.SvnPassword
#    secret_alias_value: repository/conf/carbon.xml//Server/DeploymentSynchronizer/SvnPassword,true
#    password: password
#
#  thrift_based_entitlement_config_key_store_password:
#    secret_alias: EntitlementSettings.ThirftBasedEntitlementConfig.KeyStore.Password
#    secret_alias_value: repository/conf/identity/identity.xml//Server/EntitlementSettings/ThirftBasedEntitlementConfig/KeyStore/Password,false
#    password: "%{hiera('wso2::key_stores::key_store::password')}"

##Use below advanced secure vault configurations if they are used in corresponding files
#  wso2am_stats_db_password:
#    secret_alias: Datasource.WSO2AM_STATS_DB.configuration.password
#    secret_alias_value: repository/conf/datasources/master-datasources.xml//datasources-configuration/datasources/datasource[name='WSO2AM_STATS_DB']/definition[@type='RDBMS']/configuration/password,false
#    password: "%{hiera('wso2::datasources::mysql::password')}"
#
#  user_store_manager_connection_password:
#    secret_alias: UserStoreManager.Property.ConnectionPassword
#    secret_alias_value: repository/conf/user-mgt.xml//UserManager/Realm/UserStoreManager/Property[@name='ConnectionPassword'],flase
#    password: admin
#
#  user_store_manager_password:
#    secret_alias: UserStoreManager.Property.password
#    secret_alias_value: repository/conf/user-mgt.xml//UserManager/Realm/UserStoreManager/Property[@name='password'],true
#    password: admin
#
#  user_trusted_RPStore_password:
#    secret_alias: Security.UserTrustedRPStore.Password
#    secret_alias_value: repository/conf/identity/identity.xml//Server/Security/UserTrustedRPStore/Password,false
#    password: "%{hiera('wso2::key_stores::user_trusted_rp_store::password')}"
#
#  user_trusted_RPStore_key_password:
#    secret_alias: Security.UserTrustedRPStore.KeyPassword
#    secret_alias_value: repository/conf/identity/identity.xml//Server/Security/UserTrustedRPStore/KeyPassword,false
#    password: "%{hiera('wso2::key_stores::user_trusted_rp_store::key_password')}"
#
#  identity_system_store_pass:
#    secret_alias: Identity.System.StorePass
#    secret_alias_value: repository/conf/identity/identity.xml//Server/Identity/System/StorePass,false
#    password: wso2carbon