ivy.yaml

[engineDir]/configuration/reference/ivy.yaml

# yaml-language-server: $schema=https://json-schema.axonivy.com/ivy/12.0.12/ivy.json
#
# -------------------------------------------
# Axon Ivy Engine Configuration
# -------------------------------------------
# 
# This file shows configurations of the Axon Ivy Engine and its external systems.
# https://developer.axonivy.com/doc/12.0/engine-guide/configuration/
#
# Copy contents of this reference file to 'configuration/ivy.yaml' before adjusting
# them to your needs.
# https://developer.axonivy.com/doc/12.0/engine-guide/configuration/files/ivy-yaml.html
#
# By default, the engine is pre-configured to run in demo mode.
# To run an engine in a productive environment, at least the system database
# has to be configured.
#
# SECRETS / PASSWORDS:
# Any configuration value can be encrypted just by enclosing it with "${encrypt:}".
# This applies a reversible encryption private to this Ivy Engine.
# You cannot copy the encrypted values from one engine to another.
# Example:
# * to encrypt the string "myPassword", write "${encrypt:myPassword}"
#   https://developer.axonivy.com/doc/12.0/engine-guide/configuration/advanced-configuration.html#passwords
#
# OVERRIDING:
# Any configuration value provided here can be set in alternative sources. 
# * environment variables: of the operating system can set app config entries. 
#    Their key must be prefixed with 'IVY_'. 
#    For instance, use 'IVY_SYSTEMDB_URL' to override the jdbc driver url.
#    https://developer.axonivy.com/doc/12.0/engine-guide/configuration/advanced-configuration.html#overriding-configuration
#

# Axon Ivy requires a System Database to store the state of running workflow applications.
# Unless you run the engine in Demo mode, a valid System DB driver, url and the user+password credentials are mandatory.
# [restart required]
SystemDb:
  # JDBC URL
  # [examples: jdbc:postgresql://localhost:5432/AxonIvySystemDatabase, jdbc:sqlserver://localhost:1433;databaseName=AxonIvySystemDatabase, jdbc:mariadb://localhost:3306/AxonIvySystemDatabase, jdbc:mysql://localhost:3306/AxonIvySystemDatabase, jdbc:oracle:thin:@//localhost:1521/ServiceName, jdbc:oracle:thin:@localhost:1521:ServiceId, jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=localhost)(PORT=1521))(CONNECT_DATA=(SERVICE_NAME=ServiceName)(SERVER=DEDICATED)))]
  Url: ""
  # Name of the technical user to connect to system database on behalf of the engine.
  # [examples: ivy, AxonIvy, workflowengine]
  UserName: ""
  # Password for the technical user (see UserName).
  Password: ""
  # Defines how long ivy should wait (in seconds) at startup for the db server to be available
  BootTimeout: 60
  # JDBC Driver. If not set, it is auto determined based on the JDBC URL.
  Driver: ""
  # Additional driver specific connection properties.
  DriverProperties:
  # Maximum number of connections to the system database.
  MaxConnections: 50
  Creation:
    # If set to true, the system database will be created on startup, if it does not exist.
    Enabled: true
    # Password which will be taken to create the system database (only for Oracle).
    Password: ""
    # Tablespace which will be used (only for Oracle).
    Tablespace: ivy
    # Username which will be taken to create the system database (only for Oracle).
    UserName: ""

# Administrators can configure, monitor and manage the Axon Ivy Engine.
# The default administrator in demo mode is 'admin' with password 'admin'.
Administrators:
#  # example Administrator
#  exampleAdministrator:
#    # Will be used to send info mails like license expiration
#    Email: ""
#    # Used to display a nice name for this user
#    FullName: ""
#    # For security reasons, please hash the password(s) using "${hash:mySecret}"
#    # The real password cannot be recovered from the hash.
#    # [examples: "${hash:mySecret}"]
#    Password: ""
#  

SecuritySystems:
  # 'default' security system which exists always
  default:
    # The security system slug name which will be used in URL as prefix for all resources which are part of the security system.
    # If not set, then the security system name will be choosen.
    # Only for the default security context this is empty, by default.
    UrlPath:
    IdentityProvider:
      # The Security System manages the user and roles in the system database.
      # For the Ivy Security System, no additional configuration is needed.
      # For any other Security System, further configuration is need to integrate such a system.
      # [examples: ivy, keycloak, microsoft-active-directory, novell-edirectory, microsoft-entra-id]
      Name: ivy
    
    # The notification channel settings including their default subscription settings which apply to all users.
    Notification:
      # Settings for cleaning up notifications.
      Cleanup:
        # Notifications older than this will be deleted on a daily basis.
        DaysUntilDeletion: 90
      
      # Parameters to disable notifications if a user is absent.
      # Is no property set, it will act like NotifyAbsentUser:always.
      # If NotifyAbsentUser is set to:
      # always: Send a notification regardless of the user’s absence.
      # never: Does not send a notification if the user is absent.
      # noActiveSubstitute: Send a notification only the absent user does not have an active substitute.
      # [enum: always, never, noActiveSubstitute]
      NotifyAbsentUser: always
      # Settings for an individual Channel.
      # [examples: web, mail, microsoft-teams]
      Channels:
        mail:
          # Name of the channel.
          # [examples: web, mail, microsoft-teams]
          Name: ""
          # Whether the channel is enabled or not.
          Enabled: false
          # The default subscription settings.
          Events:
            # Whether all events are enabled or not.
            # [enum: enabled, disabled]
            AllKinds: enabled
            # Array of subscribed events.
            # [examples: new-task]
            Kinds:
        
        microsoft-teams:
          # Name of the channel.
          # [examples: web, mail, microsoft-teams]
          Name: ""
          # Whether the channel is enabled or not.
          Enabled: false
          # The default subscription settings.
          Events:
            # Whether all events are enabled or not.
            # [enum: enabled, disabled]
            AllKinds: enabled
            # Array of subscribed events.
            # [examples: new-task]
            Kinds:
        
        web:
          # Name of the channel.
          # [examples: web, mail, microsoft-teams]
          Name: ""
          # Whether the channel is enabled or not.
          Enabled: true
          # The default subscription settings.
          Events:
            # Whether all events are enabled or not.
            # [enum: enabled, disabled]
            AllKinds: enabled
            # Array of subscribed events.
            # [examples: new-task]
            Kinds:
    
    # Single Sign-on allows to auto login users.
    # A reverse proxy has to be installed in front of the Axon Ivy Engine.
    # It is responsible for authenticating the user.
    # The name of the user must then be transmitted as a HTTP header.
    # !! Assert exclusive access to the Axon Ivy Engine otherwise attackers can easily login as another user.
    # https://developer.axonivy.com/doc/12.0/engine-guide/integration/single-sign-on
    # [restart required]
    SSO:
      # Whether SSO is enabled
      Enabled: false
      # name of the HTTP header with the username that has to be provided by the reverse proxy
      UserHeader: X-Forwarded-User
    
    UserSynch:
      # Shall we synchronize a user with the Identity Provider at login?
      # If the user does not exist yet, he will be synchronized anyway.
      # In case of slow Identity Provider connections, it can make sense to set this to false.
      OnLogin: true
      OnSchedule:
        # Unix Cron expression for the user synchronization.
        # Format is: minutes, hours, day of month, month, day of the week. e.g. "32 13 * * *" is everyday at 13:32
        Cron: 0 0 * * *
        # Shall we run the daily Identity Provider user synchronization job?
        # When the synchronization runs is defined by 'Cron'.
        Enabled: true
        # Shall we import NEW users with the Identity Provider on schedule?
        # This setting does not affect synchronization of existing users.
        # If ImportUsers is set to:
        # true:  NEW users are imported on schedule.
        # If a user has not yet been imported by the user synchronization job, she is also imported the first time she logs in.
        # false: NEW users are not imported on schedule.
        # Instead, a NEW user is only imported the first time she logs in.
        ImportUsers: true
    
    DocumentStorage:
      # The document storage defines where the workflow documents should be stored.
      # [enum: local, s3]
      # [examples: local, s3]
      Name: local
    
    # The default language settings, which applies to all users, who have not explicitly set this in their profile settings.
    Language:
      # Content is displayed in this language if the content exists in this language. A locale (language[_COUNTRY])
      # [examples: en, en_GB, en_US, de, de_CH, de_AT, de_DE, fr, vi]
      Content: en
      # Data like numbers, dates, times and much more are formatted according to this language. A locale (language[_COUNTRY])
      # [examples: en, en_GB, en_US, de, de_CH, de_AT, de_DE, fr, vi]
      Formatting: en_GB

# Web address of the Axon Ivy Engine installation, such as https://yourdomain/.
# This value is used to let ivy know how to refer to itself, ie. to create links in emails.
# This is necessary because ivy cannot reliably detect such a URL from within itself.
# [examples: https://yourdomain.com/]
BaseUrl: ""
# The purpose of a reverse proxy is to provide a single point of entry for
# one or more services from outside the network. The reverse proxy receives all requests from the
# clients and forwards them to the Axon Ivy Engine which handles them.
# https://developer.axonivy.com/doc/12.0/engine-guide/integration/reverse-proxy
# [restart required]
ReverseProxy:
  # HTTP headers which are interpreted by the Axon Ivy Engine to generate the correct URLs for links and redirects.
  # [restart required]
  HttpHeaders:
    # Name of the HTTP Header for identifying the originating IP address of a client connecting to the reverse proxy server.
    # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For
    # [examples: X-Forwarded-For]
    ForwardedFor: X-Forwarded-For
    # Name of the HTTP header for identifying the original host requested by the client. Not needed if the reverse proxy preserves the original host in the 'Host' HTTP Header.
    # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Host
    # [examples: X-Forwarded-Host]
    ForwardedHost: X-Forwarded-Host
    # Name of the HTTP header used to represent the port number used by the client for the request. Not needed if your reverse proxy uses standard ports (80, 443). Only in charge when the HTTP Header of 'ForwardedProtocol' is also set on request.
    # [examples: X-Forwarded-Port]
    ForwardedPort: X-Forwarded-Port
    # Name of the HTTP header for identifying the protocol used between the client and the reverse proxy server.
    # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Proto
    # [examples: X-Forwarded-Proto, X-Forwarded-Ssl, X-Forwarded-Protocol, Front-End-Https, X-Url-Scheme]
    ForwardedProtocol: X-Forwarded-Proto
    # Value of the 'ForwardedProtocol' header to indicate that it is an HTTPS request.
    # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Proto
    # [examples: https, "on"]
    ForwardedProtocolHttps: https

SSL:
  Client:
    # Manipulates the JVMs default SSLSocketFactory, so that untrusted (self signed or outdated) certificates are silently accepted.
    # This could for instance be useful to generate a Webservice stub from an insecure WSDL location.
    EnableInsecureSSL: false
    # A trust store is used to specify trusted server certificates or certificates of certification authorities.
    # An SSL client authenticates a server by using the certificates in a trust store.
    # Self signed or signed by an unknown certification authority can be added to this trustore.
    TrustStore:
      Algorithm: PKIX
      File: configuration/truststore.p12
      # Password to access the store.
      # [password]
      Password: changeit
      Provider: ""
      Type: PKCS12
    
    # A key store is used to read client keys (certificates).
    # This is only required if a remote server requests a client certificate in order to authenticate the client.
    KeyStore:
      Algorithm: SunX509
      File: configuration/keystore.p12
      # Password of the 'ivy' certificate.
      # [password]
      KeyPassword: changeit
      # Password to access the store.
      # [password]
      Password: changeit
      Provider: ""
      Type: PKCS12
      UseCustom: false

Deployment:
  # Directory where the server watches for files to deploy.
  # You can specify a remote network location using a UNC path.
  # https://developer.axonivy.com/doc/12.0/engine-guide/deployment
  # [examples: //servername/share/file]
  Directory: deploy
  Backup:
    # The number of backups of deployed projects that are kept on disk
    # n < 0: infinite number of backups are kept
    # n = 0: No backups are made or kept
    # n > 0: Number of backups that are kept.
    Keep: 5

Data:
  # Folder where applications are stored, unless otherwise defined in application specific configuration.
  # 
  # In demo mode: not configurable and set to: [Data.WorkDirectory]/demo-applicationsAbsolute and relative paths (to the engine root directory) are supported,
  # we recommend to use locations outside the engine root directory to facilitate migrations.
  # !! STOP YOUR ENGINE before changing this setting !!
  # [restart required]
  AppDirectory: applications
  # Folder where runtime data will be stored.Absolute and relative paths (to the engine root directory) are supported,
  # we recommend to use locations outside the engine root directory to facilitate migrations.
  # !! STOP YOUR ENGINE before changing this setting !!
  # [restart required]
  Directory: data
  # DEPRECATED: All runtime data will be stored by default in Data.Directory specified in ivy.yaml. Use Data.Directory
  # to change the location of stored files.
  # 
  # Root folder where application data files are stored.
  # A change in this setting will NOT move existing application files to the new location.
  # You have to move existing files manually to the new directory.
  # 
  # If not set the files will be stored under the path Data.Directory configured in ivy.yaml.Absolute and relative paths (to the engine root directory) are supported,
  # we recommend to use locations outside the engine root directory to facilitate migrations.
  # !! STOP YOUR ENGINE before changing this setting !!
  # [restart required]
  FilesDirectory: ""

DataCache:
  # Invalidate data cache groups and entries.
  # Checks if the lifetime of caches has ended and invalidates them.
  # You can set the delay in milliseconds between each check.
  # This delay has to be greater than 0.
  InvalidationInterval: 60000

# Axon Ivy uses an search engine to provide scalable full text search capabilities.
# The bundled instance is started on demand, in a separate JVM, when an API request needs it.
# You can operate Axon Ivy with the bundled search engine server or with your own external search engine cluster.
SearchEngine:
  # The bundled search engine server...
  # - is started in a separate JVM.
  # - reachable only on 'localhost' but the access is unprotected.
  # - JVM arguments used to start the bundled search engine server can be configured in the '[ivyEngine]/configuration/opensearch/jvm.options' file.
  # [restart required]
  BundledServer:
    # Path to the directory where the bundled search engine server stores data.
    # It is recommended to configure a data directory that is located outside of
    # the Engine installation directory to ease the Engine migration to newer versions.
    # [restart required]
    DataPath: data/_/opensearch
    # Path to the directory where the bundled search engine should log.
    # [restart required]
    LogPath: logs/opensearch
    # Name of the cluster of the bundled search engine server.
    # [restart required]
    ClusterName: ivy-opensearch-{uid}
    # Port to communicate with bundled search engine server
    # AUTO: A free port in port range 19200-19299 is searched automatically.
    # <integer>: A fixed port number that you define. We recommend to use a number > 10000.
    # Make sure it is free.
    # [restart required]
    Port: AUTO
  
  # Configure access to your own search engine server if you want to use it instead of the bundled server.
  # 
  # To install your own search engine server follow these steps
  # https://opensearch.org/docs/2.19/install-and-configure/install-opensearch/index/
  # 
  # Currently, Axon Ivy supports OpenSearch in version 2.19.
  # If your OpenSearch server is running on another host, the access to that instance has to be protected.
  # You can achieve that with a front-end webserver like NGINX that enforces basic authentication.
  # [restart required]
  ExternalServer:
    # Configure the URL of your own OpenSearch server if you want to use it instead of the bundled server.
    # [restart required]
    Url: ""
    # Name of the user to use to authenticate in the external OpenSearch server
    UserName: ""
    # Password of the user to use to authenticate in the external OpenSearch server.
    # [examples: "${encrypt:}"]
    # [password]
    Password: ""
  
  # Settings for the indexes that are created in the search engine.
  Index:
    # The name prefix for the indexes.
    # If multiple Ivy Engines use the same OpenSearch server instance, you need to define unique NamePrefixes per engine.
    # You might add the engine host name as part of the name prefix, i.e. 'servername'
    # [restart required]
    NamePrefix: ivy
    Reindex:
      # The size of the queue that is used to store objects read from the database until they are written to the search engine
      # [restart required]
      QueueSize: 10000
      # The number of objects that Ivy reads in one batch from the system database.
      # [restart required]
      ReadWindowSize: 1000
      # The number of objects that Ivy writes in one batch to the search engine.
      # [restart required]
      WriteWindowSize: 1000
    
    # If BusinessData are not well modeled for OpenSearch, you may have to increase the 'total_fields.limit' of the mapping.
    # Performance may decrease. If you change this setting, you need to reindex all business data in Engine Cockpit.
    # [restart required]
    TotalFieldsLimit: 4000
  
  # Configures the search engine client. The client is the ivy engine which communicates with the search engine.
  Client:
    # Maximum seconds to wait until a connection to the search engine can be established.
    # [restart required]
    ConnectTimeout: 10
    # Maximum seconds to wait for data to be sent by search engine.
    # Raise this value if large datasets are expected.
    # [restart required]
    ReadTimeout: 30

EMail:
  # Whether mails should be sent or not
  Enabled: true
  # All mails will be sent via this mail server
  Server:
    # Mail server host name or IP address
    Host: ""
    # Mail server port
    Port: -1
    # Email address that will be used for emails sent by the server (e.g. task notification emails)
    MailAddress: noreply@ivyserver.local
    User: guest
    # The password for the mail user
    # [password]
    Password: ""
    # A password provider set the password on the mail session from an external resource
    PasswordProvider:
      # Name of the password provider
      # [examples: office365-oauth2]
      Name: ""
    
    # [enum: NONE, START_TLS, SSL]
    EncryptionMethod: NONE
    # Additional properties which will be set on the mail session
    # Read https://javaee.github.io/javamail/docs/api/com/sun/mail/smtp/package-summary.html
    SessionProperties:
      mail.smtp.auth.xoauth2.disable: false
    
    # Specifies the maximum number of emails that can be sent concurrently
    # [restart required]
    MaxConcurrentSendings: 10
    # Certificates are to be stored in the Ivy keystore (default: configuration/keystore.p12; see below at SSL / Client), with the alias defined below.
    SSL:
      # Specifies the alias of the client certificate in the Ivy keystore.
      KeyAlias: ""
      # Specifies whetere a client certificate should be used for authentication
      UseKey: false

# Detection of Axon Ivy versions. Available updates are listed on the Axon Ivy Engine main web page.
UpdateChecker:
  # Shall update notification messages be shown and statistic information sent to the update server?
  # 
  # While checking for new versions the following statistic information is sent to the update server.
  # This information is only used to improve the product!
  # - Engine (version, up time)
  # - Configuration (number of: cluster nodes, users, licensed users, applications, process model, process model version, deleted process model version, running workflows)
  # - Licence information (number, organisation, individual)
  # - Operating system information (name, version, architecture, number of processors)
  # - Host information (host name, SHA-256 hashes of IP address and MAC address to identify the host without being able to read the original IP address and MAC address itself)
  # - System database (product name and version, driver, identification number)
  # - JVM (Java virtual machine) information (version, vendor, name, memory)
  # - Used features: we collect the features you are using such as the active connector technologies (REST, SOAP, JPA, ...).
  # You may inspect the sent information on your own, by enabling the Logger `ch.ivyteam.ivy.update.metrics` on level `DEBUG`.
  Enabled: true
  # Time of day when a update check will be executed
  # The engine must be running at this time otherwise the update check will not be executed.
  # Format is hh:mm.
  # [daytime]
  # [examples: 02:00, 14:15]
  ExecutionTime: ""

Cluster:
  # The name of the cluster.
  # It is used to find and communicate with other nodes of the same cluster.
  # Multiple clusters located in the same network must have different cluster names.
  # Otherwise the nodes of both clusters find each other and build one cluster instead of two.
  # [restart required]
  Name: IvyCluster
  # The name of this node.
  # If not configured, a random name is generated.
  # The name of a node is also used as jvm route identifier that is used by some load balancers to provide sticky sessions.
  # https://developer.axonivy.com/doc/12.0/engine-guide/integration/cluster
  # [restart required]
  NodeName: ""

# When an error occurs while processing a user request, an error screen is displayed to the user.
# The displayed error page can be customized for your needs:
# https://developer.axonivy.com/doc/12.0/engine-guide/configuration/files/web-xml.html
Errors:
  # Shall the end user see detailed error information (stacktraces, detailed error reports, etc.)?
  # By default (false) we only show a unique 'Error Id'. This 'Error Id' can be used to find the error in the log files.
  # For security reasons, normal users should not see technical implementation details.
  # But in development or pre-production environments, it might be safe to show the full error details directly to the end user.
  ShowDetailsToEndUser: false

Persistence:
  JPA:
    # Persist ivyScript auto initialized fields with NULL values. Affects types:
    # - ch.ivyteam.ivy.scripting.objects.Date
    # - ch.ivyteam.ivy.scripting.objects.DateTime
    # - ch.ivyteam.ivy.scripting.objects.Time
    # If this option is set to false, auto initialized values are stored as before Axon Ivy 6.4.
    defaultInitializedAsNull: true

ProcessEngine:
  FiringStatistic:
    # If set to true, a process element statistic is written periodically to the log directory.
    # May impact server performance.
    Active: false
    # Interval in seconds the 'process element statistic' is written to the log directory
    Interval: 300

Boot:
  # Switch to maintencance mode if a configuration problem is detected during startup.
  # If set to DISABLED you can explicit start the engine in maintenance mode by using the command line option '-maintenance'.
  # [enum: AUTO, DISABLED]
  MaintenanceMode: AUTO

Workflow:
  History:
    # Can completed cases and tasks be seen by substitutes of the user who worked on them?
    # [enum: VISIBLE, INVISIBLE]
    ForSubstitutes: VISIBLE

ThreadPool:
  # Executes process engine background operations like Database, WebService calls, etc.
  BackgroundOperationExecutor:
    # Minimum number of threads
    CorePoolSize: 5
    # Maximum number of threads
    MaximumPoolSize: 200
  
  # Executes unscheduled jobs
  ImmediateJobExecutor:
    # Minimum number of threads
    CorePoolSize: 5
    # Maximum number of threads
    MaximumPoolSize: 50
  
  # Executes scheduled jobs
  ScheduledJobExecutor:
    # Minimum number of threads
    CorePoolSize: 5

SystemTask:
  Failure:
    # Defines the behaviour in case a system task fails.
    # [enum: FAIL_TASK_DO_RETRY, FAIL_TASK_DO_NOT_RETRY, DESTROY_TASK, DESTROY_CASE]
    Behaviour: FAIL_TASK_DO_RETRY
  
  SearchJob:
    # Interval in seconds between executions of the search job for system tasks.
    # The job searches system tasks that were not executed because of failures.
    Interval: 900

# Configures the RESTful services provided.
REST:
  Servlet:
    # Controls the REST servlet interface. If disabled no REST resources will be accessible.
    # Calls to remote REST services are still possible.
    # [restart required]
    Enabled: true
    # Controls whether the REST resources provided by the Axon Ivy Engine should be available or not
    # [restart required]
    API: true
    # Controls whether the REST resource for remote deployment under '/system/api/apps/{application} is available or not
    # [restart required]
    Deployment: true
    # Cross Site Request Forgery (CRSF) settings
    # [restart required]
    CSRF:
      # Provides the general CSRF protection via 'X-Requested-By' header for REST services.
      # [restart required]
      Protection: true
    
    # Allows the service developer to get diagnostic information about request processing by Jersey.
    # Those diagnostic/tracing information are returned in response headers (X-Jersey-Tracing-nnn).
    # On productive environments this feature should not be turned on.
    # [restart required]
    # [enum: OFF, ON_DEMAND, ALL]
    Tracing: 'OFF'

Session:
  # Session identifier will be renewed on login to prevent the 'Session Fixation' attack.
  RenewIdOnLogin: true

WebServer:
  # HTTP Headers that are added to a server response.
  # [restart required]
  HttpHeaders:
    # https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Embedder-Policy
    # [restart required]
    # [examples: unsafe-none, require-corp, credentialless]
    Cross-Origin-Embedder-Policy: ""
    # https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Opener-Policy
    # [restart required]
    # [examples: unsafe-none, same-origin-allow-popups, same-origin, noopener-allow-popups]
    Cross-Origin-Opener-Policy: ""
    # https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Resource-Policy
    # [restart required]
    # [examples: same-site, same-origin, cross-origin]
    Cross-Origin-Resource-Policy: ""
    # https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Referrer-Policy
    # [restart required]
    # [examples: no-referrer, no-referrer-when-downgrade, origin, origin-when-cross-origin, same-origin, strict-origin, strict-origin-when-cross-origin, unsafe-url]
    Referrer-Policy: strict-origin-when-cross-origin
    # https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Strict-Transport-Security
    # [restart required]
    # [examples: max-age=63072000]
    Strict-Transport-Security: ""
    # https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Content-Type-Options
    # [restart required]
    # [examples: nosniff]
    X-Content-Type-Options: ""
    # https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options
    # [restart required]
    # [examples: DENY, SAMEORIGIN]
    X-Frame-Options: ""
  
  # Name of the Ivy servlet context. Use a simple name without any special characters.
  # [restart required]
  # [examples: ivy, workflow]
  IvyContextName: ""
  PrimeFaces:
    # https://primefaces.github.io/primefaces/13_0_0/#/core/contentsecuritypolicy?id=content-security-policy
    # [restart required]
    ContentSecurityPolicy:
      # [examples: false, true, reportOnly]
      Enabled: false
      # [examples: object-src 'none'; base-uri 'none'; frame-ancestors 'self'; worker-src 'self' blob:; script-src 'strict-dynamic']
      Policy: ""
      ReportOnlyPolicy: ""

OfflineDialog:
  # Disable it if you don't use the Mobile Offline Dialog feature.
  # [restart required]
  Enabled: true

Connector:
  # https://tomcat.apache.org/tomcat-9.0-doc/config/http.html
  # [restart required]
  HTTP:
    # Whether the HTTP connector is enabled.
    # [restart required]
    Enabled: true
    # The TCP port number on which this Connector will create a server socket and await incoming connections.
    # [restart required]
    Port: 8080
    # The maximum length of the operating system provided queue for incoming connection requests when maxConnections has been reached.
    # [restart required]
    AcceptCount: 100
    # For servers with more than one IP address, this attribute specifies which address will be used for listening
    # on the specified port.
    # By default, the connector will listen all local addresses.
    # [restart required]
    # [examples: 0.0.0.0, ::]
    Address: ""
    # A boolean value which can be used to enable or disable the TRACE HTTP method.
    # [restart required]
    AllowTrace: false
    # The value is a comma separated list of MIME types for which HTTP compression may be used.
    # [restart required]
    CompressibleMimeType: text/html,text/xml,text/plain,text/css,text/javascript,application/javascript,application/json,application/xml
    # The Connector may use HTTP/1.1 GZIP compression in an attempt to save server bandwidth.
    # [restart required]
    # [examples: on, off, force]
    Compression: 'off'
    # The number of seconds during which the sockets used by this Connector will linger when they are closed. The default value is -1 which disables socket linger.
    # [restart required]
    ConnectionLinger: -1
    # The number of milliseconds this Connector will wait, after accepting a connection, for the request URI line to be presented.
    # [restart required]
    ConnectionTimeout: 60000
    # This flag allows the servlet container to use a different, usually longer connection timeout during data upload.
    # [restart required]
    DisableUploadTimeout: true
    # Set to true if you want calls to request.getRemoteHost() to perform DNS lookups in order to return the actual host name of the remote client.
    # Set to false to skip the DNS lookup and return the IP address in String form instead (thereby improving performance).
    # [restart required]
    EnableLookups: false
    # Provides the default value for maxHttpRequestHeaderSize and maxHttpResponseHeaderSize.
    # [restart required]
    MaxHttpHeaderSize: 8192
    # The maximum number of HTTP requests which can be pipelined until the connection is closed by the server.
    # Setting this attribute to 1 will disable HTTP/1.0 keep-alive, as well as HTTP/1.1 keep-alive and pipelining.
    # Setting this to -1 will allow an unlimited amount of pipelined or keep-alive HTTP requests.
    # [restart required]
    MaxKeepAliveRequests: 100
    # The maximum number of parameters (GET plus POST) which will be automatically parsed by the container. 10000 by default
    # [restart required]
    MaxParameterCount: 10000
    # The maximum total number of parts permitted in a request where the
    # content type is multipart/form-data. This limit is in
    # addition to maxParameterCount. Requests that exceed this
    # limit will be rejected. A value of less than 0 means no limit. If not
    # specified, a default of -1 is used.
    # [restart required]
    MaxPartCount: -1
    # The maximum size in bytes of the POST which will be handled by the container FORM URL parameter parsing.
    # The limit can be disabled by setting this attribute to a value less than zero.
    # [restart required]
    MaxPostSize: 2097152
    # The maximum size in bytes of the request body which will be saved/buffered by
    # the container during FORM or CLIENT-CERT authentication or during HTTP/1.1 upgrade.
    # [restart required]
    MaxSavePostSize: 4096
    # The maximum number of request processing threads to be created by this Connector, which therefore determines the maximum number of simultaneous requests that can be handled.
    # [restart required]
    MaxThreads: 200
    # The minimum number of threads always kept running. This includes both active and idle threads.
    # [restart required]
    MinSpareThreads: 10
    # The value is a regular expression (using java.util.regex) matching the user-agent header of HTTP clients
    # for which compression should not be used.
    # [restart required]
    NoCompressionUserAgents: ""
    # If this Connector is being used in a proxy configuration, configure this attribute to specify the server name to be returned for calls to request.getServerName().
    # [restart required]
    ProxyName: ""
    # If this Connector is being used in a proxy configuration, configure this attribute to specify the server port to be returned for calls to request.getServerPort().
    # [restart required]
    ProxyPort:
    # If this Connector is supporting non-SSL requests, and a request is received for which a matching <security-constraint> requires SSL transport, Catalina will automatically redirect the request to the port number specified here.
    # [restart required]
    RedirectPort: 8443
    # The value is a regular expression (using java.util.regex) matching the user-agent header of HTTP clients
    # for which HTTP/1.1 or HTTP/1.0 keep alive should not be used, even if the clients advertise support for these features.
    # [restart required]
    RestrictedUserAgents: ""
    # Overrides the Server header for the http response.
    # If set, the value for this attribute overrides any Server header set by a web application.
    # If not set, any value specified by the application is used.
    # If the application does not specify a value then no Server header is set.
    # [restart required]
    Server: ""
    # If set to true, the TCP_NO_DELAY option will be set on the server socket, which improves performance under most circumstances.
    # [restart required]
    TcpNoDelay: true
    # The priority of the request processing threads within the JVM.
    # [restart required]
    ThreadPriority: 5
    # This specifies the character encoding used to decode the URI bytes, after %xx decoding the URL.
    # [restart required]
    URIEncoding: UTF-8
    # This specifies if the encoding specified in contentType should be used for URI query parameters, instead of using the URIEncoding.
    # [restart required]
    UseBodyEncodingForURI: false
    # Set this attribute to true to cause Tomcat to use the IP address that the request was received on to determine the Host to send the request to.
    # [restart required]
    UseIPVHosts: false
    # Set this attribute to true to cause Tomcat to advertise support for the Servlet specification using the header recommended in the specification.
    # [restart required]
    XpoweredBy: false
  
  # https://tomcat.apache.org/tomcat-9.0-doc/config/http.html
  # [restart required]
  HTTPS:
    # Whether the HTTPS connector is enabled.
    # [restart required]
    Enabled: false
    # The TCP port number on which this Connector will create a server socket and await incoming connections.
    # [restart required]
    Port: 8443
    # The maximum length of the operating system provided queue for incoming connection requests when maxConnections has been reached.
    # [restart required]
    AcceptCount: 100
    # For servers with more than one IP address, this attribute specifies which address will be used for listening
    # on the specified port.
    # By default, the connector will listen all local addresses.
    # [restart required]
    # [examples: 0.0.0.0, ::]
    Address: ""
    # A boolean value which can be used to enable or disable the TRACE HTTP method.
    # [restart required]
    AllowTrace: false
    # 
    # [restart required]
    ClientAuth: NONE
    # The value is a comma separated list of MIME types for which HTTP compression may be used.
    # [restart required]
    CompressibleMimeType: text/html,text/xml,text/plain,text/css,text/javascript,application/javascript,application/json,application/xml
    # The Connector may use HTTP/1.1 GZIP compression in an attempt to save server bandwidth.
    # [restart required]
    # [examples: on, off, force]
    Compression: 'off'
    # The number of seconds during which the sockets used by this Connector will linger when they are closed. The default value is -1 which disables socket linger.
    # [restart required]
    ConnectionLinger: -1
    # The number of milliseconds this Connector will wait, after accepting a connection, for the request URI line to be presented.
    # [restart required]
    ConnectionTimeout: 60000
    # This flag allows the servlet container to use a different, usually longer connection timeout during data upload.
    # [restart required]
    DisableUploadTimeout: true
    # Set to true if you want calls to request.getRemoteHost() to perform DNS lookups in order to return the actual host name of the remote client.
    # Set to false to skip the DNS lookup and return the IP address in String form instead (thereby improving performance).
    # [restart required]
    EnableLookups: false
    # Provides the default value for maxHttpRequestHeaderSize and maxHttpResponseHeaderSize.
    # [restart required]
    MaxHttpHeaderSize: 8192
    # The maximum number of HTTP requests which can be pipelined until the connection is closed by the server.
    # Setting this attribute to 1 will disable HTTP/1.0 keep-alive, as well as HTTP/1.1 keep-alive and pipelining.
    # Setting this to -1 will allow an unlimited amount of pipelined or keep-alive HTTP requests.
    # [restart required]
    MaxKeepAliveRequests: 100
    # The maximum number of parameters (GET plus POST) which will be automatically parsed by the container. 10000 by default
    # [restart required]
    MaxParameterCount: 10000
    # The maximum total number of parts permitted in a request where the
    # content type is multipart/form-data. This limit is in
    # addition to maxParameterCount. Requests that exceed this
    # limit will be rejected. A value of less than 0 means no limit. If not
    # specified, a default of -1 is used.
    # [restart required]
    MaxPartCount: -1
    # The maximum size in bytes of the POST which will be handled by the container FORM URL parameter parsing.
    # The limit can be disabled by setting this attribute to a value less than zero.
    # [restart required]
    MaxPostSize: 2097152
    # The maximum size in bytes of the request body which will be saved/buffered by
    # the container during FORM or CLIENT-CERT authentication or during HTTP/1.1 upgrade.
    # [restart required]
    MaxSavePostSize: 4096
    # The maximum number of request processing threads to be created by this Connector, which therefore determines the maximum number of simultaneous requests that can be handled.
    # [restart required]
    MaxThreads: 200
    # The minimum number of threads always kept running. This includes both active and idle threads.
    # [restart required]
    MinSpareThreads: 10
    # The value is a regular expression (using java.util.regex) matching the user-agent header of HTTP clients
    # for which compression should not be used.
    # [restart required]
    NoCompressionUserAgents: ""
    # If this Connector is being used in a proxy configuration, configure this attribute to specify the server name to be returned for calls to request.getServerName().
    # [restart required]
    ProxyName: ""
    # If this Connector is being used in a proxy configuration, configure this attribute to specify the server port to be returned for calls to request.getServerPort().
    # [restart required]
    ProxyPort:
    # If this Connector is supporting non-SSL requests, and a request is received for which a matching <security-constraint> requires SSL transport, Catalina will automatically redirect the request to the port number specified here.
    # [restart required]
    RedirectPort: 8443
    # The value is a regular expression (using java.util.regex) matching the user-agent header of HTTP clients
    # for which HTTP/1.1 or HTTP/1.0 keep alive should not be used, even if the clients advertise support for these features.
    # [restart required]
    RestrictedUserAgents: ""
    # Overrides the Server header for the http response.
    # If set, the value for this attribute overrides any Server header set by a web application.
    # If not set, any value specified by the application is used.
    # If the application does not specify a value then no Server header is set.
    # [restart required]
    Server: ""
    # The name of the protocol to support when communicating with clients.
    # If you need a fine granular selection of multiple protocols, use the 'SslHostConfig.Protocols' property.
    # [restart required]
    # [examples: TLS, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3]
    SslProtocol: TLS
    SslHostConfig:
      # The names of the protocols to support when communicating with clients.
      # Multiple protocols can be enabled by separating them with a comma.
      # [restart required]
      # [examples: SSLv2Hello, SSLv3, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3, all]
      Protocols: all
    
    # 
    # [restart required]
    KeyAlias: ""
    # [password]
    # [restart required]
    KeyPass: ""
    # 
    # [restart required]
    KeystoreFile: configuration/keystore.p12
    # [password]
    # [restart required]
    KeystorePass: changeit
    # 
    # [restart required]
    KeystoreType: pkcs12
    # If set to true, the TCP_NO_DELAY option will be set on the server socket, which improves performance under most circumstances.
    # [restart required]
    TcpNoDelay: true
    # The priority of the request processing threads within the JVM.
    # [restart required]
    ThreadPriority: 5
    # 
    # [restart required]
    TruststoreFile: ""
    # [password]
    # [restart required]
    TruststorePass: ""
    # 
    # [restart required]
    TruststoreType: JKS
    # This specifies the character encoding used to decode the URI bytes, after %xx decoding the URL.
    # [restart required]
    URIEncoding: UTF-8
    # This specifies if the encoding specified in contentType should be used for URI query parameters, instead of using the URIEncoding.
    # [restart required]
    UseBodyEncodingForURI: false
    # Set this attribute to true to cause Tomcat to use the IP address that the request was received on to determine the Host to send the request to.
    # [restart required]
    UseIPVHosts: false
    # Set this attribute to true to cause Tomcat to advertise support for the Servlet specification using the header recommended in the specification.
    # [restart required]
    XpoweredBy: false

HealthCheck:
  # Whether health check is enabled
  Enabled:
  Checks:
    DatabasesConnectionPoolCheck:
      Enabled: true
    
    EngineModeCheck:
      Enabled: true
    
    HeapMemoryCheck:
      Enabled: true
    
    ReleaseCandidateCheck:
      Enabled: true
    
    RestartRequiredCheck:
      Enabled: true
    
    RestClientsConnectionPoolCheck:
      Enabled: true
    
    SysDbConnectionPoolCheck:
      Enabled: true
    
    SystemCpuLoadCheck:
      Enabled: true
    
    SystemMemoryCheck:
      Enabled: true

Cockpit:
  # Hide restart button in the Cockpit toolbar.
  # [enum: Enabled, Disabled]
  Restart: Enabled