jndi:
  datasources:
    acl:
      enabled: true
      wait-for-it: true
      wait-timeout: 15
      url: jdbc:postgresql://acldb:5432/acl
      username: acl
      password: acls3cr3t
      maximum-pool-size: 50
      minimum-idle: 2
      connection-timeout: 3000
      idle-timeout: 60000

acl.db.jndiName: java:comp/env/jdbc/acl
acl.db.schema: acl
acl.db.dialect: org.hibernate.spatial.dialect.postgis.PostgisPG10Dialect

geoserver:
  acl:
    security:
      headers:
        # Remember to only enable header pre-authentication if behing a reverse proxy 
        # that removes the incoming request headers used for `user-header` and `roles-header`
        # and adds the sanitized ones.
        enabled: false
        user-header: sec-username
        roles-header: sec-roles
        admin-roles: ["ROLE_ADMINISTRATOR"]
      internal:
        # HTTP Basic Auth
        enabled: true
        users:
          admin:
            admin: true
            enabled: ${acl.users.admin.enabled:true}
            # password is a bcrypt encoded value for s3cr3t
            password: "${acl.users.admin.password:{bcrypt}$2a$10$FE62N3ejbKm56EX5VrtSQeDDka8YjwgjwF9sSEKbatGZuZ8e7S9v.}"
            #for a plain-text password (e.g. coming from a docker or kubernetes secret,
            # use the {noop} prefix, as in: password: "{noop}plaintextpwd}", or password: "{noop}${ACL_ADMIN_PASSWORD}"
          geoserver:
            # special user for GeoServer to ACL communication
            # Using a `{noop}` default credentials for performance, since bcrypt adds a significant per-request overhead
            # in the orther of 100ms. In production it should be replaced by a docker/k8s secret
            admin: true
            enabled: ${acl.users.geoserver.enabled:true}
            password: "${acl.users.geoserver.password:{noop}s3cr3t}"


logging:
  level:
    root: warn
    org.geoserver.acl: info
    org.geoserver.cloud.config: info
    org.springframework.jdbc.support: info

management:
  endpoint:
    health:
      probes:
        enabled: true
  endpoints:
    web:
      exposure:
        include:
        - '*'

---
spring.config.activate.on-profile: acl_debug
logging:
  level:
    org.geoserver.acl: debug