Backend settings

# ===============================
# DATABASE
# ===============================

# JDBC connection URL for the database
spring.datasource.url=jdbc:mysql://localhost:3306/as2gx?useSSL=false

# JDBC driver to use for connecting to the database; consult the official JDBC driver documentation for your chosen databass
spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver

# user name and password for connecting to the database
spring.datasource.username=
spring.datasource.password=

# system will maintain a pool of live database connections for fast operation;
# this query is used to health-check each connection picked from the pool, before it is used for actual operations
# consult documentation of your chosen database for the appropriate validation/health-check query
spring.datasource.validationQuery=SELECT 1
# keep the connection alive if idle for a long time (needed in production)
spring.datasource.testWhileIdle=true

# ==================================
# = JPA / HIBERNATE CONFIGURATION
# ==================================

# automatically update database schema based on application entity model; used in first application launch
spring.jpa.hibernate.ddl-auto=update

# internal; allows Hibernate to generate SQL optimized for a particular DBMS
spring.jpa.database-platform=org.hibernate.dialect.MySQL8Dialect

# internal; log each SQL query issued by the application
spring.jpa.show-sql=false

# internal; DB entity naming strategy
spring.jpa.hibernate.naming.implicit-strategy=com.as2gateway.util.SpringImplicitNamingStrategy
spring.jpa.hibernate.naming.physical-strategy=com.as2gateway.util.SpringPhysicalNamingStrategy

# internal; for stripping XML dependencies from Hibernate
hibernate.xml_mapping_enabled=false

# internal; for returning JPA entities outside of services
spring.jpa.open-in-view=true

# path storing large binary payloads (raw messages, attachments etc)
# applicable ONLY on variants with VLF (large file) support
# you would usually mount a disk/NFS/volume with adequate space under this path of the runtime, visible to both backend and broker
blob.store.path=/var/lib/as2gx

# ===============================
# = TEMP DIRECTORY
# ===============================

# internal; path storing temporarily uploaded files
file.store.isBlob=true
file.store.path=/tmp


# ===============================
# = REGULATORY SUBMISSIONS
# applicable ONLY on variants with RegSub (regulatory submissions) support
# ===============================

# local path where submission source-files directory (disk/NFS/volume) is mounted
submission.base.path=/tmp/submissions

# whether to use the subject included in the submission, as the AS2 message Subject header
submission.include.subject=false

# allow directly composing/submitting messages, without going thru submissions view?
outbound.direct.enabled=true
webapp.config.outbound.direct.enabled=${outbound.direct.enabled}

# ===============================
# = COMPRESSION
# ===============================
# controls the executor and thread pool provisioned for compressing submission source files into final archives
# applicable ONLY on variants with RegSub (regulatory submissions) support

# keep at least this many thread in pool
compression.executor.core_size=5
# don't allow pool to grow beyond this many threads (concurrent compression operations)
compression.executor.max_size=20
# discard threads that have been idle for more than this many seconds
compression.executor.keep_alive=60
# accept up to this many tasks into the executor queue
compression.executor.queue=50

# mode to use for archiving large (> 8GB) files in generated tar.gz submissions
# https://commons.apache.org/proper/commons-compress/tar.html#Big_Numeric_Values
# ERROR|STAR|POSIX
compression.mode.large_file=STAR
# mode to use for archiving files with long paths/names (> 100 chars) in generated tar.gz submissions
# https://commons.apache.org/proper/commons-compress/tar.html#Big_Numeric_Values#Long_File_Names
# ERROR|TRUNCATE|GNU|POSIX
compression.mode.long_name=GNU


# ===============================
# = MULTIPART
# ===============================

# [DEPRECATED] mainly applicable for direct message composing via local/browser file uploads
# maximum size of an individual part/file, in multipart payloads accepted by backend REST endpoints
spring.servlet.multipart.max-file-size=${outbound.max.size}
# maximum overall size of a multipart payload accepted by backend REST endpoints
spring.servlet.multipart.max-request-size=${outbound.max.size}


# =================================
# AUTH
# =================================

# authentication type for built-in (non-third-party) auth
# currently jdbc is the only supported type
auth.type=jdbc
# enable DB/direct password-based login; e.g. you may need to turn this off if SSO is configured
auth.direct=true
webapp.config.auth.direct=${auth.direct}

# JWT Token expiration time - One day (1000 * 60 * 60 * 24)
jwt.token.expiration=86400000
# issuer claim to use for app-issued (built-in auth) JWT tokens
jwt.token.issuer=${host.name}
# secret for signing app-issued JWT tokens; must be at least ?? chars in size, and base-64 encoded
jwt.token.secret=cGwzQHNlIGNoYW5nZSA3aGlzIHNlY3JldCB3OGVuIDdvdSBnbyBwcjBkdWN0aW9uIQ==
# remember and reject invalidated tokens (logged-out sessions)
# default behavior is to accept any valid token till its expiry time
logout.token.validation.enabled=false

# Configuring third-party OpenID auth providers:
# multiple providers can be configured, each with unique value for "<name>" placeholder

# provider's base OIDC URL; exposed to frontend
# e.g. if configuration URL is https://foo.bar/baz/.well-known/openid-configuration, base URL is https://foo.bar/baz
# openid.provider.<name>.baseUrl=
# OIDC app client ID; exposed to frontend
# openid.provider.<name>.clientId=
# OIDC app client secret
# openid.provider.<name>.clientSecret=
# (optional) automatically expire any JWKS (keys) obtained from OIDC server's JWKS endpoint, by this schedule
# format: <second> <minute> <hour> <day-of-month> <month> <day-of-week>
# openid.provider.<name>.jwksExpirationCron=
# (optional) any additional/static JWKs (not present in JWKS endpoint response) can be configured here, as <key-id> and <key-value> pairs
# openid.provider.<name>.additionalKeys.<key-id>=<key-value>
# (optional) claim name (JSON key) that the provider uses for denoting username, inside JWT body, if different from "email"; exposed to frontend
# openid.provider.<name>.userClaimName=
# (optional) claim name (JSON key) that the provider uses for denoting groups, inside JWT body, if different from "groups"; exposed to frontend
# openid.provider.<name>.groupsClaimName=

# for each provider, these additional entries must be configured to expose corresponding backend properties for frontend OIDC auth flow:
# in UI, a 'Log-in with <provider name>' button would appear for each such configured provider
# webapp.config.auth.<provider name>.clientId=${openid.provider.<name>.clientId}
# webapp.config.auth.<provider name>.baseUrl=${openid.provider.<name>.baseUrl}

# (next entries are not required if not overridden:)
# webapp.config.auth.<provider name>.userClaimName=${openid.provider.<name>.userClaimName}
# webapp.config.auth.<provider name>.groupsClaimName=${openid.provider.<name>.groupsClaimName}

# internal; app-level redirect URI for implicit auth
openid.redirect_uri=${host.url}/openid-callback


# =================================
# HOST
# =================================

# publicly accessible base URL of the web interface
host.url=http://${host.name}:8080

# hostname designated for overall system (recommended: hostname of web interface); for internal use
host.name=localhost
# any incoming messages with this prefix on the `Host` header, e.g. test-${http.public.endpoint}, will be treated as test messages
# https://aayutechnologies.com/docs/product/as2-gateway/partner-types/
test.host.prefix=test-
# IP address of AS2 receiving endpoint; only used in partner-profile previews
# https://aayutechnologies.com/docs/product/as2-gateway/creating-as2-station/#31-partner-configuration-of-an-as2-station
host.ip=127.0.0.1
# hostname for integrated SFTP server, if applicable
sftp.host=localhost
# REST API endpoint base URL
api.host.url=http://localhost:8080


# =================================
# ROLES / PERMISSIONS
# =================================

# internal; during first run/bootstrap, application creates a super-user account/tenant
# for managing some global resources such as system-wide HTTPS identity keypairs;
# only used in initialization

# name for super-admin group
super.group=AAYU_SUPER_GROUP
# name for super-admin role
super.role=AAYU_SUPER_ROLE
# full name of super-admin user
super.user.fullname=Aayu Admin
# domain/tenant name for super-admin account
super.user.org.domain=as2gateway.com
# organization name for super-admin account
super.user.org.name=Aayu Technologies LLC
# password to use when creating super-admin account
super.user.password=
# email address for super-admin user
super.user.email=support@as2gateway.com

# a read-only super-admin account (has to be registered manually)
super-readonly.user.email=support+readonly@as2gateway.com

# when registering each new tenant/account, application registers an org-admin group and role for the tenant;
# and uses them to grant full access to all features, for the first organization member

# name for org-admin roles
org.admin.role=ORG_ADMIN_ROLE
# name for org-admin groups
org.admin.group=OrgAdmins
# description for org-admin groups
org.admin.group.description=Organizational Admins

# bootstrap; automatically initialize DB with permissions and super-user details
# idempotent, but recommended to disable after initial deployment
auto.init.db=false

# automatically activate newly added users, without requiring email verification
auto.verify.users=true
# when adding new users, verify that their emails belong to the tenant's domain;
e.g. for a tenant foo.com, all users must have @foo.com or @<subdomain>.foo.com emails
email.domain.verification.enabled=false

# send welcome emails for new users
email.welcome.enabled=true


# =================================
# EMail
# =================================

# SMTP email server hostname, e.g. AWS SES
spring.mail.host=email-smtp.us-east-1.amazonaws.com
# port number to connect on the email server
spring.mail.port=587
# 'From' address (MAILFROM) to use for sending emails out; may need to be authorized before use, e.g. in case of SES
spring.mail.from=noreply@as2gateway.com
# name to use (along with the 'From' address) for sending emails out
spring.mail.fromName=AS2 Gateway
# SMTP server log-in username
spring.mail.username=
# SMTP server log-in password
spring.mail.password=

# 'From' address (MAILFROM) to use for system-generated support notifications; recommended: an address that can receive replies
spring.mail.fromSupport=support@as2gateway.com

# internal JavaMail properties; not necessary to change in most cases
# https://javaee.github.io/javamail/docs/api/com/sun/mail/smtp/package-summary.html#properties

# mail.transport.protocol property
spring.mail.properties.mail.transport.protocol=smtp
# mail.smtp.auth property; disable only if you use a SMTP server that allows anonymous/unauthenticated connections (e.g. locally installed)
spring.mail.properties.mail.smtp.auth=true
# mail.smtp.starttls.enable property; disable if your server does not require/support STARTTLS authentication
spring.mail.properties.mail.smtp.starttls.enable=true
# mail.smtp.timeout property; increase this if your server/network is slow, or timeouts are commonly observed during email sending
spring.mail.properties.mail.smtp.timeout=180000


# =================================
# LISTENERS
# =================================

# application receives incoming AS2 traffic on this HTTP port
http.port=8280

# set to `true` to enable receiving AS2 traffic via broker's built-in HTTPS (TLS/SSL) endpoint
# AS2 payloads are already encrypted; in most cases, HTTPS only adds an unnecessary overhead
https.enabled=true
# application receives incoming HTTPS AS2 traffic over this port, if enabled
https.port=8443

# is there a publicly exposed HTTP endpoint to receive AS2 traffic?
http.public.enabled=true
# public AS2 HTTP endpoint in hostname:port format
http.public.endpoint=localhost:8280
# is there a publicly exposed HTTPS (TLS/SSL) endpoint to receive AS2 traffic?
# (either broker's above built-in endpoint, or a reverse proxy forwarding back to http.port)
https.public.enabled=false
# public AS2 HTTPS endpoint in hostname:port format
https.public.endpoint=

# =================================
# HTTPS KeyStores
# =================================

# internal; entry name/alias for the identity key inside application's HTTPS keystore
https.identity.key.alias=ultraesb
# internal; password used for the above key; DO NOT change after initial run
https.identity.key.password=password

# =================================
# ESB direct invoke
# =================================

# in some operations, backend will directly invoke an internal endpoint on broker

# refresh cached SSL/TLS context of broker, after backend makes a change in HTTPS certs
ssl.context.reload.url=http://localhost:8283/service/reload
# when user invokes "resend MDN" option on a message
async.mdn.resend.url=http://localhost:8283/service/resend-async-mdn
# when user invokes "test connection" option on a partner
test.connection.url=http://localhost:8283/service/test-connection
# when user invokes "test" option on a webhook
test.webhook.url=http://localhost:8283/service/test-webhook
# when user invokes "replay" option on an incoming message
replay.incoming.url=http://localhost:8283/service/replay-incoming
# when user invokes "replay" option on an outgoing message
replay.outgoing.url=http://localhost:8283/service/replay-outgoing
# when user invokes "redeliver to downstreams" option on an incoming message
replay.downstreams.url=http://localhost:8283/service/replay-downstreams
# refresh S3 polling/listener configs, when a tenant enables or updates S3 integration
s3.refresh.url=http://localhost:8283/service/s3-refresh

# internal; shared secret/auth token used for direct broker invocations; same value must be configured on backend and broker
as2.direct.invoke.token=6dafba86-6e37-46be-9827-b3688501121a

# customize S3 base paths for receiving and sending files using S3 integration
# https://aayutechnologies.com/docs/product/as2-gateway/aws-s3-integration/#3-receiving-incoming-files-through-s3
s3.inbound.prefix=as2gateway
s3.outbound.prefix=AS2/send

webapp.config.s3.inbound_prefix=${s3.inbound.prefix}/
webapp.config.s3.outbound_prefix=${s3.outbound.prefix}/


# =================================
# METRICS
# =================================

# metrics (sent/received message/MDN counts) are published by broker to an Elasticsearch (ES) node/cluster via REST,
# and queried by backend via "transport" protocol
# NOT applicable for "lite", Dockerized and similar variants without built-in metrics support

# enable message/MDN statistics?
metrics.enabled=true
# ES transport-protocol endpoint to access for metrics
es.servers=localhost:9300

# metrics query configs; must match publisher configs (conf/metrics/ultraesb_x_template.json) on broker

# index name to query
es.index_name=ultraesb_x
# mapping type name for metrics entities
es.mapping_type=x_statistics
# name assigned to ES cluster
es.cluster_name=elasticsearch


# =================================
# OUTBOUND
# =================================

# max total size of content (files) allowed in one outgoing message submission
# NOTE: this may differ from the actual size of the final composed AS2 message
outbound.max.size=10485760
# max number of files that can be included in one outgoing message submission
outbound.max.files=10

# https://aayutechnologies.com/docs/product/as2-gateway/rest-api-integration/#73-downloading-multiple-attachments
# max number of files that can be downloaded as one batch, from batch-download REST API
v1.attachment.batch.maxcount=10
# max total size of files that can be downloaded as one batch, from batch-download REST API
v1.attachment.batch.sizelimit=10485760

# suffix to use for Message-IDs (of outgoing messages and MDNs)
# set this to your organization domain name e.g. "@your.domain", to get IDs of the format `<unique-prefix@your.domain>`
as2.message.id-suffix=@as2gateway.com

# this section controls retry schedule for outbound message failures

# how many times each outgoing message will be retried (on temporary send failures like network issues and HTTP 5xx error responses)
as2.internal.outbound.retry.count=10
# failed messages are retried using an exponential back-off, with this initial/starting delay (millis)
as2.internal.outbound.retry.initial=5000
# multiplication factor for above exponential back-off; e.g. 2 will double the delay after each retry (until ceiling is reached)
as2.internal.outbound.retry.multiplier=2
# max value (ceiling) for retry delay; back-off/delay will not increase beyond this value
# e.g. initial=5000, ceiling=60000 will run retries at 5s, 10s, 20s, 40s, 60s (80s reduced by ceiling), 60s, 60s, ..
as2.internal.outbound.retry.ceiling=60000

# max number of outgoing messages that will be picked in each retry cycle
# when increasing this value, make sure system has sufficient resources (esp. disk and memory) to process such number of messages concurrently
as2.internal.outbound.fetch.limit=10


# =================================
# SFTP
# =================================

# applicable ONLY for deployments with local-SFTP integration (SFTP server with filesystem directly accessible by AS2 application)

# path where SFTP-setup scripts are located (executed when a tenant enables SFTP integration)
sftp.script.path=/opt/as2gx-services/bin/sftp_scripts
# root directory where SFTP folder hierarchy is located; must be accessible to both backend and broker
sftp.root.path=/home/sftp


# =================================
# Response Compression
# =================================

# standard Spring Boot properties controlling server response behaviors
# https://docs.spring.io/spring-boot/how-to/webserver.html
server.compression.enabled=true
server.compression.mime-types=application/json,text/xml,text/html,text/plain
server.compression.min-response-size=64
# avoid including keys with null values, in backend API responses
spring.jackson.default-property-inclusion=non_null
# convert java.util.Date objects in backend API responses, into timestamps
spring.jackson.serialization.write_dates_as_timestamps=true

# =================================
# Brute Force Authentication Prevention
# =================================

# block user log-in temporarily from a given source IP address, after this many failed attempts from that address
max.login.attempts=10
# temporary log-in block duration
cache.duration.hours=1

# when backend is running behind a reverse proxy e.g. Apache/Nginx or a managed deployment platform like Heroku, source IP address exposed by Java's network APIs may not reflect the actual client IP
# in such cases, enable this to extract original source IP from `X-Forwarded-For` request header - IF the proxy actually adds it to the request
x.forwarded.header.available=false

# =================================
# Other Security Settings
# =================================

# allow users to reveal previously-saved passwords/secrets; e.g. private key passwords, SFTP passphrase
password.reveal.enabled=true

# CSP/HSTS security headers for web interface
security.headers.csp=default-src 'self' 'unsafe-inline' data: https://fonts.googleapis.com https://www.gstatic.com https://fonts.gstatic.com
security.headers.hsts=max-age=31536000; includeSubDomains


# =================================
# Async Task Executor
# =================================

# this executor/thread pool is used for non-real-time tasks like sending out emails

# how many threads (and hence concurrent tasks) are supported
task.executor.maxPoolSize=20
# how many tasks can get queued while the executor is busy/saturated, before starting to reject tasks
task.executor.queueCapacity=100


# =================================
# CRON
# =================================

# schedule to automatically purge used/expired verification tokens, generated for new account/user registrations
# format: <second> <minute> <hour> <day-of-month> <month> <day-of-week>
verification.token.purge.cron.expression=0 0 5 * * ?

# CRON schedule expression of message sanity-check utility, capturing pending MDNs, in-flight stuck messages, etc
message.sanity.cron=0 0 11 * * ?
# alert only messages stuck for past 24-48h
message.sanity.alert-threshold=1
message.sanity.check-interval=1

# CRON schedule expression of certificate expiry-check utility
certificate.expiry.cron=0 30 11 * * 1
# alert only certs expiring in next 7-14D
certificate.expiry.alert-threshold=7
certificate.expiry.check-interval=7

# allow importing a previously exported tenant account from a zipfile, instead of manual registration and configuration
tenant.import.enabled=false

# optional; reporting actions of interest (partner creation, update etc.), and any operational WARN logs, to a Slack webhook
# https://docs.slack.dev/messaging/sending-messages-using-incoming-webhooks/#posting_with_webhooks
# has basic compatibility with MS-Teams incoming-webhook URLs as well:
# https://learn.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/how-to/add-incoming-webhook#send-a-request-to-the-webhook
slack.url=
slack.channel=