# Passwords in this file are base64 encoded
# These passwords can be generated from the command line by using this command:
# echo -n "the plaintext password" | base64
# Note that the -n parameter to echo is important to avoid encoding a newline
# as part of the actual password.
global:
  hadoop:
    # kafkaBootstrapServer is the host and port of the Kafka server
    # For the development HDP topology, this is the hadoop master, typically port 9096
    # For the production HDP topology, this is the secondary master, typically port 9096
    # When not using HDP, this is the internal name of the kafka pod running in the kubernetes cluster using port 9092
    # kafkaBootstrapServer:kafka-hostname:9096
    kafkaBootstrapServer: fcco-kafka:9092

  LDAP_SERVER_HOST: '<hostname>'
  LDAP_SERVER_PORT: '636'

  # set to True if connecting to the LDAP server over SSL
  # set to False otherwise
  LDAP_SERVER_SSL: True
    
  LDAP_SERVER_BINDDN: 'administrator'

  # LDAP_SERVER_BINDCREDENTIALS is the base64 encoded password 
  # of the LDAP server bind dn
  LDAP_SERVER_BINDCREDENTIALS: '<ldap_password_base64>'
  LDAP_SERVER_SEARCHBASE: 'cn=users,dc=aml,dc=ibm,dc=com'
  LDAP_PROFILE_DISPLAYNAME: 'displayName'
  LDAP_PROFILE_EMAIL: 'userPrincipalName'
  LDAP_PROFILE_GROUPS: 'memberOf'
  LDAP_PROFILE_ID: 'sAMAccountName'
  LDAP_SERVER_USERNAME_MAPPING: 'sAMAccountName'

  # all passwords must be in quotes and base64 encoded
  passwords:
    # the password for the WebSphere MQ admin user
    mqm: '<mqm_password_base64>'
    # the password for the FCI database user
    fciauthid: '<fciauthid_password_base64>'
    # the password for the FCI database instance owner
    db2inst1: '<db2inst1_password_base64>'

foundational-services:
  platform-secrets:

  kafka:
    # disable Kafka if using Kafka in HDP
    enabled: True

    image: "ibmcom/fci-kafka"
    imageTag: "1.0.3-APAR-PH01524"
    imagePullPolicy: "IfNotPresent"

    zookeeperImage:
      repository: ibmcom/fci-zookeeper
      tag: 1.0.3-APAR-PH01524
      pullPolicy: IfNotPresent

  logging:
    image:
      tag: 1.0.3-APAR-PH01524
      pullPolicy: IfNotPresent

  security-audit:
    image:
      tag: 1.0.3-APAR-PH01524
      pullPolicy: IfNotPresent

  security-auth:
    # When LDAP_SERVER_SSL (above) is set to True, set this value to
    # the SSL certificate of the LDAP server.  Otherwise, this value
    # is not used and does not need to be changed.
    ldap_crt: |
      -----BEGIN CERTIFICATE-----
      MIIDhzCCAm+gAwIBAgIQWBFMsY3GhJ1CAMR7Xda0ijANBgkqhkiG9w0BAQsFADBW
      MRMwEQYKCZImiZPyLGQBGRYDY29tMRMwEQYKCZImiZPyLGQBGRYDaWJtMRMwEQYK
      CZImiZPyLGQBGRYDYW1sMRUwEwYDVQQDEwxhbWwtQU1MQUQtQ0EwHhcNMTcwOTA3
      MTgxMTE2WhcNMjIwOTA3MTgyMTE2WjBWMRMwEQYKCZImiZPyLGQBGRYDY29tMRMw
      EQYKCZImiZPyLGQBGRYDaWJtMRMwEQYKCZImiZPyLGQBGRYDYW1sMRUwEwYDVQQD
      EwxhbWwtQU1MQUQtQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCl
      RZKGYatqDYhIpI09gisivkKS0xC/ENBZ6mkHZt0y7psf0KcLof7MwZ3gkaxsQ7sr
      MsWS5YSZwagmiFrQIvWDldwSi2Dq4qfw0XEQ+w/AwKKnWcw4sGHLAXBcS6W2Wvri
      fAeViXcGm2Go5GIPiOxVwp/2zunT5vDsx5+kdLF8R0Vbab4hQpUyY69Jyh6Jlkt5
      qFsMoZ+zTcrerakwlZ6ocUD/XkbI1FIp5N2HBgOyUgVxgNrZeRkBw711WKhLkQZO
      YZz6yUc+0DziPxQ+be9SPoMmPEkX5fyxV7NihcoVZRAlwJyMYILI4EcNDNKsYlIw
      Sdsc9u3wiaf1mZPlAoLtAgMBAAGjUTBPMAsGA1UdDwQEAwIBhjAPBgNVHRMBAf8E
      BTADAQH/MB0GA1UdDgQWBBQ/1oiw5LyQuHw/tVSz584xWUoT4zAQBgkrBgEEAYI3
      FQEEAwIBADANBgkqhkiG9w0BAQsFAAOCAQEAbjNnnxOdDmE+/HzR6alvLIC+fEho
      FQ90PssLGI97VftUIT55uItQhJGHlKJpp1fWDCFJm3MCwiZHZwcuKEpyVQH5E4JY
      dkjRK8zLw+xGkreVxrH8d/tYiutb+gDoo1AxwLAvmgR2deMGMy+a/QjuUyNEpMVc
      /KuQhEj9FQGN6AaXSChALcuJ1fYljDKC/gEWzjqCa7iXN54Zp0VhjmSk/Iueyi+q
      1cztqBJTOpl5webjTUZ6zAQNVBRk9K2vwJdsWCM56ERnMq7/BjzOvFiH4tVeNKwI
      R3Ae7ym8D+ZQoW1CNYesV8/uS3IFQg6McomcA3kF1vMfQMJ1iLwDjmV3zg==
      -----END CERTIFICATE-----
    

    nodejsImageVersion: '1.0.3-APAR-PH01524'
    redisImageVersion: '1.0.3-APAR-PH01524'
    nodejs:
      image:
        pullPolicy: IfNotPresent
    redis:
      image:
        pullPolicy: IfNotPresent

    securityAuthConfig:

      # specify all groups for roles
      GROUP_ANALYST: 'CN=analysts,CN=Users,DC=aml,DC=ibm,DC=com'
      GROUP_INVESTIGATOR: 'CN=investigators,CN=Users,DC=aml,DC=ibm,DC=com'
      GROUP_SUPERVISOR: 'CN=supervisors,CN=Users,DC=aml,DC=ibm,DC=com'
      GROUP_ADMIN: 'CN=admins,CN=Users,DC=aml,DC=ibm,DC=com'
      GROUP_DATA_SCIENTIST: 'CN=datascientists,CN=Users,DC=aml,DC=ibm,DC=com'
      GROUP_EXECUTIVE: 'CN=executives,CN=Users,DC=aml,DC=ibm,DC=com'
      GROUP_QUALITY_ASSURANCE: 'CN=qualityassurance,CN=Users,DC=aml,DC=ibm,DC=com'
      GROUP_READ_ONLY: 'CN=readonly,CN=Users,DC=aml,DC=ibm,DC=com'
      GROUP_CONFIDENTIAL: 'CN=confidential,CN=Users,DC=aml,DC=ibm,DC=com'

      # specify internal user registry
      # for each numbered user, specify the user's id, roles, and password
      # roles are comma separated
      # valid roles include: admin, analyst, investigator, supervisor, data_scientist, confidential
      # password must be base64 encoded and preceded with '{base64}'
      # to add additional users, add additional user properties numbered 3, 4, etc.
      USER_ID_1: fciadmin
      USER_ROLES_1: admin,analyst
      USER_PASSWORD_1: '{base64}cGFzc3dvcmQ='
      USER_ID_2: fcianalyst
      USER_ROLES_2: analyst
      USER_PASSWORD_2: '{base64}cGFzc3dvcmQ='
      USER_ID_3: fciinvestigator
      USER_ROLES_3: investigator
      USER_PASSWORD_3: '{base64}cGFzc3dvcmQ='
      USER_ID_4: fcisupervisor
      USER_ROLES_4: supervisor
      USER_PASSWORD_4: '{base64}cGFzc3dvcmQ='
      USER_ID_5: fcidatascientist
      USER_ROLES_5: data_scientist
      USER_PASSWORD_5: '{base64}cGFzc3dvcmQ='
      USER_ID_6: fciconfidential
      USER_ROLES_6: confidential
      USER_PASSWORD_6: '{base64}cGFzc3dvcmQ='

      # set to true to use an internal registry
      # set to false to use LDAP registry
      INTERNAL_REGISTRY: 'false'

      # JWT configuration
      JWT_KEY_EXPIRY: '1d'
      # DO NOT CHANGE THIS VALUE:
      JWT_ISSUER: 'fci.ibm.com'

case-manager:
  # set to False to disable Case Manager
  # set to True otherwise
  enabled: True

  mq:
    image:
      tag: 1.0.3-APAR-PH01524
      pullPolicy: IfNotPresent
  liberty:
    image:
      tag: 1.0.3-APAR-PH01524
      pullPolicy: IfNotPresent

  libertyConfig:
    # set to server_ldap_actived.xml if the LDAP server is Active Directory
    # set to server_ldap_ids.xml if the LDAP server is IBM Directory Server
    # 
    # set to server_basic_registry.xml in a non-production environment 
    # where a basic registry is being used instead of LDAP
    com_fci_ldap_config: 'server_ldap_actived.xml'

cedm:
  # set to False to disable CEDM 
  # set to True otherwise
  enabled: True
  
  liberty:
    image:
      tag: 1.0.3-APAR-PH01524
      pullPolicy: IfNotPresent
  db2:
    image:
      tag: 1.0.3-APAR-PH01524
      pullPolicy: IfNotPresent
  nodejs:
    image:
      tag: 1.0.3-APAR-PH01524
      pullPolicy: IfNotPresent

rms:
  # set to False to disable RMS
  # set to True otherwise
  enabled: False

  image:
    tag: 1.0.3-APAR-PH01524
    pullPolicy: IfNotPresent

common-ui:
  nodejs:
    image:
      tag: 1.0.3-APAR-PH01524
      pullPolicy: IfNotPresent
  nginx:
    image:
      tag: 1.0.3-APAR-PH01524
      pullPolicy: IfNotPresent

  config:
    APP_ROLE_ANALYST: 'case-manager'
    APP_ROLE_INVESTIGATOR: 'case-manager'
    APP_ROLE_SUPERVISOR: 'case-manager'
    APP_ROLE_ADMIN: 'case-manager'
    APP_ROLE_DATA_SCIENTIST: 'case-manager'
    APP_ROLE_EXECUTIVE: 'case-manager'
    APP_ROLE_QUALITY_ASSURANCE: 'case-manager'
    APP_ROLE_READ_ONLY: 'case-manager'
    APP_ROLE_CONFIDENTIAL: 'case-manager'
