themis.yaml

## SPDX-FileCopyrightText: 2017 Comcast Cable Communications Management, LLC
## SPDX-License-Identifier: Apache-2.0
servers:
  key:
    address: :6500
    disableHTTPKeepAlives: true
    header:
      X-Midt-Server:
        - issuer
      X-Midt-Version:
        - development

  issuer:
    address: :6501
    disableHTTPKeepAlives: true
#   tls:
#     key: "/etc/themis/key.pem"
#     certificateFile: "/etc/themis/cert.pem"
    header:
      X-Midt-Server:
        - issuer
      X-Midt-Version:
        - development

  claims:
    address: :6502
    disableHTTPKeepAlives: true
    header:
      X-Midt-Server:
        - issuer
      X-Midt-Version:
        - development

  metrics:
    address: :6503
    disableHTTPKeepAlives: true

  health:
    address: :6504
    disableHTTPKeepAlives: true
    header:
      X-Midt-Server:
        - issuer
      X-Midt-Version:
        - development

health:
  disableLogging: false
  custom:
    server: development

prometheus:
  defaultNamespace: xmidt
  defaultSubsystem: issuer
  constLabels:
    development: "true"

token:
  alg: RS256
  nonce: true
  notBeforeDelta: -15s
  duration: 24h
  clientCertificates:
    # rootCAFile: "/path/to/bundle.pem"
    # intermediatesFile: "/path/to/bundle.pem"
    trust:
      # these trust values are just to illustrate what you can do
      # they are unique, so locally you can easily tell which case happened
      noCertificates: 10
      expiredUntrusted: 100
      expiredTrusted: 200
      untrusted: 900
      trusted: 1000

  claims:
    - key: mac
      header: X-Midt-Mac-Address
      parameter: mac
    - key: serial
      header: X-Midt-Serial-Number
      parameter: serial
    - key: uuid
      header: X-Midt-Uuid
      parameter: uuid
    - key: iss
      value: "development"
    - key: sub
      value: "client-supplied"
    - key: aud
      value: "XMiDT"
    - key: capabilities
      value:
        - x1:issuer:test:.*:all
    - key: nestedClaims
      json: '{
          "casePreservedScalar": "true",
          "casePreservedArray": ["casePreserved1", "casePreserved2"]
      }'
  metadata:
    - key: mac
      header: X-Midt-Mac-Address
      parameter: mac
    - key: serial
      header: X-Midt-Serial-Number
      parameter: serial
    - key: uuid
      header: X-Midt-Uuid
      parameter: uuid
  partnerID:
    claim: partner-id
    metadata: pid
    header: X-Midt-Partner-ID
    parameter: pid
    default: comcast
  key:
    kid: development
    type: rsa
    bits: 1024

log:
  outputPaths:
    - stdout
  errorOutputPaths:
    - stderr
  level: DEBUG
  encoding: json

# tracing provides configuration around traces using OpenTelemetry.
# (Optional). By default, a 'noop' tracer provider is used and tracing is disabled.
tracing:
  # provider is the name of the trace provider to use. Currently, otlp/grpc, otlp/http, stdout, jaeger and zipkin are supported.
  # 'noop' can also be used as provider to explicitly disable tracing.
  provider: "noop"

  # skipTraceExport only applies when provider is stdout. Set skipTraceExport to true
  # so that trace information is not written to stdout.
  # skipTraceExport: true

  # endpoint is where trace information should be routed. Applies to otlp, zipkin, and jaeger. OTLP/gRPC uses port 4317 by default.
  # OTLP/HTTP uses port 4318 by default.
  # endpoint: "http://localhost:9411/api/v2/spans"