akhq:
  connections:
    dev:
      properties:
        bootstrap.servers: "b-1.dev-managed-kafka-cdc.rk4es0.c11.kafka.us-east-1.amazonaws.com:9094,b-2.dev-managed-kafka-cdc.rk4es0.c11.kafka.us-east-1.amazonaws.com:9094,b-3.dev-managed-kafka-cdc.rk4es0.c11.kafka.us-east-1.amazonaws.com:9094"
        security.protocol: SSL
      schema-registry:
        url: "https://dev-schema-registry.dev.theorchard.io"
        type: confluent
      connect:
        - name: debezium-ats
          url: "https://dev-kafka-connect-debezium-ats.dev.theorchard.io"
        - name: es-sink
          url: "https://dev-kafka-connect-es-sink.dev.theorchard.io"
        - name: neo-sink-ats
          url: "https://dev-kafka-connect-neo-sink-ats.dev.theorchard.io"
        - name: sf-sink
          url: "https://dev-kafka-connect-sf-sink.dev.theorchard.io"
        - name: sf-sink-avro
          url: "https://dev-kafka-connect-sf-sink-avro.dev.theorchard.io"
        - name: sforce-sink
          url: "https://dev-kafka-connect-sforce-sink.dev.theorchard.io"
    artist_diy_dev:
      properties:
        bootstrap.servers: "b-1.dev-managed-kafka-arti.f45gcm.c7.kafka.us-east-1.amazonaws.com:9094,b-3.dev-managed-kafka-arti.f45gcm.c7.kafka.us-east-1.amazonaws.com:9094,b-2.dev-managed-kafka-arti.f45gcm.c7.kafka.us-east-1.amazonaws.com:9094"
        security.protocol: SSL

  security:
    roles:
      topic-read:
        - resources: [ "TOPIC", "TOPIC_DATA" ]
          actions: [ "READ" ]
        - resources: [ "TOPIC" ]
          actions: [ "READ_CONFIG" ]
      consumer-group-read:
        - resources: [ "CONSUMER_GROUP" ]
          actions: [ "READ" ]
      misc-read:
        - resources: [ "SCHEMA", "CONNECT_CLUSTER", "CONNECTOR", "NODE" ]
          actions: [ "READ" ]
      topic-admin:
        - resources: [ "TOPIC", "TOPIC_DATA" ]
          actions: [ "READ", "CREATE", "DELETE" ]
        - resources: [ "TOPIC" ]
          actions: [ "UPDATE", "READ_CONFIG", "ALTER_CONFIG" ]
      consumer-group-admin:
        - resources: [ "CONSUMER_GROUP" ]
          actions: [ "READ", "UPDATE_OFFSET", "DELETE_OFFSET" ]
    default-group: no-roles
    groups:
      power-users:
        - role: topic-admin
        - role: consumer-group-admin
        - role: misc-read
      users:
        - role: topic-read
        - role: consumer-group-read
        - role: misc-read

    basic-auth:
      - username: adminuser
        password: "50d2a2efba151f8dd7fd6de5a7f56fc458dcaa7c63abf92c1e851a31de01c012"
        passwordHash: SHA256
        groups:
          - admin
      - username: poweruser
        password: "50d2a2efba151f8dd7fd6de5a7f56fc458dcaa7c63abf92c1e851a31de01c012"
        passwordHash: SHA256
        groups:
          - power-users
      - username: regularuser
        password: "50d2a2efba151f8dd7fd6de5a7f56fc458dcaa7c63abf92c1e851a31de01c012"
        passwordHash: SHA256
        groups:
          - users

    oidc:
      enabled: false
    data-masking:
      filters:
        - description: "Mask email"
          search-regex: '"email":[ ]?"(.{1})(?:.*?)@(?:.+?)\.(.+?)"'
          replacement: '"email": "$1[MASKED]@[MASKED].$2"'
        - description: "Mask firstName, lastName, token"
          search-regex: '"(firstName|lastName|token)":[ ]?"(?:.*?)"'
          replacement: '"$1": "[MASKED]"'

micronaut:
  security:
    enabled: true
    oauth2:
      enabled: true
      callback-uri: "https://qa-akhq.theorchard.io/oauth/callback{/provider}"
    endpoints:
      logout:
        get-allowed: true
    token:
      jwt:
        enabled: true
        cookie:
          enabled: true
        generator:
          access-token:
            expiration: 43200
        signatures:
          secret:
            generator:
              secret: "7600bc6a39b79d1d4b197397f30d13ecb16c5f0c2d87ae62e0348df6a998a7ca"