#
# Copyright (c) 2012-2024 Red Hat, Inc.
# This program and the accompanying materials are made
# available under the terms of the Eclipse Public License 2.0
# which is available at https://www.eclipse.org/legal/epl-2.0/
#
# SPDX-License-Identifier: EPL-2.0
#
# Contributors:
#   Red Hat, Inc. - initial API and implementation
#

# {orch-name}: Kubernetes or OpenShift
# {prod-short}: Eclipse Che

### {prod-short} server

# API service. Browsers initiate REST communications to {prod-short} server with this URL.
che.api=http://${CHE_HOST}:${CHE_PORT}/api

# API service internal network URL. Back-end services should initiate REST communications to {prod-short} server with this URL.
che.api.internal=NULL

# {prod-short} WebSocket major endpoint. Provides basic communication endpoint
# for major WebSocket interactions and messaging.
che.websocket.endpoint=ws://${CHE_HOST}:${CHE_PORT}/api/websocket

# {prod-short} WebSocket major internal endpoint. Provides basic communication endpoint
# for major WebSocket interactions and messaging.
che.websocket.internal.endpoint=NULL

# HTTP proxy setting for workspace JVM.
che.workspace.http_proxy_java_options=NULL

# Java command line options added to JVMs running in workspaces.
che.workspace.java_options=-XX:MaxRAM=150m -XX:MaxRAMFraction=2 -XX:+UseParallelGC -XX:MinHeapFreeRatio=10 -XX:MaxHeapFreeRatio=20 -XX:GCTimeRatio=4 -XX:AdaptiveSizePolicyWeight=90 -Dsun.zip.disableMemoryMapping=true -Xms20m -Djava.security.egd=file:/dev/./urandom

# Maven command line options added to JVMs running agents in workspaces.
che.workspace.maven_options=-XX:MaxRAM=150m -XX:MaxRAMFraction=2 -XX:+UseParallelGC -XX:MinHeapFreeRatio=10 -XX:MaxHeapFreeRatio=20 -XX:GCTimeRatio=4 -XX:AdaptiveSizePolicyWeight=90 -Dsun.zip.disableMemoryMapping=true -Xms20m -Djava.security.egd=file:/dev/./urandom

# RAM limit default for each machine that has no RAM settings in its environment.
# Value less than or equal to `0` is interpreted as disabling the limit.
che.workspace.default_memory_limit_mb=1024

# RAM request for each container that has no explicit RAM settings in its environment.
# This amount is allocated when the workspace container is created.
# This property may not be supported by all infrastructure implementations.
# Currently it is supported by {orch-name}.
# A memory request exceeding the memory limit is ignored, and only the limit size is used.
# Value less than or equal to `0` is interpreted as disabling the limit.
che.workspace.default_memory_request_mb=200

# CPU limit for each container that has no CPU settings in its environment.
# Specify it either in floating point cores or in integer millicores, for example: `0.125` or `125m`.
# Value less than or equal to `0` is interpreted as disabling the limit.
che.workspace.default_cpu_limit_cores=-1

# CPU request for each container that has no CPU settings in its environment.
# A CPU request exceeding the CPU limit is ignored and only the limit number is used.
# Value less than or equal to `0` is interpreted as disabling the limit.
che.workspace.default_cpu_request_cores=-1

# RAM limit for each sidecar that has no RAM settings in the {prod-short} plug-in configuration.
# Value less than or equal to `0` is interpreted as disabling the limit.
che.workspace.sidecar.default_memory_limit_mb=128

# RAM request for each sidecar that has no RAM settings in the {prod-short} plug-in configuration.
che.workspace.sidecar.default_memory_request_mb=64

# CPU limit default for each sidecar that has no CPU settings in the {prod-short} plug-in configuration.
# Specify it either in floating point cores or in integer millicores, for example: `0.125` or `125m`.
# Value less than or equal to `0` is interpreted as disabling the limit.
che.workspace.sidecar.default_cpu_limit_cores=-1

# CPU request default for each sidecar that has no CPU settings in the {prod-short} plug-in configuration.
# Specify it either in floating point cores or in integer millicores, for example: `0.125` or `125m`.
che.workspace.sidecar.default_cpu_request_cores=-1

# Delay before the first execution of a temporary workspaces cleanup job.
che.workspace.cleanup_temporary_initial_delay_min=5

# Delay between the termination of one execution and the commencement
# of the next execution of temporary workspaces cleanup job.
che.workspace.cleanup_temporary_period_min=180

# List of names of the servers that require liveness probes.
che.workspace.server.liveness_probes=wsagent/http,exec-agent/http,terminal,theia,jupyter,dirigible,cloud-shell,intellij

# Limits the size of logs collected from a single container that can be observed by {prod-short} server when
# debugging workspace startup.
# The default is: 10MB=10485760.
che.workspace.startup_debug_log_limit_bytes=10485760

# Specifies whether {prod-short} is deployed with DevWorkspaces enabled.
# This property is set by the {prod-short} Operator if it also installed the support for DevWorkspaces.
# This property is used to advertise this fact to the {prod-short} dashboard.
# It doesn't make sense to change the value of this property manually.
che.devworkspaces.enabled=false

### Authentication parameters

# {prod-short} has a single identity implementation, so this does not change the user experience.
# If set to `true`, enables user creation at the API level.
che.auth.user_self_creation=false

# Authentication error page address.
che.auth.access_denied_error_page=/error-oauth

# Reserved user names.
che.auth.reserved_user_names=

# Configuration of the Azure DevOps Service OAuth2 client. Used to obtain personal access tokens.
# Location of the file with Azure DevOps Service Application ID.
che.oauth2.azure.devops.clientid_filepath=NULL

# Location of the file with Azure DevOps Service Client Secret.
che.oauth2.azure.devops.clientsecret_filepath=NULL

# Azure DevOps Service OAuth2 scopes.
# Separate multiple values with comma, for example: scope,scope,scope
# The full list of scopes: https://learn.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/oauth?view=azure-devops#scopes
che.integration.azure.devops.application_scopes=vso.code_write

# Azure DevOps Service OAuth2 authorization URI.
che.oauth.azure.devops.authuri=https://app.vssps.visualstudio.com/oauth2/authorize

# Azure DevOps OAuth Service token URI.
che.oauth.azure.devops.tokenuri=https://app.vssps.visualstudio.com/oauth2/token

# Azure DevOps Service API server address.
che.integration.azure.devops.api_endpoint=https://vssps.dev.azure.com

# Azure DevOps SCM API server address.
che.integration.azure.devops.scm.api_endpoint=https://dev.azure.com

# Azure DevOps Service redirect URIs.
# Separate multiple values with comma, for example: URI,URI,URI.
che.oauth.azure.devops.redirecturis=https://${CHE_HOST}/api/oauth/callback

# Configuration of the GitHub OAuth2 client. Used to obtain personal access tokens.
# Location of the file with GitHub client id.
che.oauth2.github.clientid_filepath=NULL

# Configuration of the GitHub OAuth2 client. Used to obtain personal access tokens.
# Location of the file with GitHub client id (The second GitHub instance).
che.oauth2.github.clientid_filepath_2=NULL

# Location of the file with GitHub client secret.
che.oauth2.github.clientsecret_filepath=NULL

# Location of the file with GitHub client secret (The second GitHub instance).
che.oauth2.github.clientsecret_filepath_2=NULL

# GitHub OAuth authorization URI.
che.oauth.github.authuri= https://github.com/login/oauth/authorize

# GitHub OAuth authorization URI (The second GitHub instance).
che.oauth.github.authuri_2= https://github.com/login/oauth/authorize

# GitHub OAuth token URI.
che.oauth.github.tokenuri= https://github.com/login/oauth/access_token

# GitHub OAuth token URI (The second GitHub instance).
che.oauth.github.tokenuri_2= https://github.com/login/oauth/access_token

# GitHub server address.
# Prerequisite: OAuth 2 integration is configured on the GitHub server.
che.integration.github.oauth_endpoint=NULL

# GitHub server address.
# Prerequisite: OAuth 2 integration is configured on the GitHub server (The second GitHub instance).
che.integration.github.oauth_endpoint_2=NULL

# GitHub server disable subdomain isolation flag.
che.integration.github.disable_subdomain_isolation=false

# GitHub server disable subdomain isolation flag (The second GitHub instance).
che.integration.github.disable_subdomain_isolation_2=false

# GitHub OAuth redirect URIs.
# Separate multiple values with comma, for example: URI,URI,URI.
che.oauth.github.redirecturis= http://localhost:${CHE_PORT}/api/oauth/callback

# Configuration of OpenShift OAuth client. Used to obtain OpenShift OAuth token.
# OpenShift OAuth client ID.
che.oauth.openshift.clientid=NULL
# OpenShift OAuth client secret.
che.oauth.openshift.clientsecret=NULL
# OpenShift OAuth endpoint.
che.oauth.openshift.oauth_endpoint= NULL
# OpenShift OAuth verification token URL.
che.oauth.openshift.verify_token_url= NULL

# Configuration of Bitbucket Server OAuth1 client. Used to obtain personal access tokens.
# Location of the file with Bitbucket Server application consumer key (equivalent to a username).
che.oauth1.bitbucket.consumerkeypath=NULL
# Location of the file with Bitbucket Server application private key.
che.oauth1.bitbucket.privatekeypath=NULL
# Bitbucket Server URL. To work correctly with factories, the same URL
# has to be part of `che.integration.bitbucket.server_endpoints` too.
che.oauth.bitbucket.endpoint=https://bitbucket.org

# Configuration of Bitbucket OAuth2 client. Used to obtain Personal access tokens.
# Location of the file with Bitbucket client id.
che.oauth2.bitbucket.clientid_filepath=NULL

# Location of the file with Bitbucket client secret.
che.oauth2.bitbucket.clientsecret_filepath=NULL

# Bitbucket OAuth authorization URI.
che.oauth.bitbucket.authuri= https://bitbucket.org/site/oauth2/authorize

# Bitbucket OAuth token URI.
che.oauth.bitbucket.tokenuri= https://bitbucket.org/site/oauth2/access_token

# Bitbucket OAuth redirect URIs.
# Separate multiple values with comma, for example: URI,URI,URI
che.oauth.bitbucket.redirecturis= https://${CHE_HOST}/api/oauth/callback

### Internal

# {prod-short} extensions can be scheduled executions on a time basis.
# This value configures the size of the thread pool allocated to extensions that are launched on
# a recurring schedule.
schedule.core_pool_size=10

# Database initialization and migration configuration.
# If set to `true`, the database initialization component on {prod-short} Server side ignores scripts up to the version configured by `baseline.version`.
db.schema.flyway.baseline.enabled=true

# Scripts with a version up to the specified one are ignored.
# Note that scripts with a version equal to the baseline version are also ignored.
db.schema.flyway.baseline.version=5.0.0.8.1

# Prefix of migration scripts.
db.schema.flyway.scripts.prefix=

# Suffix of migration scripts.
db.schema.flyway.scripts.suffix=.sql

# Separator of `version` from the other parts of script name.
db.schema.flyway.scripts.version_separator=__

# Locations where to search for migration scripts.
db.schema.flyway.scripts.locations=classpath:che-schema

### Kubernetes infrastructure parameters

# Configuration of Kubernetes Client master URL that the infrastructure uses.
che.infra.kubernetes.master_url=

# Boolean to configure Kubernetes Client to use trusted certificates.
che.infra.kubernetes.trust_certs=false

# Kubernetes cluster domain. If not set, svc names doesn't contain information about the cluster domain.
che.infra.kubernetes.cluster_domain=NULL

# Defines how servers are exposed to the world in Kubernetes infra.
# Options include: `default-host`, `multi-host`, `single-host`.
che.infra.kubernetes.server_strategy=multi-host

# Defines the way in which the workspace plug-ins and editors are exposed in the single-host mode.
# Supported exposures:
# `native`:: Exposes servers using Kubernetes Ingresses. Works only on Kubernetes.
# `gateway`:: Exposes servers using reverse-proxy gateway.
che.infra.kubernetes.singlehost.workspace.exposure=native

# Defines the way to expose devfile endpoints as end-user's applications, in single-host server strategy.
# They can either follow the single-host strategy and be exposed on subpaths, or they can be exposed on subdomains.
# Supported exposures:
# `multi-host`:: Exposes devfile endpoints on subdomains.
# `single-host`:: Exposes devfile endpoints on subpaths.
che.infra.kubernetes.singlehost.workspace.devfile_endpoint_exposure=multi-host

# Defines labels which are set to ConfigMaps configuring single-host gateway.
che.infra.kubernetes.singlehost.gateway.configmap_labels=app=che,component=che-gateway-config

# Generates a domain for a server in a workspace in case the property `che.infra.kubernetes.server_strategy` is set to `multi-host`
che.infra.kubernetes.ingress.domain=

# Indicates whether {prod-short} server is allowed to create {orch-namespace} for user
# workspaces, or they're intended to be created manually by cluster administrator.
# This property is also used by OpenShift infrastructure.
che.infra.kubernetes.namespace.creation_allowed=true

# Defines Kubernetes default namespace in which user's workspaces are created
# if user does not override it.
# Use placeholder variables like `<username>` and `<userid>`. For example: `che-workspace-<username>`.
# This ensures that a new namespace is created for each user, so that their workspaces do not collide with other users.
# Used by OpenShift infrastructure to specify a Project.
# The `<username>` or `<userid>` placeholder is mandatory.
che.infra.kubernetes.namespace.default=<username>-che

# Defines whether {prod-short} server should try to label the workspace namespaces.
# NOTE: It's strongly recommended you keep the value of this property set to `true`. If set to `false`, the new workspace namespaces will not be labeled
# automatically, and therefore not recognized by the {prod-operator-image-name} causing some features of DevWorkspaces to not work.
# If set to `false`, an administrator is required to label the namespaces manually using the labels specified in `che.infra.kubernetes.namespace.labels`.
# If you want to manage the namespaces yourself, make sure to follow this guide:
# https://www.eclipse.org/che/docs/stable/administration-guide/provisioning-namespaces-in-advance/.
# Any additional labels present on the namespace are kept in place and do not affect the functionality.
# Also note that the the administrator is free to pre-create and label the namespaces manually even if this property is
# `true`. No updates to the namespaces are done if they already conform to the labeling requirements.
che.infra.kubernetes.namespace.label=true

# Defines whether {prod-short} server should try to annotate the workspace namespaces.
che.infra.kubernetes.namespace.annotate=true

# List of labels to find {orch-namespace} that are used for {prod-short} Workspaces.
# They are used to:
#  - Find prepared {orch-namespace} for users in combination with `che.infra.kubernetes.namespace.annotations`.
#  - Actively label {orch-namespace} with any workspace.
# NOTE: It's strongly recommended not to change the value of this property because the {prod-operator-image-name} relies on these labels 
# and their precise values when reconciling DevWorkspaces. If this configuration is changed, the namespaces will not be automatically
# recognized by the {prod-operator-image-name} as workspace namespaces unless manually labeled as such using the default labels and values.
# Additional labels on the namespace do not affect the functionality.
che.infra.kubernetes.namespace.labels=app.kubernetes.io/part-of=che.eclipse.org,app.kubernetes.io/component=workspaces-namespace

# List of annotations to find {orch-namespace} prepared for {prod-short} user workspaces.
# Only {orch-namespace} matching the `che.infra.kubernetes.namespace.labels` is matched against these annotations.
# {orch-namespace} that matches both `che.infra.kubernetes.namespace.labels` and `che.infra.kubernetes.namespace.annotations`
# is used preferentially for user workspaces.
# It's possible to use `<username>` placeholder to specify the {orch-namespace} to concrete user.
# They are used to:
#  - Find prepared {orch-namespace} for users in combination with `che.infra.kubernetes.namespace.labels`.
#  - Actively annotate {orch-namespace} with any workspace.
che.infra.kubernetes.namespace.annotations=che.eclipse.org/username=<username>

# Defines Kubernetes Service Account name which should be specified to be bound to all workspace pods.
# The {prod-short} Operator that Kubernetes infrastructure will not create the service account and it should exist.
# OpenShift infrastructure checks if project exists and `che.infra.openshift.project` isn't empty:
#  - If not 'NULL', then service account must exist there.
#  - If it's 'NULL' or an empty string, then infrastructure creates new OpenShift project per workspace
#    and prepare workspace service account with needed roles there.
che.infra.kubernetes.service_account_name=NULL

# Specifies optional additional cluster roles to use with the workspace service account.
# The {prod-short} Operator that the cluster role names must already exist and the {prod-short} service account needs to be able to create a Role Binding
# to associate these cluster roles with the workspace service account. The names are comma separated.
# This property deprecates `che.infra.kubernetes.cluster_role_name`.
che.infra.kubernetes.workspace_sa_cluster_roles=NULL

# Cluster roles to assign to user in their namespace.
che.infra.kubernetes.user_cluster_roles=NULL

# Defines the timeout (in minutes) that limits the period for which {orch-ingress} becomes ready.
che.infra.kubernetes.ingress_start_timeout_min=5

# If an unrecoverable event defined in the property occurs during workspace startup,
# this parameter stops the workspace immediately rather than waiting until timeout.
# Do not include a simple "Failed" string, as that might catch more events than than intended.
# A failed container startup is handled explicitly by {prod-short} server.
che.infra.kubernetes.workspace_unrecoverable_events=FailedMount,FailedScheduling,MountVolume.SetUp failed,Failed to pull image,FailedCreate,ReplicaSetCreateError

# Defines annotations for ingresses which are used for servers exposing. Value depends on the kind of ingress
# controller.
# OpenShift infrastructure ignores this property because it uses Routes rather than Ingresses.
# the {prod-short} Operator that for a single-host deployment strategy to work, a controller supporting URL rewriting has to be
# used so that URLs can point to different servers while the servers do not need to support changing the app root.
# The `che.infra.kubernetes.ingress.path.rewrite_transform` property defines how the path of the Ingress should be
# transformed to support the URL rewriting. 
# This property defines the set of annotations on the Ingress itself
# that instruct the chosen Ingress Controller to actually do the URL rewriting, potentially building on the path
# transformation (if required by the chosen ingress controller).
# For example, for Nginx Ingress Controller 0.22.0 and later, the following value is recommended:
# `{"ingress.kubernetes.io/rewrite-target": "/$1","ingress.kubernetes.io/ssl-redirect": "false",\
#     "ingress.kubernetes.io/proxy-connect-timeout": "3600","ingress.kubernetes.io/proxy-read-timeout": "3600",
#     "nginx.org/websocket-services": "<service-name>"}`
# and the `che.infra.kubernetes.ingress.path.rewrite_transform` should be set to `"%s(.*)"`.
# For Nginx Ingress Controller older than 0.22.0, the rewrite-target should be set to `/` and the path transformed
# to `%s` (see the `che.infra.kubernetes.ingress.path.rewrite_transform` property).
# See the Nginx Ingress Controller documentation for the explanation on how the Ingress Controller uses
# the regular expression available in the Ingress path and how it achieves the rewriting of URL.
che.infra.kubernetes.ingress.annotations_json=NULL

# Defines a recipe on how to declare the path of the Ingress that should expose a server.
# The `%s` represents the base public URL of the server and is guaranteed to end with a forward slash. This property
# must be a valid input to the `String.format()` method and contain exactly one reference to `%s`.
# See the description of the `che.infra.kubernetes.ingress.annotations_json` property to see how these two
# properties interplay when specifying the Ingress annotations and path.
# If not defined, this property defaults to `%s` (without the quotes) which means that the path is not transformed
# for use with the Ingress Controller.
che.infra.kubernetes.ingress.path_transform=NULL

# Additional labels to add into every Ingress created by {prod-short} server
# to allow clear identification.
che.infra.kubernetes.ingress.labels=NULL

# Defines security context for pods that is created by Kubernetes infrastructure.
# This property is ignored by OpenShift infrastructure.
che.infra.kubernetes.pod.security_context.run_as_user=NULL

# Defines security context for pods that are created by Kubernetes infrastructure.
# A special supplemental group that applies to all containers in a pod.
# This property is ignored by OpenShift infrastructure.
che.infra.kubernetes.pod.security_context.fs_group=NULL

# Defines the grace termination period for pods that are created by {orch-name} infrastructures.
# The default value is `0`. It allows to stop pods quickly and significantly decreases the time required for stopping a workspace.
# In the case of the {prod-short} Operator, if `terminationGracePeriodSeconds` have been explicitly set in {orch-name} recipe, it isn't overridden.
che.infra.kubernetes.pod.termination_grace_period_sec=0

# Creates Ingresses with Transport Layer Security (TLS) enabled.
# In OpenShift infrastructure, Routes are TLS-enabled.
che.infra.kubernetes.tls_enabled=false

# The name of a secret that should be used when creating workspace Ingresses with TLS.
# This property is ignored by OpenShift infrastructure.
che.infra.kubernetes.tls_secret=

# Data for TLS Secret that should be used for workspace Ingresses.
# The `cert` and `key` values should be encoded with Base64 algorithm.
# These properties are ignored by OpenShift infrastructure.
che.infra.kubernetes.tls_key=NULL

# Certificate data for TLS secret that should be used for workspace Ingresses.
# The certificate should be encoded with Base64 algorithm.
# This property is ignored by OpenShift infrastructure.
che.infra.kubernetes.tls_cert=NULL

# Defines the period with which runtimes consistency checks are performed.
# If the runtime has an inconsistent state, it's stopped automatically.
# The value must be more than 0 or `-1`, where `-1` means that checks aren't performed at all.
# It's disabled by default because there is a possible {prod-short} server configuration when {prod-short} server
# doesn't have the ability to interact with Kubernetes API when operation is not invoked by the user.
#
# It works with the following configurations:
# - Workspaces objects are created in the same namespace where {prod-short} server is located.
# - The `cluster-admin` service account token is mounted to {prod-short} server pod.
#
# It doesn't work with the following configuration:
# - {prod-short} server communicates with Kubernetes API using the token from OAuth provider.
che.infra.kubernetes.runtimes_consistency_check_period_min=-1


# Name of the ConfigMap in {prod-short} server namespace with additional CA TLS certificates to be propagated into all user workspaces.
# If the property is set on OpenShift 4 infrastructure, and `che.infra.openshift.trusted_ca.dest_configmap_labels` includes the `config.openshift.io/inject-trusted-cabundle=true` label, then cluster CA bundle is propagated too.
che.infra.kubernetes.trusted_ca.src_configmap=NULL

# Name of the ConfigMap in a workspace namespace with additional CA TLS certificates.
# Holds the copy of `che.infra.kubernetes.trusted_ca.src_configmap` but in a workspace namespace.
# Content of this ConfigMap is mounted into all workspace containers including plug-in brokers.
# Do not change the ConfigMap name unless it conflicts with an already existing ConfigMap.
# The {prod-short} Operator that the resulting ConfigMap names can be adjusted eventually to make it unique in {orch-namespace}.
# The original name is stored in `che.original_name` label.
che.infra.kubernetes.trusted_ca.dest_configmap=ca-certs

# Configures path on workspace containers where the CA bundle should be mounted.
# Content of ConfigMap specified by `che.infra.kubernetes.trusted_ca.dest_configmap` is mounted.
che.infra.kubernetes.trusted_ca.mount_path=/public-certs

# Comma separated list of labels to add to the CA certificates ConfigMap in user workspace.
# See the `che.infra.kubernetes.trusted_ca.dest_configmap` property.
che.infra.kubernetes.trusted_ca.dest_configmap_labels=


### OpenShift infrastructure parameters

# Comma separated list of labels to add to the CA certificates ConfigMap in user workspace.
# See `che.infra.kubernetes.trusted_ca.dest_configmap` property.
# This default value is used for automatic cluster CA bundle injection in OpenShift 4.
che.infra.openshift.trusted_ca.dest_configmap_labels=config.openshift.io/inject-trusted-cabundle=true

# Additional labels to add into every Route created by {prod-short} server to allow clear identification.
che.infra.openshift.route.labels=NULL

# The hostname that should be used as a suffix for the workspace routes.
# For example: Using `domain_suffix=__<{che-host}>__`, the route resembles: `routed3qrtk.__<{che-host}>__`.
# It must be a valid DNS name.
che.infra.openshift.route.host.domain_suffix=NULL

# Initialize OpenShift project with {prod-short} server's service account
# if OpenShift OAuth is enabled.
che.infra.openshift.project.init_with_server_sa=true

### Experimental properties

# The following properties are subject to changes and removal, do not rely on them in a stable {prod-short} instance.

# Docker image of {prod-short} plug-in broker app that resolves workspace tools configuration and copies plug-in dependencies to a workspace.
# The {prod-short} Operator overrides these images by default. Changing the images here doesn't
# have an effect if {prod-short} is installed using the Operator.
che.workspace.plugin_broker.metadata.image=quay.io/eclipse/che-plugin-metadata-broker:v3.4.0

# Docker image of Che plug-in artifacts broker.
# This broker runs as an init container on the workspace pod. Its job is to take in a list of plug-in identifiers
# (either references to a plug-in in the registry or a link to a plug-in `meta.yaml`) and ensure that the correct `.vsix`
# and `.theia` extensions are downloaded into the `/plugins directory`, for each plug-in requested for the workspace.
che.workspace.plugin_broker.artifacts.image=quay.io/eclipse/che-plugin-artifacts-broker:v3.4.0

# Configures the default behavior of the plug-in brokers when provisioning plug-ins for a workspace.
# If set to `true`, the plug-in brokers attempt to merge plug-ins when possible: they run in
# the same sidecar image and do not have conflicting settings. This value is the default setting
# used when the devfile doesn't specify the `mergePlugins` attribute.
che.workspace.plugin_broker.default_merge_plugins=false

# Docker image of {prod-short} plug-in broker app that resolves workspace tools configuration and copies
# plug-in dependencies to a workspace.
che.workspace.plugin_broker.pull_policy=Always

# Defines the timeout in minutes that limits the max period of result waiting for plug-in broker.
che.workspace.plugin_broker.wait_timeout_min=3

# Workspace plug-in registry endpoint. Should be a valid HTTP URL.
# Example: `++http://che-plugin-registry-eclipse-che.192.168.65.2.nip.io++`
# In case the {prod-short} plug-in registry isn't needed, use the value 'NULL'.
che.workspace.plugin_registry_url=https://che-plugin-registry.prod-preview.openshift.io/v3

# Workspace plug-in registry internal endpoint. Should be a valid HTTP URL.
# Example: `++http://devfile-registry.che.svc.cluster.local:8080++`
# In case the {prod-short} plug-in registry isn't needed, use the value 'NULL'.
che.workspace.plugin_registry_internal_url=NULL

# Devfile registry endpoint. Should be a valid HTTP URL.
# Example: `++http://che-devfile-registry-eclipse-che.192.168.65.2.nip.io++`
# In case the {prod-short} plug-in registry isn't needed, use the value 'NULL'.
che.workspace.devfile_registry_url=https://che-devfile-registry.prod-preview.openshift.io/

# Devfile registry "internal" endpoint. Should be a valid HTTP URL.
# Example: `++http://plugin-registry.che.svc.cluster.local:8080++`
# In case the {prod-short} plug-in registry isn't needed, use the value 'NULL'.
che.workspace.devfile_registry_internal_url=NULL

# The configuration property that defines available values for storage types that clients such as the Dashboard should propose to users during workspace creation and update.
# Following values are available:
#   - `persistent`: Persistent Storage slow I/O but persistent.
#   - `ephemeral`: Ephemeral Storage allows for faster I/O but may have limited storage
#       and is not persistent.
#   - `async`: Experimental feature: Asynchronous storage is a combination of Ephemeral
#       and Persistent storage. Allows for faster I/O and keep your changes, backs up on stop
#       and restores on start workspace.
#       Works only with following values:
#           - `che.infra.kubernetes.pvc.strategy='common'`
#           - `che.limits.user.workspaces.run.count=1`
#           - `che.infra.kubernetes.namespace.default` contains `<username>`,
#      in other cases remove `async` from the list.
che.workspace.storage.available_types=persistent,ephemeral,async

# The configuration property that defines a default value for storage type that clients, such as the Dashboard, should propose to users during workspace creation and update.
# The `async` value is an experimental feature not recommended as the default type.
che.workspace.storage.preferred_type=persistent

# Configures in which way secure servers are protected with authentication.
# Suitable values:
#   - `default`: `jwtproxy` is configured in a pass-through mode. Servers should authenticate requests themselves.
#   - `jwtproxy`: `jwtproxy` authenticates requests. Servers only receive authenticated requests.
che.server.secure_exposer=jwtproxy

# `Jwtproxy` issuer string, token lifetime, and optional auth page path to route unsigned requests to.
che.server.secure_exposer.jwtproxy.token.issuer=wsmaster

# JWTProxy issuer token lifetime.
che.server.secure_exposer.jwtproxy.token.ttl=8800h

# Optional authentication page path to route unsigned requests to.
che.server.secure_exposer.jwtproxy.auth.loader.path=/_app/loader.html

# JWTProxy image.
che.server.secure_exposer.jwtproxy.image=quay.io/eclipse/che-jwtproxy:0.10.0

# JWTProxy memory request.
che.server.secure_exposer.jwtproxy.memory_request=15mb

# JWTProxy memory limit.
che.server.secure_exposer.jwtproxy.memory_limit=128mb

# JWTProxy CPU request.
che.server.secure_exposer.jwtproxy.cpu_request=0.03

# JWTProxy CPU limit.
che.server.secure_exposer.jwtproxy.cpu_limit=0.5

### Configuration of the major WebSocket endpoint

# Maximum size of the JSON RPC processing pool.
# If pool size is exceeded, the message execution is rejected.
che.core.jsonrpc.processor_max_pool_size=50

# Initial JSON processing pool. Minimum number of threads used to process major JSON RPC messages.
che.core.jsonrpc.processor_core_pool_size=5

# Configuration of the queue used to process JSON RPC messages.
che.core.jsonrpc.processor_queue_capacity=100000


# Port the HTTP server endpoint that would be exposed with Prometheus metrics.
che.metrics.port=8087

### CORS settings

# Indicates which request origins are allowed.
# CORS filter on WS Master is turned off by default.
# Use the environment variable "CHE_CORS_ENABLED=true" to turn it on.
che.cors.allowed_origins=*

# Indicates if CORS allows processing of requests with credentials located in cookies, headers, and TLS client certificates.
che.cors.allow_credentials=false

### Factory defaults

# Editor and plug-in used for factories that are created from a remote Git repository
# which doesn't contain any {prod-short}-specific workspace descriptor.
# Multiple plug-ins must be comma-separated, for example:
# `pluginFooPublisher/pluginFooName/pluginFooVersion,pluginBarPublisher/pluginBarName/pluginBarVersion`
che.factory.default_plugins=redhat/vscode-commons/latest

# Devfile filenames to look on repository-based factories, for example GitHub.
# Factory tries to locate those files in the order they're enumerated in the property.
che.factory.default_devfile_filenames=devfile.yaml,.devfile.yaml

### Devfile defaults
# Editor used for factories that are created from a remote Git repository
# which doesn't contain any {prod-short}-specific workspace descriptor.
che.factory.default_editor=eclipse/che-theia/latest

# File size limit for the URL fetcher which fetches files from the SCM repository.
che.factory.scm_file_fetcher_limit_bytes=102400

# Additional files which may be present in the repository to complement devfile v2.
# To retrieve them in a factory, they should be referenced as links to SCM resolver service.
che.factory.devfile2_files_resolution_list=.che/che-editor.yaml,.che/che-theia-plugins.yaml,.vscode/extensions.json

# Default editor that should be provisioned into Devfile if there is no specified editor.
# The format is `editorPublisher/editorName/editorVersion` value.
# A `NULL` or absence of value means that default editor should not be provisioned.
che.workspace.devfile.default_editor=eclipse/che-theia/latest

# Default plug-ins which should be provisioned for the default editor.
# All plug-ins from this list that aren't explicitly mentioned in the user-defined devfile
# are provisioned but only when the default editor is used or if the user-defined editor is
# the same as the default one (even if in different version).
# The format is comma-separated `pluginPublisher/pluginName/pluginVersion` values, and URLs. 
# For example: `eclipse/che-theia-exec-plugin/0.0.1,eclipse/che-theia-terminal-plugin/0.0.1,https://cdn.pluginregistry.com/vi-mode/meta.yaml`
# If the plug-in is a URL, the plug-in's `meta.yaml` is retrieved from that URL.
che.workspace.devfile.default_editor.plugins=NULL

# Defines comma-separated list of labels for selecting secrets from a user namespace
# which are mounted into workspace containers as files or environment variables.
# Only secrets that match ALL given labels are selected.
che.workspace.provision.secret.labels=app.kubernetes.io/part-of=che.eclipse.org,app.kubernetes.io/component=workspace-secret

# Plug-in is added in case the asynchronous storage feature is enabled in workspace configuration
# and supported by the environment.
che.workspace.devfile.async.storage.plugin=eclipse/che-async-pv-plugin/latest

# Bitbucket endpoints used for factory integrations.
# A comma separated list of Bitbucket server URLs or `NULL` if no integration is expected.
che.integration.bitbucket.server_endpoints=NULL

# GitLab endpoints used for factory integrations.

# The address of the GitLab server with configured OAuth 2 integration.
che.integration.gitlab.oauth_endpoint=NULL

# The address of the GitLab server with configured OAuth 2 integration. (The second GitLab instance).
che.integration.gitlab.oauth_endpoint_2=NULL

# Configuration of GitLab OAuth2 client. Used to obtain personal access tokens.
# Location of the file with GitLab client ID.
che.oauth2.gitlab.clientid_filepath=NULL

# Configuration of GitLab OAuth2 client. Used to obtain personal access tokens.
# Location of the file with GitLab client ID. (The second GitLab instance).
che.oauth2.gitlab.clientid_filepath_2=NULL

# Location of the file with GitLab client secret.
che.oauth2.gitlab.clientsecret_filepath=NULL

# Location of the file with GitLab client secret. (The second GitLab instance).
che.oauth2.gitlab.clientsecret_filepath_2=NULL

### Advanced authorization
# Comma separated list of users allowed to access Che.
che.infra.kubernetes.advanced_authorization.allow_users=NULL

# Comma separated list of groups of users allowed to access Che.
che.infra.kubernetes.advanced_authorization.allow_groups=NULL

# Comma separated list of users denied to access Che.
che.infra.kubernetes.advanced_authorization.deny_users=NULL

# Comma separated list of groups of users denied to access Che.
che.infra.kubernetes.advanced_authorization.deny_groups=NULL
