#
# Copyright (c) 2012-2023 Red Hat, Inc.
# This program and the accompanying materials are made
# available under the terms of the Eclipse Public License 2.0
# which is available at https://www.eclipse.org/legal/epl-2.0/
#
# SPDX-License-Identifier: EPL-2.0
#
# Contributors:
#   Red Hat, Inc. - initial API and implementation
#


### Che system

# System Super Privileged Mode.
# Grants users with the `manageSystem` permission additional permissions for
# `getByKey`, `getByNameSpace`, `stopWorkspaces`, and `getResourcesInformation`.
# These are not given to admins by default. They allow
# admins to gain visibility to any workspace along with naming themselves
# with administrator privileges to those workspaces.
che.system.super_privileged_mode=false

# Grants system permission for `che.admin.name` user. If the user already exists, it will happen on
# component startup. If not, it will happen during the first login when user is persisted in the database.
che.system.admin_name=admin

### Workspace limits

# Workspaces are the fundamental runtime for users when doing development. You can set
# parameters that limit how workspaces are created and the resources that are consumed.
# Sets the maximum amount of RAM that a user can allocate to a workspace when they
# create a new workspace. The RAM slider is adjusted to this maximum value.
che.limits.workspace.env.ram=16gb

# The length of time (in milliseconds) that a user is idle within their workspace, after which the system will
# suspend the workspace, and then stop it. Idleness is the
# length of time that the user has not interacted with the workspace, meaning that
# one of the agents has not received interaction. Leaving a browser window open
# counts toward idleness.
che.limits.workspace.idle.timeout=1800000

# The length of time (in milliseconds) that a workspace will run, regardless of activity, before
# the system will suspend it. Set this property if you want to automatically stop
# workspaces after a period of time. The default is `0`, meaning that there is no
# run timeout.
che.limits.workspace.run.timeout=0

### Users workspace limits

# The total amount of RAM that a single user is allowed to allocate to running
# workspaces. A user can allocate this RAM to a single workspace or spread it
# across multiple workspaces.
che.limits.user.workspaces.ram=-1

# The maximum number of workspaces that a user is allowed to create. The user will
# be presented with an error message if they try to create additional workspaces.
# This applies to the total number of both running and stopped workspaces.
che.limits.user.workspaces.count=-1

# The maximum number of running workspaces that a single user is allowed to have.
# If the user has reached this threshold, and they try to start an additional
# workspace, they will be presented with an error message. The user will need to
# stop a running workspace to activate another.
che.limits.user.workspaces.run.count=1


### Multi-user-specific OpenShift infrastructure configuration

# Alias of the OpenShift identity provider registered in Keycloak
# that should be used to create workspace OpenShift resources in
# OpenShift namespaces owned by the current Che user.
# Set it to `NULL` if `che.infra.openshift.project`
# is set to a non-empty value.
# See: link:https://www.keycloak.org/docs/latest/server_admin/#openshift-4[OpenShift identity provider]
che.infra.openshift.oauth_identity_provider=NULL

### OIDC configuration

# Url to OIDC identity provider server.
# You can set it to `NULL` only if `che.oidc.oidcProvider` is used.
che.oidc.auth_server_url=http://${CHE_HOST}:5050/auth

# Internal network service URL to OIDC identity provider server.
che.oidc.auth_internal_server_url=NULL

# The number of seconds to tolerate for clock skew when verifying `exp` or `nbf` claims.
che.oidc.allowed_clock_skew_sec=3

# Username claim to be used as user display name when parsing JWT token.
# If not defined, the fallback value is 'preferred_username' in Keycloak installations and
# `name` in Dex installations.
che.oidc.username_claim=NULL

# Email claim to be used when parsing JWT token.
# If not defined, the fallback value is 'email'.
che.oidc.email_claim=NULL

# Base URL of an alternate OIDC provider that provides
# a discovery endpoint as detailed in the following specification
# link:https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig[Obtaining OpenID Provider Configuration Information].
# If deprecated, use `che.oidc.auth_server_url` and `che.oidc.auth_internal_server_url` instead.
che.oidc.oidc_provider=NULL

### Keycloak configuration

# Keycloak realm is used to authenticate users.
# You can set it to `NULL` only if `che.keycloak.oidcProvider`
# is used.
che.keycloak.realm=che

# Keycloak client identifier in `che.keycloak.realm` to authenticate users in the dashboard, the IDE, and the CLI.
che.keycloak.client_id=che-public

# URL to access OSO OAuth tokens.
che.keycloak.oso.endpoint=NULL

# URL to access Github OAuth tokens.
che.keycloak.github.endpoint=NULL

# Use the OIDC optional `nonce` feature to increase security.
che.keycloak.use_nonce=true

# URL to the Keycloak Javascript adapter to use.
# If you set it to `NULL`, the default used value is
# `${che.keycloak.auth_server_url}/js/keycloak.js`,
# or `<che-server>/api/keycloak/OIDCKeycloak.js`
# if an alternate `oidc_provider` is used.
che.keycloak.js_adapter_url=NULL

# Set it to `true` when using an alternate OIDC provider that
# only supports fixed redirect URLs.
# This property is ignored when `che.keycloak.oidc_provider` is set to`NULL`.
che.keycloak.use_fixed_redirect_urls=false

# Configuration of OAuth Authentication Service that can be used in `embedded` or `delegated` mode.
# If you set it to `embedded`, the service works as a wrapper to Che's OAuthAuthenticator (as in Single User mode).
# If you set it to `delegated`, the service will use Keycloak IdentityProvider mechanism.
# Runtime Exception `wii` will be thrown, if this property isn't set properly.
che.oauth.service_mode=delegated


# User name adjustment configuration. Che needs to use the usernames as part of Kubernetes object names and labels.
# Therefore there are stricter requirements on their format than the identity providers usually
# allow (it needs them to be DNS-compliant). The adjustment is represented by comma-separated key-value pairs.
# These are sequentially used as arguments to the `String.replaceAll` function on the original username.
# The keys are regular expressions, values are replacement strings that replace the characters in the username
# that match the regular expression. The modified username will only be stored in the Che database
# and will not be advertised back to the identity provider.
# It is recommended that you use DNS-compliant characters as replacement strings (values in the key-value pairs).
# Example: `\\=-,@=-at-` changes `\` to `-` and `@` to `-at-`
# so the username `org\user@com` becomes `org-user-at-com.`
che.keycloak.username.replacement_patterns=NULL
