# non secure connector configuration
org.osgi.service.http.enabled = true
org.osgi.service.http.port = 8181

# secure connector configuration
org.osgi.service.http.secure.enabled = true
org.osgi.service.http.port.secure = 8282
org.ops4j.pax.web.ssl.truststore = ${karaf.etc}/virtimo/ssl/virtimo_truststore.jks
org.ops4j.pax.web.ssl.truststore.password = virtimo
org.ops4j.pax.web.ssl.truststore.type = JKS
org.ops4j.pax.web.ssl.keystore = ${karaf.etc}/virtimo/ssl/virtimo_keystore.jks
org.ops4j.pax.web.ssl.keystore.password = virtimo
org.ops4j.pax.web.ssl.keystore.type = JKS
org.ops4j.pax.web.ssl.key.alias = karaf
org.ops4j.pax.web.ssl.key.password = virtimo
#org.ops4j.pax.web.ssl.clientauth.needed = false
#org.ops4j.pax.web.ssl.protocols.included = TLSv1.3
#org.ops4j.pax.web.ssl.protocol = TLSv1.3
#org.ops4j.pax.web.ssl.protocols.included = TLSv1.2 TLSv1.3
#org.ops4j.pax.web.ssl.ciphersuites.included = TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384
#org.ops4j.pax.web.ssl.secureRandom.algorithm = NativePRNGNonBlocking
#org.ops4j.pax.web.ssl.renegotiationAllowed = true
#org.ops4j.pax.web.ssl.session.enabled = true

# TLS hardening
org.ops4j.pax.web.ssl.renegotiationAllowed = false
# default jetty (10) pattern + mozilla recommendations
org.ops4j.pax.web.ssl.ciphersuites.excluded = ^.*_(MD5|SHA|SHA1)$,^TLS_RSA_.*$,^SSL_.*$,^.*_NULL_.*$,^.*_anon_.*$,TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384

# external Jetty configuration file where Jetty-specific beans may be declared
org.ops4j.pax.web.config.file = ${karaf.etc}/jetty.xml
# optional Jetty context configuration file applied to all web contexts
# see https://www.eclipse.org/jetty/documentation/jetty-9/index.html#using-basic-descriptor-files
#org.ops4j.pax.web.context.file = ${karaf.etc}/jetty-web.xml

# SameSite attribute configuration for session cookie (possible values: none, lax, strict)
# Important: when using OpenID Connect / Oauth2 (e.g., Keycloak) SameSite=strict won't work, because
# the Keycloak redirected response after authentication should contain JSESSIONID cookie
org.ops4j.pax.web.session.cookie.sameSite = strict

# this is a root directory for all the context-specific directories managed by Pax Web
javax.servlet.context.tempdir = ${karaf.data}/pax-web/tmp
org.apache.karaf.features.configKey = org.ops4j.pax.web

# Miscellaneous
org.ops4j.pax.web.server.showStacks = false
