quarkus.native.resources.includes=service-templates/**
quarkus.banner.enabled=false
quarkus.devservices.enabled=false
quarkus.console.enabled=false
quarkus.http.port=8080
quarkus.grpc.server.use-separate-server=false

# Optional local overrides for dev profile (not committed)
#%dev.quarkus.config.locations=file:./application.dev.properties

# Health check configuration
wanaku.router.health-check.enabled=true
wanaku.router.health-check.interval-seconds=60
wanaku.router.health-check.max-concurrent=10

wanaku.bridge.grpc.transport.deadline-seconds=10

# Wanaku internal NS
quarkus.mcp.server.wanaku-internal.sse.root-path=/wanaku-internal/mcp

# Namespaces must be set in build time
quarkus.mcp.server.ns-1.sse.root-path=/ns-1/mcp
quarkus.mcp.server.ns-2.sse.root-path=/ns-2/mcp
quarkus.mcp.server.ns-3.sse.root-path=/ns-3/mcp
quarkus.mcp.server.ns-4.sse.root-path=/ns-4/mcp
quarkus.mcp.server.ns-5.sse.root-path=/ns-5/mcp
quarkus.mcp.server.ns-6.sse.root-path=/ns-6/mcp
quarkus.mcp.server.ns-7.sse.root-path=/ns-7/mcp
quarkus.mcp.server.ns-8.sse.root-path=/ns-8/mcp
quarkus.mcp.server.ns-9.sse.root-path=/ns-9/mcp
quarkus.mcp.server.ns-10.sse.root-path=/ns-10/mcp

# Public NS
quarkus.mcp.server.public.sse.root-path=/public/mcp

quarkus.http.cors.enabled=true
quarkus.http.cors.origins=http://localhost:8080,http://127.0.0.1:8080,http://localhost:5173,http://localhost:6274

quarkus.mcp.server.traffic-logging.enabled=true
quarkus.mcp.server.traffic-logging.text-limit=1000000
quarkus.mcp.server.server-info.name=Wanaku
quarkus.mcp.server.client-logging.default-level=debug

# Auth configuration: "keycloak" (default) enables OIDC, "none" disables authentication
wanaku.http.auth=keycloak

# Auth
quarkus.oidc.enabled=true

# Address of the Keycloak authentication server - adjust to your Keycloak instance
auth.server=${AUTH_SERVER:http://localhost:8543}
# Address used by the OIDC proxy -
auth.proxy=http://localhost:${quarkus.http.port}
# Keycloak realm name - adjust to your Keycloak realm
auth.realm=${AUTH_REALM:wanaku}

# Address of the Keycloak authentication server
quarkus.oidc.auth-server-url=${auth.server}/realms/${auth.realm}

# Client identifier configured in Keycloak for the backend service
quarkus.oidc.client-id=wanaku-mcp-router

# Wanaku uses hybrid, as it is both a web application and a service
quarkus.oidc.application-type=hybrid
quarkus.oidc.tls.verification=none
# URL path where users can log out from the application (don't change)
quarkus.oidc.logout.path=/logout
quarkus.oidc.discovery-enabled=true
quarkus.oidc.resource-metadata.enabled=true

# This helps the metadata handler be aware that we are using the OIDC proxy (don't change)
quarkus.oidc.resource-metadata.authorization-server=${auth.proxy}/q/oidc

# Avoid forcing HTTPS
quarkus.oidc.resource-metadata.force-https-scheme=false

# These configure the special rules for the restricted MCP namespaces
quarkus.oidc.mcp.resource-metadata.authorization-server=${auth.proxy}/q/oidc
quarkus.oidc.mcp.auth-server-url=${auth.server}/realms/${auth.realm}
quarkus.oidc.mcp.tenant-paths=/mcp/*
quarkus.oidc.mcp.token.audience=wanaku-mcp-client
quarkus.oidc.mcp.resource-metadata.enabled=true
quarkus.oidc.mcp.resource-metadata.resource=mcp
quarkus.oidc.mcp.resource-metadata.force-https-scheme=false

# Per-namespace OIDC tenant configurations so that each namespace
# advertises the correct resource metadata URL in WWW-Authenticate headers
quarkus.oidc.ns-1.resource-metadata.authorization-server=${auth.proxy}/q/oidc
quarkus.oidc.ns-1.auth-server-url=${auth.server}/realms/${auth.realm}
quarkus.oidc.ns-1.tenant-paths=/ns-1/*
quarkus.oidc.ns-1.token.audience=wanaku-mcp-client
quarkus.oidc.ns-1.resource-metadata.enabled=true
quarkus.oidc.ns-1.resource-metadata.resource=ns-1/mcp
quarkus.oidc.ns-1.resource-metadata.force-https-scheme=false

quarkus.oidc.ns-2.resource-metadata.authorization-server=${auth.proxy}/q/oidc
quarkus.oidc.ns-2.auth-server-url=${auth.server}/realms/${auth.realm}
quarkus.oidc.ns-2.tenant-paths=/ns-2/*
quarkus.oidc.ns-2.token.audience=wanaku-mcp-client
quarkus.oidc.ns-2.resource-metadata.enabled=true
quarkus.oidc.ns-2.resource-metadata.resource=ns-2/mcp
quarkus.oidc.ns-2.resource-metadata.force-https-scheme=false

quarkus.oidc.ns-3.resource-metadata.authorization-server=${auth.proxy}/q/oidc
quarkus.oidc.ns-3.auth-server-url=${auth.server}/realms/${auth.realm}
quarkus.oidc.ns-3.tenant-paths=/ns-3/*
quarkus.oidc.ns-3.token.audience=wanaku-mcp-client
quarkus.oidc.ns-3.resource-metadata.enabled=true
quarkus.oidc.ns-3.resource-metadata.resource=ns-3/mcp
quarkus.oidc.ns-3.resource-metadata.force-https-scheme=false

quarkus.oidc.ns-4.resource-metadata.authorization-server=${auth.proxy}/q/oidc
quarkus.oidc.ns-4.auth-server-url=${auth.server}/realms/${auth.realm}
quarkus.oidc.ns-4.tenant-paths=/ns-4/*
quarkus.oidc.ns-4.token.audience=wanaku-mcp-client
quarkus.oidc.ns-4.resource-metadata.enabled=true
quarkus.oidc.ns-4.resource-metadata.resource=ns-4/mcp
quarkus.oidc.ns-4.resource-metadata.force-https-scheme=false

quarkus.oidc.ns-5.resource-metadata.authorization-server=${auth.proxy}/q/oidc
quarkus.oidc.ns-5.auth-server-url=${auth.server}/realms/${auth.realm}
quarkus.oidc.ns-5.tenant-paths=/ns-5/*
quarkus.oidc.ns-5.token.audience=wanaku-mcp-client
quarkus.oidc.ns-5.resource-metadata.enabled=true
quarkus.oidc.ns-5.resource-metadata.resource=ns-5/mcp
quarkus.oidc.ns-5.resource-metadata.force-https-scheme=false

quarkus.oidc.ns-6.resource-metadata.authorization-server=${auth.proxy}/q/oidc
quarkus.oidc.ns-6.auth-server-url=${auth.server}/realms/${auth.realm}
quarkus.oidc.ns-6.tenant-paths=/ns-6/*
quarkus.oidc.ns-6.token.audience=wanaku-mcp-client
quarkus.oidc.ns-6.resource-metadata.enabled=true
quarkus.oidc.ns-6.resource-metadata.resource=ns-6/mcp
quarkus.oidc.ns-6.resource-metadata.force-https-scheme=false

quarkus.oidc.ns-7.resource-metadata.authorization-server=${auth.proxy}/q/oidc
quarkus.oidc.ns-7.auth-server-url=${auth.server}/realms/${auth.realm}
quarkus.oidc.ns-7.tenant-paths=/ns-7/*
quarkus.oidc.ns-7.token.audience=wanaku-mcp-client
quarkus.oidc.ns-7.resource-metadata.enabled=true
quarkus.oidc.ns-7.resource-metadata.resource=ns-7/mcp
quarkus.oidc.ns-7.resource-metadata.force-https-scheme=false

quarkus.oidc.ns-8.resource-metadata.authorization-server=${auth.proxy}/q/oidc
quarkus.oidc.ns-8.auth-server-url=${auth.server}/realms/${auth.realm}
quarkus.oidc.ns-8.tenant-paths=/ns-8/*
quarkus.oidc.ns-8.token.audience=wanaku-mcp-client
quarkus.oidc.ns-8.resource-metadata.enabled=true
quarkus.oidc.ns-8.resource-metadata.resource=ns-8/mcp
quarkus.oidc.ns-8.resource-metadata.force-https-scheme=false

quarkus.oidc.ns-9.resource-metadata.authorization-server=${auth.proxy}/q/oidc
quarkus.oidc.ns-9.auth-server-url=${auth.server}/realms/${auth.realm}
quarkus.oidc.ns-9.tenant-paths=/ns-9/*
quarkus.oidc.ns-9.token.audience=wanaku-mcp-client
quarkus.oidc.ns-9.resource-metadata.enabled=true
quarkus.oidc.ns-9.resource-metadata.resource=ns-9/mcp
quarkus.oidc.ns-9.resource-metadata.force-https-scheme=false

quarkus.oidc.ns-10.resource-metadata.authorization-server=${auth.proxy}/q/oidc
quarkus.oidc.ns-10.auth-server-url=${auth.server}/realms/${auth.realm}
quarkus.oidc.ns-10.tenant-paths=/ns-10/*
quarkus.oidc.ns-10.token.audience=wanaku-mcp-client
quarkus.oidc.ns-10.resource-metadata.enabled=true
quarkus.oidc.ns-10.resource-metadata.resource=ns-10/mcp
quarkus.oidc.ns-10.resource-metadata.force-https-scheme=false

quarkus.oidc-proxy.enabled=true
quarkus.oidc-proxy.root-path=/q/oidc
# Make sure to use the configurations for the MCP tenant instead of the default ones
quarkus.oidc-proxy.tenant-id=mcp

# Paths used by the OIDC Proxy, which need to be public
quarkus.http.auth.permission.oidcproxy.paths=/.well-known/oauth-protected-resource/*, /.well-known/oauth-authorization-server/*, /q/oidc/*
quarkus.http.auth.permission.oidcproxy.policy=permit

# Health check paths must be publicly accessible for K8s probes
quarkus.http.auth.permission.health.paths=/q/health/*
quarkus.http.auth.permission.health.policy=permit

# Management APIs and the Data Store APIs
quarkus.http.auth.permission.authenticated.paths=/api/v1/management/*, /api/v1/data-store/*
quarkus.http.auth.permission.authenticated.policy=authenticated

# Restricted MCP namespaces
quarkus.http.auth.permission.mcp-authenticated.paths=/mcp/*, /ns-1/*, /ns-2/*, /ns-3/*, /ns-4/*, /ns-5/*, /ns-6/*, /ns-7/*, /ns-8/*, /ns-9/*, /ns-10/*
quarkus.http.auth.permission.mcp-authenticated.policy=authenticated

# Public APIs and static resources
quarkus.http.auth.permission.public.paths=/api/v1/*, /api/v2/*, /index.html, /*
quarkus.http.auth.permission.public.policy=permit

## Admin UI, which requires authentication for all paths in the web interface
quarkus.http.auth.permission.web.paths=/admin/*, /admin, /node_modules/*
quarkus.http.auth.permission.web.policy=authenticated

# Logging configuration

quarkus.http.access-log.enabled=true
quarkus.log.level=INFO
quarkus.log.category."ai.wanaku".level=INFO
quarkus.log.category."io.quarkiverse.quinoa".level=WARN
quarkus.log.category."io.quarkus.oidc.proxy".level=INFO
quarkus.log.category."io.quarkiverse.mcp".level=INFO

%dev.quarkus.log.console.enabled=false

%dev.quarkus.log.handler.file.wanaku-log.enabled=true
%dev.quarkus.log.handler.file.wanaku-log.path=target/logs/wanaku.log
%dev.quarkus.log.handler.file.wanaku-log.format=%d{yyyy-MM-dd HH:mm:ss} %-5p [%c] (%t) %s%e%n
%dev.quarkus.log.category."ai.wanaku".handlers=wanaku-log
%dev.quarkus.log.category."ai.wanaku".level=DEBUG
%dev.quarkus.log.category."io.quarkus".handlers=wanaku-log
%dev.quarkus.log.category."io.quarkus".level=INFO
%dev.quarkus.log.category."org.apache.http".handlers=wanaku-log
%dev.quarkus.log.category."org.apache.http".level=INFO
%dev.quarkus.log.category."io.quarkus.oidc.proxy".handlers=wanaku-log
%dev.quarkus.log.category."io.quarkus.oidc.proxy".level=DEBUG
%dev.quarkus.log.category."io.quarkiverse.mcp".handlers=wanaku-log
%dev.quarkus.log.category."io.quarkiverse.mcp".level=DEBUG

%perf.quarkus.log.console.enabled=false

%perf.quarkus.log.handler.file.wanaku-log.enabled=true
%perf.quarkus.log.handler.file.wanaku-log.path=target/logs/wanaku.log
%perf.quarkus.log.handler.file.wanaku-log.format=%d{yyyy-MM-dd HH:mm:ss} %-5p [%c] (%t) %s%e%n
%perf.quarkus.log.category."ai.wanaku".handlers=wanaku-log
%perf.quarkus.log.category."ai.wanaku".level=DEBUG
%perf.quarkus.log.category."io.quarkus".handlers=wanaku-log
%perf.quarkus.log.category."io.quarkus".level=INFO
%perf.quarkus.log.category."org.apache.http".handlers=wanaku-log
%perf.quarkus.log.category."org.apache.http".level=INFO
%perf.quarkus.log.category."io.quarkus.oidc.proxy".handlers=wanaku-log
%perf.quarkus.log.category."io.quarkus.oidc.proxy".level=DEBUG
%perf.quarkus.log.category."io.quarkiverse.mcp".handlers=wanaku-log
%perf.quarkus.log.category."io.quarkiverse.mcp".level=DEBUG

%test.quarkus.log.file.enabled=true
%test.quarkus.log.file.path=target/logs/wanaku.log
%test.quarkus.log.file.format=%d{yyyy-MM-dd HH:mm:ss} %-5p [%c] (%t) %s%e%n
%test.quarkus.log.category."org.apache.http".level=INFO

quarkus.smallrye-openapi.store-schema-directory=src/main/webui/
quarkus.smallrye-openapi.auto-add-security=false
mp.openapi.scan.exclude.packages=ai.wanaku.backend.api.v1.oidc

# Quinoa configuration
quarkus.quinoa=true
quarkus.quinoa.ui-dir=../ui/admin
quarkus.quinoa.build-dir=dist
quarkus.quinoa.ui-root-path=/admin
quarkus.quinoa.enable-spa-routing=true
quarkus.quinoa.ci=true
quarkus.quinoa.package-manager=yarn
quarkus.quinoa.package-manager-install=true
quarkus.quinoa.package-manager-install.yarn-version=1.22.22
quarkus.quinoa.package-manager-install.node-version=22.18.0
quarkus.quinoa.package-manager-install.pnpm-version=10.14.0
quarkus.quinoa.force-install=true
quarkus.quinoa.package-manager-command.ci=install
quarkus.quinoa.package-manager-command.build=run build
quarkus.quinoa.package-manager-command.build-env.VITE_API_URL=""
quarkus.quinoa.package-manager-command.dev-env.VITE_API_URL=""
quarkus.quinoa.package-manager-command.dev=run dev
quarkus.quinoa.package-manager-command.test=run test