# This is an example configuration file for Redpanda Console v3.x.x

#----------------------------------------------------------------------------
# Kafka configuration
#----------------------------------------------------------------------------
kafka:
  # Brokers is a list of bootstrap servers with ports.
  brokers:
    - "broker-0.mycompany.com:19092"
    - "broker-1.mycompany.com:19092"
    - "broker-2.mycompany.com:19092"
  # Optional: Client ID used to identify Redpanda Console to the Kafka cluster.
  # clientId: "console"
  # Optional: Rack identifier to optimize message consumption in multi-zone clusters.
  # rackId: "zone-a"
  # sasl:
    # enabled: true
    # Supported mechanisms include:
    # - OAUTHBEARER (OIDC)
    # - SCRAM-SHA-256 or SCRAM-SHA-512 (basic authentication)
    # - GSSAPI (Kerberos); if using Kerberos, ensure impersonateUser is false.
    # - AWS_MSK_IAM (AWS MSK IAM)
    # mechanism: SCRAM-SHA-256
    # impersonateUser: false
    # oauth:
      # token: "example-oauth-token"
      # clientId: "example-client-id"
      # clientSecret: "example-client-secret"
      # tokenEndpoint: "https://accounts.google.com/token"
      # tokenFilepath: "/var/run/secrets/kafka/serviceaccount/token"
      # scope: "openid"
    # Example for basic authentication (uncomment to use):
    # username: "your-username"
    # password: "your-password"
    # Example for GSSAPI (Kerberos) - impersonateUser must be false:
    # gssapi:
    #   authType: KEYTAB_AUTH
    #   keyTabPath: "/path/to/keytab"
    #   kerberosConfigPath: "/path/to/krb5.conf"
    #   serviceName: "kafka"
    #   username: "your-username"
    #   password: "your-password"
    #   realm: "MY.REALM"
    #   enableFast: true
  # tls:
    # enabled: false
    # Uncomment and set the following paths if TLS is required:
    # caFilepath: "/path/to/ca-cert.pem"
    # certFilepath: "/path/to/client-cert.pem"
    # keyFilepath: "/path/to/client-key.pem"
    # insecureSkipTlsVerify: false
  # Startup is a configuration block to specify how often and with what delays
  # we should try to connect to the Kafka service. If all attempts fail the
  # application exits with code 1.
  # startup:
    # maxRetries: 5
    # retryInterval: 1s
    # maxRetryInterval 60s
    # backoffMultiplier: 2

#----------------------------------------------------------------------------
# Schema Registry configuration (top-level)
#----------------------------------------------------------------------------
schemaRegistry:
  enabled: true
  urls:
    - "http://schema-registry.mycompany.com:8081"
  # Optional: Authentication for Schema Registry.
  # authentication:
  #   basic:
  #     username: "example-user"
  #     password: "example-password"
  #   bearerToken: "example-bearer-token"
  tls:
    enabled: false
    # Uncomment and configure if TLS is required:
    # caFilepath: "/path/to/ca-cert.pem"
    # certFilepath: "/path/to/client-cert.pem"
    # keyFilepath: "/path/to/client-key.pem"
    # insecureSkipTlsVerify: false

#----------------------------------------------------------------------------
# Redpanda Console authentication
#----------------------------------------------------------------------------
authentication:
  jwtSigningKey: "secret-value"
  useSecureCookies: true
  # Optionally enable cookie chunking if cookie size is an issue.
  # useCookieChunking: false
  # OIDC configuration (if using OIDC):
  # oidc:
  #   enabled: true
  #   issuerUrl: "https://accounts.google.com"
  #   clientId: "your-oidc-client-id"
  #   clientSecret: "your-oidc-client-secret"
  #   redirectUrl: "http://localhost:9090/auth/callbacks/oidc"
  #   successfulLoginRedirectUrl: "http://localhost:3000"
  #   accessType: "offline"
  #   prompt: "consent"
  #   issuerTls:
    #   enabled: true
    #   caFilepath: "/path/to/ca.pem"
    #   certFilepath: "/path/to/issuer-cert.pem"
    #   keyFilepath: "/path/to/issuer-key.pem"
    #   insecureSkipTlsVerify: false

  # Basic authentication is supported by default.

#----------------------------------------------------------------------------
# Redpanda Console authorization and role bindings
#----------------------------------------------------------------------------
authorization:
  roleBindings:
    - roleName: admin
      users:
        - loginType: oidc
          name: "admin@mycompany.com"
    - roleName: viewer
      users:
        - loginType: basic
          name: "user@mycompany.com"

#----------------------------------------------------------------------------
# Redpanda Admin API configuration
#----------------------------------------------------------------------------
redpanda:
  adminApi:
    enabled: true
    urls:
      - "admin-0.mycompany.com:9644"
      - "admin-1.mycompany.com:9644"
    authentication:
      impersonateUser: true
    # If impersonateUser is false, configure static credentials here:
    # authentication:
    #   basic:
    #     username: "example-user"
    #     password: "example-password"
    startup:
      establishConnectionEagerly: true
      maxRetries: 5
      retryInterval: 1s
      maxRetryInterval: 60s
      backoffMultiplier: 2
    tls:
      enabled: true
      caFilepath: "/path/to/ca-cert.pem"
      certFilepath: "/path/to/client-cert.pem"
      keyFilepath: "/path/to/client-key.pem"
      insecureSkipTlsVerify: false

#----------------------------------------------------------------------------
# Kafka Connect configuration (optional)
#----------------------------------------------------------------------------
kafkaConnect:
  enabled: false
  # connectTimeout: 15s
  # readTimeout: 60s
  # requestTimeout: 6s
  clusters: []
  # Example:
  # clusters:
  #   - name: my-connect-cluster
  #     url: "http://connect.mycompany.com:8083"
  #     tls:
  #       enabled: false
  #     username: "connect-user"
  #     password: "connect-password"
  #     token: "optional-token"

#----------------------------------------------------------------------------
# Enterprise License configuration (optional)
#----------------------------------------------------------------------------
# To mount an enterprise license, set either license or licenseFilepath.
# This is only required if you want to use an enterprise feature
# such as SSO or RBAC.

# Filepath to your redpanda.license file
# licenseFilepath: ""

# License string.
# license: ""

#----------------------------------------------------------------------------
# Serde settings
#----------------------------------------------------------------------------

serde:
  maxDeserializationPayloadSize: 20480
  # protobuf:
    # enabled: false
    # mappings: []
      # Map the Proto type names for each of your topics.
      # These Proto types will be used for deserialization.
      # - topicName: xy
       # You can specify the Proto type for the record key
       # and/or value (just one will work too)
       # valueProtoType: fake_model.Order
       # keyProtoType: package.Type
    # Configure the fileSystem if you want Redpanda Console to
    # search the local file system for the Proto files
    # fileSystem:
      # enabled: false
      # paths: []
      # refreshInterval: 5m
    # importPaths is a list of paths from which to import Proto files into Redpanda Console.
    # Paths are relative to the root directory.
    # The `git` configuration must be enabled to use this feature.
    #importPaths: []
    # Git is where the Proto files come from.
    # git:
      # enabled: false
      # repository:
        # url:
        # branch: (defaults to primary/default branch)
        # baseDirectory: (defaults to the root directory of the repo/branch above)
        # How often Redpanda Console pulls the repository to look for new files.
        # Set to 0 to disable periodic pulls.
        # refreshInterval: 5m
      # To use GitHub's personal access tokens, use `token`
      # as username and pass the same token as password.
      # basicAuth:
        # enabled: true
        # username:
        # Password can also be set using the --serde.protobuf.git.basic-auth.password flag.
        # password:
      # You can pass the private key file directly using a flag on the command line, or you can specify it in the
      # yaml configuration file. Another alternative is to provide the filepath to a mounted key
      # file in this configuration block.
      # ssh:
        # enabled: false
        # username:
        # privateKey can also be set using the --serde.protobuf.git.ssh.private-key flag.
        # privateKey:
        # privateKeyFilepath:
        # Passphrase can also be set using the --serde.protobuf.git.ssh.passphrase flag.
        # passphrase:
  # messagePack:
    # enabled: false
    # List of topic name regexes, defaults to /.*/
    # topicNames: ["/.*/"]


#----------------------------------------------------------------------------
# Redpanda Console settings
#----------------------------------------------------------------------------
console:
  topicDocumentation:
    enabled: false
    # git:
    #   enabled: false
    #   repository:
    #     url:
    #     branch: (defaults to primary/default branch)
    #     baseDirectory: .
    #   # How often Redpanda Console pulls the repository to look for new files.
    #   # Set to 0 to disable periodic pulls.
    #   # refreshInterval: 1m
    #   # To use GitHub's personal access tokens, use `token` as username and pass the actual token as the password.
    #   basicAuth:
    #     enabled: true
    #     username: token
    #     password: <your_github_token>
    #   # You can pass the private key file directly using a flag on the command line, or you can specify it in the yaml configuration file. Another alternative is to provide the filepath to a mounted key file in this configuration block.
    #   ssh:
    #     enabled: false
    #     username: git
    #     privateKey: |
    #       -----BEGIN PRIVATE KEY-----
    #       ...
    #       -----END PRIVATE KEY-----
    #     privateKeyFilepath: /path/to/private/key
    #     passphrase: <optional_passphrase>
  auditLog:
    enabled: false   # default; set to true to write audit logs to stdout
    additionalHeaders: # specifies HTTP headers to include in audit logs
      - "X-Forwarded-For"
      - "User-Agent"

#----------------------------------------------------------------------------
# Server settings
#----------------------------------------------------------------------------
server:
  listenAddress: "0.0.0.0"
  listenPort: 8080
  httpsListenPort: 8081
  advertisedHttpsListenPort: 443
  gracefulShutdownTimeout: 30s
  readTimeout: 30s
  writeTimeout: 30s
  idleTimeout: 30s
  compressionLevel: 4
  basePath: ""
  setBasePathFromXForwardedPrefix: true
  stripPrefix: true
  tls:
    enabled: false
    # Uncomment and configure if HTTPS is required:
    # certFilepath: "/path/to/https-cert.pem"
    # keyFilepath: "/path/to/https-key.pem"
  allowedOrigins: []

#----------------------------------------------------------------------------
# Logger settings
#----------------------------------------------------------------------------
logger:
  level: info

#----------------------------------------------------------------------------
# Developer settings
#----------------------------------------------------------------------------

# Only relevant for developers who want to run the frontend separately.
# Uncomment the following line to serve the frontend separately.
# serveFrontend: true

#----------------------------------------------------------------------------
# Metrics settings
#----------------------------------------------------------------------------

# Prefix for all exported Prometheus metrics.
# Uncomment and set your metrics namespace.
# metricsNamespace: "console"

#----------------------------------------------------------------------------
# Analytics / telemetry (optional)
#----------------------------------------------------------------------------
analytics:
  enabled: true