#
# Copyright (c) 2017, 2019 Oracle and/or its affiliates. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#


security.config:
  # Set to true for production - if set to true, clear text passwords will cause failure
  require-encryption: false
  # This should be configured by system property or environment variable for production - the "master" passwords for AES decryption
  aes.insecure-passphrase: "myMasterPasswordForEncryption"
  # See documentation of pki-util
  rsa:
    # load from classpath
    keystore-resource-path: ".ssh/keystore.p12"
    # If keystore is used, alias to use from the keystore (in my example, it is "1")
    key-alias: "1"
    # Password of keystore
    keystore-passphrase: "j4c"

rsa-legacy:
  # Public key encrypted secret (can only be decrypted by private key)
  pwd3: "${RSA=aGr3sFCMQznixrgbIk9qNfoLnO1cdi3H86qweCNjxFvH4dYg5IQM1EuoyTjJaXcSCG5MBskpeA3bjnWYrzeAFFlZHuYSPsb+wJVzGLrfUColTn+BPJjpJ3rmEd3AVkJl1ASfBBMh3q3deC+rvUdhfoTGBO8sC0teUATklCQSxfHOnIxswxqrplnoGXToGiTIfehiN2IZNulRKeoDQ0AeoKREmq5au4L8OOmS+D9BqnlKMc0F1tULZ7+h3Cxla4lXC5WRPoPfHBU4vzRZOGzeDvLkRgrD60caw/wKn5M0Wy1A1cKR8E46ceBXCjJ2eWIcLyhZSAZWDe3ceNrawHZtCg==}"
  # empty string
  pwd5: "${RSA=vjjRO06oe/odWcPiJ9SpFkzjGmb4wLs8gRWTI4zJibi9Sa33nz9OMgDJrmeXv2/zKZGzvK4ihnyA4L70mu/nHnSFQ1ryTDJvrjsj0+Tt00bp1tk5h5xqYKVX54jmmC4jPe5qXcNrfIh9zVTBuVKWzv8dlE08zo/b0Qs/YaEin79ACQ645Fib0xolWeVIWwcMotRIVuez9yVYHSbC8Esc8qMVLTzXOswe0Sx9L/KwIScSw18ef/w98IGD0dfSD+xuMs/T2gYJDqyEHOPfF6t9d26851g/+a3WhZgglV7iQzg30e55v3uEF+GmsxMKLD38FAQRnQj2QYlDvCzOuRcA4Q==}"
  # wrong encryption
  pwd10: "${RSA=not really encrypted}"

  passwords: [
    "${RSA=aGr3sFCMQznixrgbIk9qNfoLnO1cdi3H86qweCNjxFvH4dYg5IQM1EuoyTjJaXcSCG5MBskpeA3bjnWYrzeAFFlZHuYSPsb+wJVzGLrfUColTn+BPJjpJ3rmEd3AVkJl1ASfBBMh3q3deC+rvUdhfoTGBO8sC0teUATklCQSxfHOnIxswxqrplnoGXToGiTIfehiN2IZNulRKeoDQ0AeoKREmq5au4L8OOmS+D9BqnlKMc0F1tULZ7+h3Cxla4lXC5WRPoPfHBU4vzRZOGzeDvLkRgrD60caw/wKn5M0Wy1A1cKR8E46ceBXCjJ2eWIcLyhZSAZWDe3ceNrawHZtCg==}"
  ]

rsa-current:
  # Public key encrypted secret (can only be decrypted by private key)
  pwd3: "${RSA-P=fXoVMRlWzlj4fUPnLYFm2h0hSqnKgJqzJLiSslSfmf5MLXRYxNT0MKDZfmGN1If1E4/TR0jeVW/myPUaAJnO3tpadi6AyWsyz6pmEt2mzXZ+yQa1Em0/6ORiqnR2NedyrtVkn8lWL2YIkWfqbNwHODB3jehJ/BPfXru0WNDNRw3jVlPA33FsLBJFeZSRPs+fu1jNu/SeSjvS23a0+rGHUR/zeDP+jqHGEEjiUb73RMRBgvaBxU3RPM2dJ4hWOMKssjYJeu6SOidc3Ej9HpL1XNw5lGfQrqU2u7Lkga1uKd7eW1hSQZQEypcAa6ZtXrKZS4sIXwKqyYt3mdPJaUnzOA==}"
  # empty string
  pwd5: "${RSA-P=JLRr1Tw0/AS6q4OITsVD5oFiLV/9hrDC6NiLkgXxkruQ1PHf85szIbR6OYbdNM9veqXQSlYjJhjnnp3aEuM3SV6zoVSnPGFr9IL0A0T+kV57V/Ss2iE2VdfrlbC1zMT0VWIQRyh7v8eKxxDzbCLDKF/r1/GarXdfJ/l6uY1GUjvBHvN0iBI+XPoV15YSTI+YDr9umH719KaHadxOQe7C4XLE2cxo3hq6XSrB0NYpTfQrheay50kwgHPYCQSwT0KA6JCjyCjOHMjpEIYXd7wxdVTN/VlDENlEdeBoK39vxaBzn7XMn+4bOzbRpXBpB/mFoJB1RawO9jH8CbdOWmH5aA==}"
  # wrong encryption
  pwd10: "${RSA-P=not really encrypted}"

  passwords: [
    "${RSA-P=fXoVMRlWzlj4fUPnLYFm2h0hSqnKgJqzJLiSslSfmf5MLXRYxNT0MKDZfmGN1If1E4/TR0jeVW/myPUaAJnO3tpadi6AyWsyz6pmEt2mzXZ+yQa1Em0/6ORiqnR2NedyrtVkn8lWL2YIkWfqbNwHODB3jehJ/BPfXru0WNDNRw3jVlPA33FsLBJFeZSRPs+fu1jNu/SeSjvS23a0+rGHUR/zeDP+jqHGEEjiUb73RMRBgvaBxU3RPM2dJ4hWOMKssjYJeu6SOidc3Ej9HpL1XNw5lGfQrqU2u7Lkga1uKd7eW1hSQZQEypcAa6ZtXrKZS4sIXwKqyYt3mdPJaUnzOA==}"
  ]

aes-legacy:
  # Secret in clear text - for non-prod environments, this is enough. Intentionally wrapped as password to protect for prod.
  pwd1: "${CLEAR=known_password}"
  # A reference to another property (and maybe in the future to a key in a "wallet" service)
  pwd2: "${ALIAS=aes-legacy.pwd1}"
 # "master" password encrypted password
  pwd4: "${AES=YbaZGjQfwOv0htF2nmRYaOMYp0+qY/IRQUlWHfRKeTw6Q2uy33Rp8ZhTwv0oDywE}"

  # empty string
  pwd6: "${AES=D/UgMzsNb265HU1NDvdzm7tACHdsW6u1PjYEcRkV/OLiWcI+ET6Q4MKCz0zHyEh9}"
  # encrypted alias
  pwd7: "${ALIAS=aes-legacy.pwd4}"
  # missing alias
  pwd8: "${ALIAS=missing}"
  # wrong encryption
  pwd9: "${AES=not really encrypted}"

  pwd11: "${ALIAS=aes-legacy.pwd2}"
  pwd12: "${ALIAS=aes-legacy.pwd11}"

  passwords: [
    "${AES=LrbVVJOnn82fjl9ioV0pIDnYDhoNZp21KIEIjX8nTadlnlM8VQu2XXjJv8MFfHgm}",
    "${AES=xAzTBAstoNzvq2qk7szFGreIEfdxNx4OkIuLZHMUO/+p2441Sd4DkdmqgFKv0zNx}"
  ]

  objects: [
  {
    pwd: "${AES=gMTQIU+zcu9UPkGY8IKpYoVV2sxPna4O6rtlgKXtkqspSyxbLJMiu+VgqZq7okMX}"
  },
  {
    pwd: "${AES=DalgBVpVjvbqNgC+jCM5AmMG0rr4BlTf0XQbJVs85ukch/PsF8reJ1NqGHF1GqgN}"
  }
  ]

  customEnc: "${URGH=argh}"

aes-current:
  # Secret in clear text - for non-prod environments, this is enough. Intentionally wrapped as password to protect for prod.
  pwd1: "${CLEAR=known_password}"
  # A reference to another property (and maybe in the future to a key in a "wallet" service)
  pwd2: "${ALIAS=aes-current.pwd1}"
  # "master" password encrypted password
  pwd4: "${GCM=bQPPs+e2i4Sry7xB3MJWUPCnGWzx69Rgs6kskDIq8LRSJFonZ1NDlLhVhZBhtwpVdNlDa9qQSw==}"

  # empty string
  pwd6: "${GCM=p5GPxwagVVPyM3E7BvEy798rmQJojLuu957jvEZrqOKuJKeiCXyU7jONvU4=}"
  # encrypted alias
  pwd7: "${ALIAS=aes-current.pwd4}"
  # missing alias
  pwd8: "${ALIAS=missing}"
  # wrong encryption
  pwd9: "${GCM=not really encrypted}"

  pwd11: "${ALIAS=aes-current.pwd2}"
  pwd12: "${ALIAS=aes-current.pwd11}"

  passwords: [
      "${GCM=O8vR1wYqWKDXSoLiHeo1WebiWfHd+H3bGm0AsmtmZt415KgqMqS6Q9HPSkmpVe6fX1YA6l9pIA==}",
      "${GCM=dEdVNy4X7+8ySuWPf6lSlAghJhB5qGxsyrSdRGG0PFEwTHJNxNGOFuVNhaU=}"
  ]

  objects: [
      {
          pwd: "${GCM=t0ttpS+BhIwnsFhi3yklv6t+uPdMTbA8BxRhbMIM4Xtbo7O0E/khK1CNXH5lR2eyakBOlrB/PA==}"
      },
      {
          pwd: "${GCM=diobI2etFbaU+R++fToPEoAwkoAdfYNu6rlIvkVTqpjs0ZhLzbaqTQK6EdI=}"
      }
  ]

  customEnc: "${URGH=argh}"
