application.yaml

# This value gets replaced by maven.
# default is prod, example for development:
# mvn spring-boot:run -Pdev
spring.profiles.active: ${activatedProfiles}

# Server configuration
# These properties can be overwritten by environment variables to enable https
server.port: 8080
server.ssl:
    enabled: false
    key-store-password:
    key-store: keystore.p12
    key-store-type: PKCS12
    key-alias: scb-engine

# Spring Boot Actuator configuration
# Used to enable an endpoint for health checks at '/status'
management.endpoints:
    enabled-by-default: false
    web.base-path: /
    web.path-mapping.health: status
management.endpoint.health.enabled: true
management.health.elasticsearch.enabled: false

management.server.port: 8080

camunda.bpm:
  webapp.index-redirect-enabled: true
  authorization.enabled: true

spring.datasource.type: org.apache.tomcat.jdbc.pool.DataSource

logging.level: INFO
logging.level.io.securecodebox: INFO

# Persistence Provider Config
securecodebox.persistence.none.enabled: "false"
securecodebox.persistence.elasticsearch.enabled: "false"
securecodebox.persistence.s3.enabled: "false"
securecodebox.persistence.defectdojo.enabled: "false"

# Configuration for the s3 persistence provider:
securecodebox.persistence.s3.bucket: abc-def
securecodebox.persistence.s3.region: eu-central-1

# Configuration for the elasticsearch persistence provider:
securecodebox.persistence.elasticsearch.host: persistence-elasticsearch
securecodebox.persistence.elasticsearch.port: 9200
securecodebox.persistence.elasticsearch.index.prefix: securecodebox
securecodebox.persistence.elasticsearch.index.delete_on_init: false
# Must be 'basic' for basic authentication or 'token' for a api token based authentication
securecodebox.persistence.elasticsearch.auth: ""
securecodebox.persistence.elasticsearch.auth.basic.username: ""
securecodebox.persistence.elasticsearch.auth.basic.password: ""
securecodebox.persistence.elasticsearch.auth.apikey.id: ""
securecodebox.persistence.elasticsearch.auth.apikey.secret: ""

# Initialize Kibana with some basic Security Dashboards and Visualisations if no .kibana index will be found on startup
securecodebox.persistence.elasticsearch.kibana.initialize: true


securecodebox.default.target.name: BodgeIT Public Host
securecodebox.default.target.location: bodgeit
securecodebox.default.target.uri: http://bodgeit:8080/bodgeit
securecodebox.default.context: BodgeIT

# Configure Secure CodeBox rest api protection
# - basic auth
# - none
securecodebox.rest.auth: basic auth

securecodebox:
  tenants: []
  users: []
  # Documentation on Authorization resources and permission of Camunda types are documented here:
  # https://docs.camunda.org/manual/7.12/user-guide/process-engine/authorization-service/#basic-principles
  groups:
    - id: scanner
      name: "secureCodeBox Scanner"
      authorizations:
        - resource: PROCESS_INSTANCE
          permissions: [READ, UPDATE]
        - resource: PROCESS_DEFINITION
          permissions: [READ, READ_INSTANCE, UPDATE_INSTANCE]
    - id: ci
      name: "secureCodeBox Continuous Integration"
      authorizations:
        - resource: PROCESS_DEFINITION
          permissions: [CREATE_INSTANCE, READ, READ_HISTORY]
        - resource: PROCESS_INSTANCE
          permissions: [READ, CREATE]
    - id: user
      name: "secureCodeBox User"
      authorizations:
        - resource: APPLICATION
          permissions: [ACCESS]
        - resource: DASHBOARD
          permissions: [ALL]
        - resource: DEPLOYMENT
          permissions: [READ]
        - resource: FILTER
          permissions: [ALL]
        - resource: PROCESS_DEFINITION
          permissions: [CREATE_INSTANCE, READ, READ_HISTORY]
        - resource: PROCESS_INSTANCE
          permissions: [ALL]
        - resource: TASK
          permissions: [ALL]
    - id: admin
      name: "secureCodeBox Admin"
      authorizations:
        - resource: APPLICATION
          permissions: [ALL]
        - resource: AUTHORIZATION
          permissions: [ALL]
        - resource: BATCH
          permissions: [ALL]
        - resource: DASHBOARD
          permissions: [ALL]
        - resource: DECISION_DEFINITION
          permissions: [ALL]
        - resource: DECISION_REQUIREMENTS_DEFINITION
          permissions: [ALL]
        - resource: FILTER
          permissions: [ALL]
        - resource: GROUP
          permissions: [ALL]
        - resource: GROUP_MEMBERSHIP
          permissions: [ALL]
        - resource: PROCESS_DEFINITION
          permissions: [ALL]
        - resource: PROCESS_INSTANCE
          permissions: [ALL]
        - resource: REPORT
          permissions: [ALL]
        - resource: TASK
          permissions: [ALL]
        - resource: TENANT
          permissions: [ALL]
        - resource: TENANT
          permissions: [ALL]
        - resource: TENANT_MEMBERSHIP
          permissions: [ALL]
        - resource: USER
          permissions: [ALL]
  rest.user:
    scanner-default:
      user-id: ${SECURECODEBOX_USER_SCANNER:}
      password: ${SECURECODEBOX_USER_SCANNER_PW:}