## ---------------------------------------------------------------------------
## Licensed to the Apache Software Foundation (ASF) under one or more
## contributor license agreements.  See the NOTICE file distributed with
## this work for additional information regarding copyright ownership.
## The ASF licenses this file to You under the Apache License, Version 2.0
## (the "License"); you may not use this file except in compliance with
## the License.  You may obtain a copy of the License at
## 
## http://www.apache.org/licenses/LICENSE-2.0
## 
## Unless required by applicable law or agreed to in writing, software
## distributed under the License is distributed on an "AS IS" BASIS,
## WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
## See the License for the specific language governing permissions and
## limitations under the License.
## ---------------------------------------------------------------------------

# XML files loaded (in order) by JettyServerBean to configure the embedded
# Jetty 12 server for the web console. Each file uses Server.insertHandler (which
# prepends), so the LAST handler loaded is the outermost. The connection limits are
# accept-time Server beans. The resulting request path (outermost -> innermost) is:
#   DoS(rate limit) -> SizeLimit -> ThreadLimit -> MinDataRate -> InetAccess(IP allow)
#   -> Security(JAAS auth) -> Contexts(webapps)
# so cheap rejections (rate/size/thread/slow-loris/IP) happen before the expensive
# JAAS authentication. jetty-webapps.xml (webAppsContext) is applied last.
# The DoS/limit handlers ship with permissive defaults; tune via jetty.dos.*,
# jetty.sizeLimit.*, jetty.threadlimit.*, jetty.minDataRate.*, jetty.connectionlimit.*
# when opening the console beyond the default loopback binding.
jettyXmlFiles=jetty-bytebufferpool.xml,jetty-threadpool.xml,jetty-scheduler.xml,jetty-http-config.xml,jetty.xml,jetty-connection-limit.xml,jetty-network-connection-limit.xml,jetty-security.xml,jetty-min-data-rate.xml,jetty-thread-limit.xml,jetty-size-limit.xml,jetty-dos.xml
jettyHttpXmlFiles=jetty-http.xml
# jetty-secure-redirect.xml redirects http->https; only loaded when httpsEnabled=true
jettyHttpsXmlFiles=jetty-ssl.xml,jetty-ssl-context.xml,jetty-https.xml,jetty-secure-redirect.xml
httpEnabled=true
httpsEnabled=false
jetty.http.port=8161
jetty.ssl.port=8443
jetty.httpConfig.securePort=8443
# Keystore for the HTTPS connector (resolved against jetty.base = ${activemq.base}).
# jetty-keystore.ks is a sample self-signed dev keystore (PKCS12, CN=localhost, password
# "password", obfuscated below) - replace it with your own certificate for production. For mutual
# TLS (client-certificate auth) also set jetty.sslContext.trustStorePath / trustStorePassword and
# enable jetty.sslContext.needClientAuth.
jetty.sslContext.keyStorePath=conf/jetty-keystore.ks
jetty.sslContext.keyStoreType=PKCS12
jetty.sslContext.keyStorePassword=OBF:1v2j1uum1xtv1zej1zer1xtn1uvk1v1v
# If the private key entry uses a password different from the keystore password, set it here
# (otherwise Jetty falls back to the keystore password above):
#jetty.sslContext.keyManagerPassword=OBF:...

# HttpConfiguration hardening (jetty-http-config.xml is verbatim-canonical; Jetty
# defaults sendServerVersion/sendDateHeader to true and sendXPoweredBy to false).
jetty.httpConfig.sendServerVersion=false
jetty.httpConfig.sendDateHeader=false

# --- jetty-dos.xml (DoSHandler) tuning -------------------------------------
# Requests/second per remote address before the DoSHandler rejects with HTTP 429.
jetty.dos.leakingBucketTracker.maxRequestsPerSecond=100
