#
# Copyright © 2016-2026 The Thingsboard Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

# Spring common parameters
# Controls Spring Boot web environment and application type settings used for optional metrics exposure.
spring.main.web-environment: "${WEB_APPLICATION_ENABLE:false}" # If you enabled process metrics you should also enable 'web-environment'.
spring.main.web-application-type: "${WEB_APPLICATION_TYPE:none}" # If you enabled process metrics you should set 'web-application-type' to 'servlet' value.
spring.main.allow-circular-references: "true" # Spring Boot configuration property that controls whether circular dependencies between beans are allowed.

# Server common parameters
# HTTP server bind address and port, effective only when the web environment is enabled.
server:
  # Server bind address (has no effect if web-environment is disabled).
  address: "${HTTP_BIND_ADDRESS:0.0.0.0}"
  # Server bind port (has no effect if web-environment is disabled).
  port: "${HTTP_BIND_PORT:8083}"

# ZooKeeper connection parameters
# Controls ZooKeeper-based service discovery and cluster coordination for microservice deployments.
zk:
  # Enable/disable ZooKeeper discovery service.
  enabled: "${ZOOKEEPER_ENABLED:false}"
  # ZooKeeper connect string
  url: "${ZOOKEEPER_URL:localhost:2181}"
  # ZooKeeper retry interval in milliseconds
  retry_interval_ms: "${ZOOKEEPER_RETRY_INTERVAL_MS:3000}"
  # ZooKeeper connection timeout in milliseconds
  connection_timeout_ms: "${ZOOKEEPER_CONNECTION_TIMEOUT_MS:3000}"
  # ZooKeeper session timeout in milliseconds
  session_timeout_ms: "${ZOOKEEPER_SESSION_TIMEOUT_MS:3000}"
  # Name of the directory in ZooKeeper 'filesystem'
  zk_dir: "${ZOOKEEPER_NODES_DIR:/thingsboard}"
  # The recalculate_delay property is recommended in a microservices architecture setup for rule-engine services.
  # This property provides a pause to ensure that when a rule-engine service is restarted, other nodes don't immediately attempt to recalculate their partitions.
  # The delay is recommended because the initialization of rule chain actors is time-consuming. Avoiding unnecessary recalculations during a restart can enhance system performance and stability.
  recalculate_delay: "${ZOOKEEPER_RECALCULATE_DELAY_MS:0}"

# Cache parameters
# Configures the cache backend type and per-entity cache specifications such as TTL and maximum size.
cache:
  # caffeine or redis
  type: "${CACHE_TYPE:redis}"
  # Deliberately placed outside the 'specs' group above
  entityLimits:
    timeToLiveInMinutes: "${CACHE_SPECS_ENTITY_LIMITS_TTL:5}" # Entity limits cache TTL
    maxSize: "${CACHE_SPECS_ENTITY_LIMITS_MAX_SIZE:100000}" # 0 means the cache is disabled

# Redis/Valkey configuration parameters
# Connection, authentication, SSL, and connection pool settings for the Redis or Valkey cache backend.
redis:
  connection:
    # standalone or cluster or sentinel
    type: "${REDIS_CONNECTION_TYPE:standalone}"
  standalone:
    # Redis connection host
    host: "${REDIS_HOST:localhost}"
    # Redis connection port
    port: "${REDIS_PORT:6379}"
    # Use default Redis configuration file
    useDefaultClientConfig: "${REDIS_USE_DEFAULT_CLIENT_CONFIG:true}"
    # this value may be used only if you used not default ClientConfig
    clientName: "${REDIS_CLIENT_NAME:standalone}"
    # this value may be used only if you used not default ClientConfig
    connectTimeout: "${REDIS_CLIENT_CONNECT_TIMEOUT:30000}"
    # this value may be used only if you used not default ClientConfig
    readTimeout: "${REDIS_CLIENT_READ_TIMEOUT:60000}"
    # this value may be used only if you used not default ClientConfig
    usePoolConfig: "${REDIS_CLIENT_USE_POOL_CONFIG:false}"
  cluster:
    # Comma-separated list of "host:port" pairs to bootstrap from.
    nodes: "${REDIS_NODES:}"
    # Maximum number of redirects to follow when executing commands across the cluster.
    max-redirects: "${REDIS_MAX_REDIRECTS:12}"
    # if set false will be used pool config build from values of the pool config section
    useDefaultPoolConfig: "${REDIS_USE_DEFAULT_POOL_CONFIG:true}"
  sentinel:
    # name of master node
    master: "${REDIS_MASTER:}"
    # comma-separated list of "host:port" pairs of sentinels
    sentinels: "${REDIS_SENTINELS:}"
    # password to authenticate with sentinel
    password: "${REDIS_SENTINEL_PASSWORD:}"
    # if set false will be used pool config build from values of the pool config section
    useDefaultPoolConfig: "${REDIS_USE_DEFAULT_POOL_CONFIG:true}"
  # Redis logical database index to select after connecting.
  db: "${REDIS_DB:0}"
  # Password for Redis authentication (leave empty if not required).
  password: "${REDIS_PASSWORD:}"
  # Redis username for ACL authentication (Redis 6.0+). Leave empty for legacy password-only auth
  username: "${REDIS_USERNAME:}"
  ssl:
    # Enable/disable secure connection
    enabled: "${TB_REDIS_SSL_ENABLED:false}"
    # Server SSL credentials (only PEM format is supported)
    credentials:
      # Path redis server (CA) certificate
      cert_file: "${TB_REDIS_SSL_PEM_CERT:}"
      # Path to user certificate file. This is optional for the client and can be used for two-way authentication for the client
      user_cert_file: "${TB_REDIS_SSL_PEM_KEY:}"
      # Path to user private key file. This is optional for the client and only needed if ‘user_cert_file’ is configured.
      user_key_file: "${TB_REDIS_SSL_PEM_KEY_PASSWORD:}"
  # pool config
  pool_config:
    # Maximum number of connections that can be allocated by the connection pool
    maxTotal: "${REDIS_POOL_CONFIG_MAX_TOTAL:128}"
    # Maximum number of idle connections that can be maintained in the pool without being closed
    maxIdle: "${REDIS_POOL_CONFIG_MAX_IDLE:128}"
    # Minumum number of idle connections that can be maintained in the pool without being closed
    minIdle: "${REDIS_POOL_CONFIG_MIN_IDLE:16}"
    # Enable/Disable PING command send when a connection is borrowed
    testOnBorrow: "${REDIS_POOL_CONFIG_TEST_ON_BORROW:false}"
    # The property is used to specify whether to test the connection before returning it to the connection pool.
    testOnReturn: "${REDIS_POOL_CONFIG_TEST_ON_RETURN:false}"
    # The property is used in the context of connection pooling in Redis
    testWhileIdle: "${REDIS_POOL_CONFIG_TEST_WHILE_IDLE:true}"
    # Minimum amount of time that an idle connection should be idle before it can be evicted from the connection pool. Value set in milliseconds
    minEvictableMs: "${REDIS_POOL_CONFIG_MIN_EVICTABLE_MS:60000}"
    # Specifies the time interval in milliseconds between two consecutive eviction runs
    evictionRunsMs: "${REDIS_POOL_CONFIG_EVICTION_RUNS_MS:30000}"
    # Maximum time in milliseconds where a client is willing to wait for a connection from the pool when all connections are exhausted
    maxWaitMills: "${REDIS_POOL_CONFIG_MAX_WAIT_MS:60000}"
    # Specifies the number of connections to test for eviction during each eviction run
    numberTestsPerEvictionRun: "${REDIS_POOL_CONFIG_NUMBER_TESTS_PER_EVICTION_RUN:3}"
    # Determines the behavior when a thread requests a connection from the pool but there are no available connections and the pool cannot create more due to the maxTotal configuration
    blockWhenExhausted: "${REDIS_POOL_CONFIG_BLOCK_WHEN_EXHAUSTED:true}"

# LWM2M server parameters
# Session, JSON processing, RPC, logging, and LwM2M-specific transport settings including DTLS, bootstrap, and OTA.
transport:
  # Size of the thread pool that executes transport API callbacks (session registration, telemetry/attribute and RPC responses, entity update notifications, and the tenant profile fetch on a cache miss). Bounds how many such callbacks - including those that block on a backend round-trip - can run concurrently.
  callback_thread_pool_size: "${TB_TRANSPORT_CALLBACK_THREAD_POOL_SIZE:20}"
  sessions:
    # Session inactivity timeout is a global configuration parameter that defines how long the device transport session will be opened after the last message arrives from the device.
    # The parameter value is in milliseconds.
    # The last activity time of the device session is updated if the device sends any message, including keepalive messages
    # If there is no activity, the session will be closed, and all subscriptions will be deleted.
    # We recommend this parameter to be in sync with device inactivity timeout ("state.defaultInactivityTimeoutInSec" or DEFAULT_INACTIVITY_TIMEOUT) parameter
    # which is responsible for detection of the device connectivity status in the core service of the platform.
    # The value of the session inactivity timeout parameter should be greater or equal to the device inactivity timeout.
    # Note that the session inactivity timeout is set in milliseconds while device inactivity timeout is in seconds.
    inactivity_timeout: "${TB_TRANSPORT_SESSIONS_INACTIVITY_TIMEOUT:600000}"
    # Interval of periodic check for expired sessions and report of the changes to session last activity time
    report_timeout: "${TB_TRANSPORT_SESSIONS_REPORT_TIMEOUT:3000}"
  json:
    # Cast String data types to Numeric if possible when processing Telemetry/Attributes JSON
    type_cast_enabled: "${JSON_TYPE_CAST_ENABLED:false}"
    # Maximum allowed string value length when processing Telemetry/Attributes JSON (0 value disables string value length check)
    max_string_value_length: "${JSON_MAX_STRING_VALUE_LENGTH:0}"
  client_side_rpc:
    # Processing timeout interval of the RPC command on the CLIENT SIDE. Time in milliseconds
    timeout: "${CLIENT_SIDE_RPC_TIMEOUT:60000}"
  log:
    # Enable/Disable log of transport messages to telemetry. For example, logging of LwM2M registration update
    enabled: "${TB_TRANSPORT_LOG_ENABLED:true}"
    # Maximum length of the log message. The content will be truncated to the specified value if needed
    max_length: "${TB_TRANSPORT_LOG_MAX_LENGTH:1024}"
  # Local LwM2M transport parameters
  lwm2m:
    # Enable/disable lvm2m transport protocol.
    enabled: "${LWM2M_ENABLED:true}"
    dtls:
      # RFC7925_RETRANSMISSION_TIMEOUT_IN_MILLISECONDS = 9000
      retransmission_timeout: "${LWM2M_DTLS_RETRANSMISSION_TIMEOUT_MS:9000}"
      # LWM2M DTLS connection ID length for LWM2M. RFC 9146, Connection Identifier for DTLS 1.2
      # Default: off. <br>
      # Control usage of DTLS connection ID length (CID).
      # <ul> <li> 'off' to deactivate it. </li>
      # <li> 'on' to activate Connection ID support (same as CID 0 or more 0). </li>
      # <li> A positive value defines generated CID size in bytes.</li>
      # <li> A value of 0 means we accept using CID but will not generate one for foreign peer (enables support but not for incoming traffic). </li>
      # <li> A value between 0 and <= 4: SingleNodeConnectionIdGenerator is used </li>
      # <li> A value that are > 4: MultiNodeConnectionIdGenerator is used </li> </ul>
      connection_id_length: "${LWM2M_DTLS_CONNECTION_ID_LENGTH:8}"
    server:
      # LwM2M Server ID
      id: "${LWM2M_SERVER_ID:123}"
      # LwM2M server bind address. Bind to all interfaces by default
      bind_address: "${LWM2M_BIND_ADDRESS:0.0.0.0}"
      # LwM2M server bind port
      bind_port: "${LWM2M_BIND_PORT:5685}"
      security:
        # LwM2M server bind address for DTLS. Bind to all interfaces by default
        bind_address: "${LWM2M_SECURITY_BIND_ADDRESS:0.0.0.0}"
        # LwM2M server bind port for DTLS
        bind_port: "${LWM2M_SECURITY_BIND_PORT:5686}"
        # Server X509 Certificates support
        credentials:
          # Whether to enable LWM2M server X509 Certificate/RPK support
          enabled: "${LWM2M_SERVER_CREDENTIALS_ENABLED:false}"
          # Server credentials type (PEM - pem certificate file; KEYSTORE - java keystore)
          type: "${LWM2M_SERVER_CREDENTIALS_TYPE:PEM}"
          # PEM server credentials
          pem:
            # Path to the server certificate file (holds server certificate or certificate chain, may include server private key)
            cert_file: "${LWM2M_SERVER_PEM_CERT:lwm2mserver.pem}"
            # Path to the server certificate private key file. Optional by default. Required if the private key is not present in server certificate file;
            key_file: "${LWM2M_SERVER_PEM_KEY:lwm2mserver_key.pem}"
            # Server certificate private key password (optional)
            key_password: "${LWM2M_SERVER_PEM_KEY_PASSWORD:server_key_password}"
          # Keystore server credentials
          keystore:
            # Type of the key store (JKS or PKCS12)
            type: "${LWM2M_SERVER_KEY_STORE_TYPE:JKS}"
            # Path to the key store that holds the SSL certificate
            store_file: "${LWM2M_SERVER_KEY_STORE:lwm2mserver.jks}"
            # Password used to access the key store
            store_password: "${LWM2M_SERVER_KEY_STORE_PASSWORD:server_ks_password}"
            # Key alias
            key_alias: "${LWM2M_SERVER_KEY_ALIAS:server}"
            # Password used to access the key
            key_password: "${LWM2M_SERVER_KEY_PASSWORD:server_ks_password}"
        # Only Certificate_x509:
        skip_validity_check_for_client_cert: "${TB_LWM2M_SERVER_SECURITY_SKIP_VALIDITY_CHECK_FOR_CLIENT_CERT:false}"
    bootstrap:
      # Enable/disable Bootstrap Server
      enabled: "${LWM2M_ENABLED_BS:true}"
      # Default value in Lwm2mClient after start in mode Bootstrap for the object : name "LWM2M Security" field: "Short Server ID" (deviceProfile: Bootstrap.BOOTSTRAP SERVER.Short ID)
      id: "${LWM2M_SERVER_ID_BS:111}"
      # LwM2M bootstrap server bind address. Bind to all interfaces by default
      bind_address: "${LWM2M_BS_BIND_ADDRESS:0.0.0.0}"
      # LwM2M bootstrap server bind port
      bind_port: "${LWM2M_BS_BIND_PORT:5687}"
      security:
        # LwM2M bootstrap server bind address for DTLS. Bind to all interfaces by default
        bind_address: "${LWM2M_BS_SECURITY_BIND_ADDRESS:0.0.0.0}"
        # LwM2M bootstrap server bind address for DTLS. Bind to all interfaces by default
        bind_port: "${LWM2M_BS_SECURITY_BIND_PORT:5688}"
        # Bootstrap server X509 Certificates support
        credentials:
          # Whether to enable LWM2M bootstrap server X509 Certificate/RPK support
          enabled: "${LWM2M_BS_CREDENTIALS_ENABLED:false}"
          # Server credentials type (PEM - pem certificate file; KEYSTORE - java keystore)
          type:  "${LWM2M_BS_CREDENTIALS_TYPE:PEM}"
          # PEM server credentials
          pem:
            # Path to the server certificate file (holds server certificate or certificate chain, may include server private key)
            cert_file: "${LWM2M_BS_PEM_CERT:lwm2mserver.pem}"
            # Path to the server certificate private key file. Optional by default. Required if the private key is not present in server certificate file;
            key_file: "${LWM2M_BS_PEM_KEY:lwm2mserver_key.pem}"
            # Server certificate private key password (optional)
            key_password: "${LWM2M_BS_PEM_KEY_PASSWORD:server_key_password}"
          # Keystore server credentials
          keystore:
            # Type of the key store (JKS or PKCS12)
            type: "${LWM2M_BS_KEY_STORE_TYPE:JKS}"
            # Path to the key store that holds the SSL certificate
            store_file: "${LWM2M_BS_KEY_STORE:lwm2mserver.jks}"
            # Password used to access the key store
            store_password: "${LWM2M_BS_KEY_STORE_PASSWORD:server_ks_password}"
            # Key alias
            key_alias: "${LWM2M_BS_KEY_ALIAS:bootstrap}"
            # Password used to access the key
            key_password: "${LWM2M_BS_KEY_PASSWORD:server_ks_password}"
    security:
      # X509 trust certificates
      trust-credentials:
        # Whether to load X509 trust certificates
        enabled: "${LWM2M_TRUST_CREDENTIALS_ENABLED:false}"
        # Trust certificates store type (PEM - pem certificates file; KEYSTORE - java keystore)
        type:  "${LWM2M_TRUST_CREDENTIALS_TYPE:PEM}"
        # PEM certificates
        pem:
          # Path to the certificates file (holds trust certificates)
          cert_file: "${LWM2M_TRUST_PEM_CERT:lwm2mtruststorechain.pem}"
        # Keystore with trust certificates
        keystore:
          # Type of the key store (JKS or PKCS12)
          type: "${LWM2M_TRUST_KEY_STORE_TYPE:JKS}"
          # Path to the key store that holds the X509 certificates
          store_file: "${LWM2M_TRUST_KEY_STORE:lwm2mtruststorechain.jks}"
          # Password used to access the key store
          store_password: "${LWM2M_TRUST_KEY_STORE_PASSWORD:server_ks_password}"
      # Set usage of recommended cipher suites; true - allow only recommended cipher suites; false - allow not recommended cipher suites
      recommended_ciphers: "${LWM2M_RECOMMENDED_CIPHERS:false}"
      # Set usage of recommended supported groups (curves); true - allow only recommended supported groups, false - allow not recommended supported groups
      recommended_supported_groups: "${LWM2M_RECOMMENDED_SUPPORTED_GROUPS:true}"
    # Timeout of LwM2M operation
    timeout: "${LWM2M_TIMEOUT:120000}"
    # Thread pool size for processing of the LwM2M uplinks
    uplink_pool_size: "${LWM2M_UPLINK_POOL_SIZE:10}"
    # Thread pool size for processing of the LwM2M downlinks
    downlink_pool_size: "${LWM2M_DOWNLINK_POOL_SIZE:10}"
    # Thread pool size for processing of the OTA updates
    ota_pool_size: "${LWM2M_OTA_POOL_SIZE:10}"
    # Period of cleanup for the registrations in store
    clean_period_in_sec: "${LWM2M_CLEAN_PERIOD_IN_SEC:2}"
    # PSM Activity Timer if not specified in the device profile
    psm_activity_timer: "${LWM2M_PSM_ACTIVITY_TIMER:10000}"
    # Paging Transmission Window for eDRX support if not specified in the device profile
    paging_transmission_window: "${LWM2M_PAGING_TRANSMISSION_WINDOW:10000}"
    network_config: # In this section you can specify custom parameters for LwM2M network configuration and expose the env variables to configure outside
  #      - key: "PROTOCOL_STAGE_THREAD_COUNT"
  #        value: "${LWM2M_PROTOCOL_STAGE_THREAD_COUNT:4}"
  stats:
    # Enable/Disable the collection of transport statistics
    enabled: "${TB_TRANSPORT_STATS_ENABLED:true}"
    # Interval of transport statistics logging
    print-interval-ms: "${TB_TRANSPORT_STATS_PRINT_INTERVAL_MS:60000}"
  ssl:
    # SSL/TLS settings for the transport layer
    certificate:
      # X.509 certificate configuration to auto-detect and reload certificate used by transport protocols in real-time (MQTT, CoAP, LwM2M, etc.)
      reload:
        # Enable/disable automatic SSL certificates reload
        enabled: "${TB_TRANSPORT_SSL_CERTIFICATE_RELOAD_ENABLED:true}"
        # Check interval in seconds for certificates reload
        check_interval_seconds: "${TB_TRANSPORT_SSL_CERTIFICATE_RELOAD_CHECK_INTERVAL_SECONDS:60}"

# Queue configuration properties
# Defines the message queue backend (Kafka) and per-topic settings for transport, core, rule-engine, and JS evaluation.
queue:
  type: "${TB_QUEUE_TYPE:kafka}" # kafka (Apache Kafka)
  prefix: "${TB_QUEUE_PREFIX:}" # Global queue prefix. If specified, prefix is added before default topic name: 'prefix.default_topic_name'. Prefix is applied to all topics (and consumer groups for kafka).
  kafka:
    # Kafka Bootstrap Servers
    bootstrap.servers: "${TB_KAFKA_SERVERS:localhost:9092}"
    ssl:
      # Enable/Disable SSL Kafka communication
      enabled: "${TB_KAFKA_SSL_ENABLED:false}"
      # The location of the trust store file
      truststore.location: "${TB_KAFKA_SSL_TRUSTSTORE_LOCATION:}"
      # The password of trust store file if specified
      truststore.password: "${TB_KAFKA_SSL_TRUSTSTORE_PASSWORD:}"
      # The location of the key store file. This is optional for the client and can be used for two-way authentication for the client
      keystore.location: "${TB_KAFKA_SSL_KEYSTORE_LOCATION:}"
      # The store password for the key store file. This is optional for the client and only needed if ‘ssl.keystore.location’ is configured. Key store password is not supported for PEM format
      keystore.password: "${TB_KAFKA_SSL_KEYSTORE_PASSWORD:}"
      # The password of the private key in the key store file or the PEM key specified in ‘keystore.key’
      key.password: "${TB_KAFKA_SSL_KEY_PASSWORD:}"
    # The number of acknowledgments the producer requires the leader to have received before considering a request complete. This controls the durability of records that are sent. The following settings are allowed:0,1 and all
    acks: "${TB_KAFKA_ACKS:all}"
    # Number of retries. Resend any record whose send fails with a potentially transient error
    retries: "${TB_KAFKA_RETRIES:1}"
    # The compression type for all data generated by the producer. The default is none (i.e. no compression). Valid values: none, gzip or lz4
    compression.type: "${TB_KAFKA_COMPRESSION_TYPE:none}" # none, gzip or lz4
    # Default batch size. This setting gives the upper bound of the batch size to be sent
    batch.size: "${TB_KAFKA_BATCH_SIZE:16384}"
    # This variable creates a small amount of artificial delay—that is, rather than immediately sending out a record
    linger.ms: "${TB_KAFKA_LINGER_MS:1}"
    # The maximum size of a request in bytes. This setting will limit the number of record batches the producer will send in a single request to avoid sending huge requests
    max.request.size: "${TB_KAFKA_MAX_REQUEST_SIZE:1048576}"
    # The maximum number of unacknowledged requests the client will send on a single connection before blocking
    max.in.flight.requests.per.connection: "${TB_KAFKA_MAX_IN_FLIGHT_REQUESTS_PER_CONNECTION:5}"
    # The total bytes of memory the producer can use to buffer records waiting to be sent to the server
    buffer.memory: "${TB_BUFFER_MEMORY:33554432}"
    # The multiple copies of data over the multiple brokers of Kafka
    replication_factor: "${TB_QUEUE_KAFKA_REPLICATION_FACTOR:1}"
    # The maximum delay between invocations of poll() when using consumer group management. This places an upper bound on the amount of time that the consumer can be idle before fetching more records
    max_poll_interval_ms: "${TB_QUEUE_KAFKA_MAX_POLL_INTERVAL_MS:300000}"
    # The maximum number of records returned in a single call to poll()
    max_poll_records: "${TB_QUEUE_KAFKA_MAX_POLL_RECORDS:8192}"
    # The maximum amount of data per-partition the server will return. Records are fetched in batches by the consumer
    max_partition_fetch_bytes: "${TB_QUEUE_KAFKA_MAX_PARTITION_FETCH_BYTES:16777216}"
    # The maximum amount of data the server will return. Records are fetched in batches by the consumer
    fetch_max_bytes: "${TB_QUEUE_KAFKA_FETCH_MAX_BYTES:134217728}"
    request.timeout.ms: "${TB_QUEUE_KAFKA_REQUEST_TIMEOUT_MS:30000}" # (30 seconds) # refer to https://docs.confluent.io/platform/current/installation/configuration/producer-configs.html#producerconfigs_request.timeout.ms
    session.timeout.ms: "${TB_QUEUE_KAFKA_SESSION_TIMEOUT_MS:10000}" # (10 seconds) # refer to https://docs.confluent.io/platform/current/installation/configuration/consumer-configs.html#consumerconfigs_session.timeout.ms
    auto_offset_reset: "${TB_QUEUE_KAFKA_AUTO_OFFSET_RESET:earliest}" # earliest, latest or none
    # Enable/Disable using of Confluent Cloud
    use_confluent_cloud: "${TB_QUEUE_KAFKA_USE_CONFLUENT_CLOUD:false}"
    confluent:
      # The endpoint identification algorithm used by clients to validate server hostname. The default value is https
      ssl.algorithm: "${TB_QUEUE_KAFKA_CONFLUENT_SSL_ALGORITHM:https}"
      # The mechanism used to authenticate Schema Registry requests. SASL/PLAIN should only be used with TLS/SSL as a transport layer to ensure that clear passwords are not transmitted on the wire without encryption
      # Set to OAUTHBEARER to authenticate via OAuth2/OIDC client-credentials (configure the oauth.* settings below)
      sasl.mechanism: "${TB_QUEUE_KAFKA_CONFLUENT_SASL_MECHANISM:PLAIN}"
      # Using JAAS Configuration for specifying multiple SASL mechanisms on a broker
      sasl.config: "${TB_QUEUE_KAFKA_CONFLUENT_SASL_JAAS_CONFIG:org.apache.kafka.common.security.plain.PlainLoginModule required username=\"CLUSTER_API_KEY\" password=\"CLUSTER_API_SECRET\";}"
      # Protocol used to communicate with brokers. Valid values are: PLAINTEXT, SSL, SASL_PLAINTEXT, SASL_SSL
      security.protocol: "${TB_QUEUE_KAFKA_CONFLUENT_SECURITY_PROTOCOL:SASL_SSL}"
      # Optional: OAuth2 (OIDC) client-credentials settings. Applied only when sasl.mechanism is OAUTHBEARER.
      # ThingsBoard wires Kafka's built-in OAuthBearerLoginCallbackHandler; the token is fetched and refreshed automatically.
      oauth:
        # Optional: OAuth2 client id
        client-id: "${TB_QUEUE_KAFKA_CONFLUENT_OAUTH_CLIENT_ID:}"
        # Optional: OAuth2 client secret
        client-secret: "${TB_QUEUE_KAFKA_CONFLUENT_OAUTH_CLIENT_SECRET:}"
        # Optional: OAuth2/OIDC token endpoint URL to request the bearer token from
        endpoint-url: "${TB_QUEUE_KAFKA_CONFLUENT_OAUTH_ENDPOINT_URL:}"
        # Optional: OAuth2 scope/audience requested for the token. Required by some IdPs for client-credentials (e.g. Azure AD's "api://<id>/.default")
        scope: "${TB_QUEUE_KAFKA_CONFLUENT_OAUTH_SCOPE:}"
    # If you override any default Kafka topic name using environment variables, you must also specify the related consumer properties
    # for the new topic in `consumer-properties-per-topic-inline`. Otherwise, the topic will not inherit its expected configuration (e.g., max.poll.records, timeouts, etc).
    # Format: "topic1:key1=value1,key2=value2;topic2:key=value"
    # Example: "tb_core_modified.notifications:max.poll.records=10;tb_edge_modified:max.poll.records=10,enable.auto.commit=true"
    consumer-properties-per-topic-inline: "${TB_QUEUE_KAFKA_CONSUMER_PROPERTIES_PER_TOPIC_INLINE:}"
    other-inline: "${TB_QUEUE_KAFKA_OTHER_PROPERTIES:}" # In this section you can specify custom parameters (semicolon separated) for Kafka consumer/producer/admin # Example "metrics.recording.level:INFO;metrics.sample.window.ms:30000"
    other: # DEPRECATED. In this section you can specify custom parameters for Kafka consumer/producer and expose the env variables to configure outside
    #  - key: "request.timeout.ms" # refer to https://docs.confluent.io/platform/current/installation/configuration/producer-configs.html#producerconfigs_request.timeout.ms
    #    value: "${TB_QUEUE_KAFKA_REQUEST_TIMEOUT_MS:30000}" # (30 seconds)
    #  - key: "session.timeout.ms" # refer to https://docs.confluent.io/platform/current/installation/configuration/consumer-configs.html#consumerconfigs_session.timeout.ms
    #    value: "${TB_QUEUE_KAFKA_SESSION_TIMEOUT_MS:10000}" # (10 seconds)
    topic-properties:
      # Kafka properties for Rule Engine
      rule-engine: "${TB_QUEUE_KAFKA_RE_TOPIC_PROPERTIES:retention.ms:604800000;segment.bytes:52428800;retention.bytes:1048576000;partitions:1;min.insync.replicas:1}"
      # Kafka properties for Core topics
      core: "${TB_QUEUE_KAFKA_CORE_TOPIC_PROPERTIES:retention.ms:604800000;segment.bytes:52428800;retention.bytes:1048576000;partitions:1;min.insync.replicas:1}"
      # Kafka properties for Transport Api topics
      transport-api: "${TB_QUEUE_KAFKA_TA_TOPIC_PROPERTIES:retention.ms:604800000;segment.bytes:52428800;retention.bytes:1048576000;partitions:10;min.insync.replicas:1}"
      # Kafka properties for Notifications topics
      notifications: "${TB_QUEUE_KAFKA_NOTIFICATIONS_TOPIC_PROPERTIES:retention.ms:604800000;segment.bytes:52428800;retention.bytes:1048576000;partitions:1;min.insync.replicas:1}"
      # Kafka properties for Housekeeper tasks topic
      housekeeper: "${TB_QUEUE_KAFKA_HOUSEKEEPER_TOPIC_PROPERTIES:retention.ms:604800000;segment.bytes:52428800;retention.bytes:1048576000;partitions:10;min.insync.replicas:1}"
    # Topics cache TTL in milliseconds. 5 minutes by default
    topics_cache_ttl_ms: "${TB_QUEUE_KAFKA_TOPICS_CACHE_TTL_MS:300000}"
  partitions:
    hash_function_name: "${TB_QUEUE_PARTITIONS_HASH_FUNCTION_NAME:murmur3_128}"  # murmur3_32, murmur3_128 or sha256
  transport_api:
    # Topic used to consume api requests from transport microservices
    requests_topic: "${TB_QUEUE_TRANSPORT_API_REQUEST_TOPIC:tb_transport.api.requests}"
    # Topic used to produce api responses to transport microservices
    responses_topic: "${TB_QUEUE_TRANSPORT_API_RESPONSE_TOPIC:tb_transport.api.responses}"
    # Maximum pending api requests from transport microservices to be handled by server
    max_pending_requests: "${TB_QUEUE_TRANSPORT_MAX_PENDING_REQUESTS:10000}"
    # Maximum timeout in milliseconds to handle api request from transport microservice by server
    max_requests_timeout: "${TB_QUEUE_TRANSPORT_MAX_REQUEST_TIMEOUT:10000}"
    # Amount of threads used to invoke callbacks
    max_callback_threads: "${TB_QUEUE_TRANSPORT_MAX_CALLBACK_THREADS:100}"
    # Interval in milliseconds to poll api requests from transport microservices
    request_poll_interval: "${TB_QUEUE_TRANSPORT_REQUEST_POLL_INTERVAL_MS:25}"
    # Interval in milliseconds to poll api response from transport microservices
    response_poll_interval: "${TB_QUEUE_TRANSPORT_RESPONSE_POLL_INTERVAL_MS:25}"
  core:
    # Default topic name
    topic: "${TB_QUEUE_CORE_TOPIC:tb_core}"
    # For high-priority notifications that require minimum latency and processing time
    notifications_topic: "${TB_QUEUE_CORE_NOTIFICATIONS_TOPIC:tb_core.notifications}"
    # Interval in milliseconds to poll messages by Core microservices
    poll-interval: "${TB_QUEUE_CORE_POLL_INTERVAL_MS:25}"
    # Amount of partitions used by Core microservices
    partitions: "${TB_QUEUE_CORE_PARTITIONS:10}"
    # Timeout for processing a message pack by Core microservices
    pack-processing-timeout: "${TB_QUEUE_CORE_PACK_PROCESSING_TIMEOUT_MS:60000}"
    stats:
      # Enable/disable statistics for Core microservices
      enabled: "${TB_QUEUE_CORE_STATS_ENABLED:false}"
      # Statistics printing interval for Core microservices
      print-interval-ms: "${TB_QUEUE_CORE_STATS_PRINT_INTERVAL_MS:10000}"
    housekeeper:
      # Topic name for Housekeeper tasks
      topic: "${TB_HOUSEKEEPER_TOPIC:tb_housekeeper}"
  js:
    # JS Eval request topic
    request_topic: "${REMOTE_JS_EVAL_REQUEST_TOPIC:js_eval.requests}"
    # JS Eval responses topic prefix that is combined with node id
    response_topic_prefix: "${REMOTE_JS_EVAL_RESPONSE_TOPIC:js_eval.responses}"
    # JS Eval max pending requests
    max_pending_requests: "${REMOTE_JS_MAX_PENDING_REQUESTS:10000}"
    # JS Eval max request timeout
    max_requests_timeout: "${REMOTE_JS_MAX_REQUEST_TIMEOUT:10000}"
    # JS response poll interval
    response_poll_interval: "${REMOTE_JS_RESPONSE_POLL_INTERVAL_MS:25}"
    # JS response auto commit interval
    response_auto_commit_interval: "${REMOTE_JS_RESPONSE_AUTO_COMMIT_INTERVAL_MS:100}"
  rule-engine:
    # Deprecated. It will be removed in the nearest releases
    topic: "${TB_QUEUE_RULE_ENGINE_TOPIC:tb_rule_engine}"
    # For high-priority notifications that require minimum latency and processing time
    notifications_topic: "${TB_QUEUE_RULE_ENGINE_NOTIFICATIONS_TOPIC:tb_rule_engine.notifications}"
    # Interval in milliseconds to poll messages by Rule Engine
    poll-interval: "${TB_QUEUE_RULE_ENGINE_POLL_INTERVAL_MS:25}"
    # Timeout for processing a message pack of Rule Engine
    pack-processing-timeout: "${TB_QUEUE_RULE_ENGINE_PACK_PROCESSING_TIMEOUT_MS:60000}"
    stats:
      # Enable/disable statistics for Rule Engine
      enabled: "${TB_QUEUE_RULE_ENGINE_STATS_ENABLED:true}"
      # Statistics printing interval for Rule Engine
      print-interval-ms: "${TB_QUEUE_RULE_ENGINE_STATS_PRINT_INTERVAL_MS:60000}"
  transport:
    # For high priority notifications that require minimum latency and processing time
    notifications_topic: "${TB_QUEUE_TRANSPORT_NOTIFICATIONS_TOPIC:tb_transport.notifications}"
    # Interval in milliseconds to poll messages
    poll_interval: "${TB_QUEUE_TRANSPORT_NOTIFICATIONS_POLL_INTERVAL_MS:25}"

# Service common parameters
# Identifies the service type and its unique instance ID within a ThingsBoard cluster.
service:
  type: "${TB_SERVICE_TYPE:tb-transport}" # service type
  # Unique id for this service (autogenerated if empty)
  id: "${TB_SERVICE_ID:}"

# Usage statistics parameters
# Controls reporting of API usage statistics at system, tenant, and optionally customer level.
usage:
  stats:
    report:
      # Enable/Disable the collection of statistics about API usage. Collected on a system and tenant level by default
      enabled: "${USAGE_STATS_REPORT_ENABLED:true}"
      # Enable/Disable collection of statistics about API usage on a customer level
      enabled_per_customer: "${USAGE_STATS_REPORT_PER_CUSTOMER_ENABLED:false}"
      # Interval of reporting the statistics. By default, the summarized statistics are sent every 10 seconds
      interval: "${USAGE_STATS_REPORT_INTERVAL:60}"
      # Reporting interval for urgent keys (e.g. SMS, Email) that require quicker usage state updates
      urgent_interval: "${USAGE_STATS_REPORT_URGENT_INTERVAL:10}"
      # Amount of statistic messages in pack
      pack_size: "${USAGE_STATS_REPORT_PACK_SIZE:1024}"

# Metrics parameters
# Enables or disables Actuator-based metrics collection (e.g., Prometheus endpoint).
metrics:
  # Enable/disable actuator metrics.
  enabled: "${METRICS_ENABLED:false}"

# General management parameters
# Configures Spring Boot Actuator endpoint exposure, e.g. for Prometheus metrics scraping.
management:
  endpoints:
    web:
      exposure:
        # Expose metrics endpoint (use value 'prometheus' to enable prometheus metrics).
        include: "${METRICS_ENDPOINTS_EXPOSE:info}"

# Notification system parameters
# Configures deduplication rules for notification triggers to prevent repeated alerts within a time window.
notification_system:
  rules:
    # Semicolon-separated deduplication durations (in millis) for trigger types. Format: 'NotificationRuleTriggerType1:123;NotificationRuleTriggerType2:456'
    deduplication_durations: "${TB_NOTIFICATION_RULES_DEDUPLICATION_DURATIONS:RATE_LIMITS:14400000;}"
