example-zowe.yaml

################################################################################
# This program and the accompanying materials are made available under the terms of the
# Eclipse Public License v2.0 which accompanies this distribution, and is available at
# https://www.eclipse.org/legal/epl-v20.html
#
# SPDX-License-Identifier: EPL-2.0
#
# Copyright Contributors to the Zowe Project.
################################################################################

#===============================================================================
# This is a YAML configuration file for Zowe instance.
#
# YAML is a human-friendly data serialization language for all programming languages.
# To learn more about YAML specifications, please check https://yaml.org/.
#
# To learn more details about the entries, please check https://docs.zowe.org/.
#
# For first time users, or for the most common use cases, please pay more
# attention on the entries marked with "**COMMONLY_CUSTOMIZED**".
#
# If you modify any settings listed in "zwe init --help" command, you may need to
# re-run "zwe init" command to make them take effect.
#===============================================================================

#-------------------------------------------------------------------------------
# Zowe global configurations
#
# This section includes Zowe setup information used by `zwe install` and
# `zwe init` command, as well as default configurations for Zowe runtime.
#-------------------------------------------------------------------------------
zowe:

  #-------------------------------------------------------------------------------
  # These configurations are used by "zwe install" or "zwe init" commands.
  #-------------------------------------------------------------------------------
  setup:
    # MVS data set related configurations
    dataset:
      # **COMMONLY_CUSTOMIZED**
      # where Zowe MVS data sets will be installed
      prefix: IBMUSER.ZWEV2
      # **COMMONLY_CUSTOMIZED**
      # PROCLIB where Zowe STCs will be copied over
      proclib: USER.PROCLIB
      # **COMMONLY_CUSTOMIZED**
      # Zowe PARMLIB
      parmlib: IBMUSER.ZWEV2.CUST.PARMLIB
      # **COMMONLY_CUSTOMIZED**
      # JCL library where Zowe will store temporary JCLs during initialization
      jcllib: IBMUSER.ZWEV2.CUST.JCLLIB
      # APF authorized LOADLIB for Zowe
      authLoadlib: "${{ zowe.setup.dataset.prefix }}.SZWEAUTH"
      # **COMMONLY_CUSTOMIZED**
      # APF authorized LOADLIB for Zowe ZIS Plugins
      authPluginLib: IBMUSER.ZWEV2.CUST.ZWESAPL

    # >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
    # # Security related configurations. This setup is optional.
    # security:
    #   # security product name. Can be RACF, ACF2 or TSS
    #   product: RACF
    #   # security group name
    #   groups:
    #     # Zowe admin user group
    #     admin: ZWEADMIN
    #     # Zowe STC group
    #     stc: ZWEADMIN
    #     # Zowe SysProg group
    #     sysProg: ZWEADMIN
    #   # security user name
    #   users:
    #     # Zowe runtime user name of main service
    #     zowe: ZWESVUSR
    #     # Zowe runtime user name of ZIS
    #     zis: ZWESIUSR
    #   # STC names
    #   stcs:
    #     # STC name of Zowe main service
    #     zowe: ZWESLSTC
    #     # STC name of Zowe ZIS
    #     zis: ZWESISTC
    #     # STC name of Zowe ZIS Auxiliary Server
    #     aux: ZWESASTC

    # >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
    # Certificate related configurations
    #
    # There are 5 configurations cases. Please choose one from below.

    # >>>> Certificate setup scenario 1
    # PKCS12 (keystore) with Zowe generate certificates.
    certificate:
      # Type of certificate storage. Valid values are: PKCS12 or JCERACFKS
      type: PKCS12
      pkcs12:
        # **COMMONLY_CUSTOMIZED**
        # Keystore directory
        directory: /var/zowe/keystore
        # # Lock the keystore directory to only accessible by Zowe runtime user and group.
        # lock: true
        # **COMMONLY_CUSTOMIZED**
        # # Certificate alias name. Optional, default value is localhost.
        # # Note: please use all lower cases as alias.
        # name: localhost
        # **COMMONLY_CUSTOMIZED**
        # # Keystore password. Optional, default value is password.
        # password: password
        # **COMMONLY_CUSTOMIZED**
        # # Alias name of self-signed certificate authority. Optional, default value is local_ca.
        # # Note: please use all lower cases as alias.
        # caAlias: local_ca
        # **COMMONLY_CUSTOMIZED**
        # # Password of keystore stored self-signed certificate authority. Optional, default value is local_ca_password.
        # caPassword: local_ca_password
      # # Distinguished name for Zowe generated certificates. All optional.
      # dname:
      #   caCommonName: ""
      #   commonName: ""
      #   orgUnit: ""
      #   org: ""
      #   locality: ""
      #   state: ""
      #   country: ""
      # # Validity days for Zowe generated certificates
      # validity: 3650
      # # Domain names and IPs should be added into certificate SAN
      # # If this field is not defined, `zwe init` command will use
      # # `zowe.externalDomains`.
      # san:
      #   # sample domain name
      #   - dvipa.my-company.com
      #   # sample IP address
      #   - 12.34.56.78

    # # >>>> Certificate setup scenario 2
    # # PKCS12 (keystore) with importing certificate generated by other CA.
    # certificate:
    #   # Type of certificate storage. Valid values are: PKCS12 or JCERACFKS
    #   type: PKCS12
    #   pkcs12:
    #     # **COMMONLY_CUSTOMIZED**
    #     # Keystore directory
    #     directory: /var/zowe/keystore
    #     # Lock the keystore directory to only accessible by Zowe runtime user and group.
    #     lock: true
    #     # # Certificate alias name. Optional, default value is localhost.
    #     # # Note: please use all lower cases as alias.
    #     # name: localhost
    #     # # Keystore password. Optional, default value is password.
    #     # password: password
    #     import:
    #       # **COMMONLY_CUSTOMIZED**
    #       # Existing PKCS12 keystore which holds the certificate issued by external CA.
    #       keystore: ""
    #       # **COMMONLY_CUSTOMIZED**
    #       # Password of the above keystore
    #       password: ""
    #       # **COMMONLY_CUSTOMIZED**
    #       # Certificate alias will be imported
    #       # Note: please use all lower cases as alias.
    #       alias: ""
    #   # **COMMONLY_CUSTOMIZED**
    #   # PEM format certificate authorities will also be imported and trusted.
    #   importCertificateAuthorities:
    #     # Path to the certificate authority signed the certificate will be imported.
    #     - ""

    # # >>>> Certificate setup scenario 3
    # # JCERACFKS (z/OS Keyring) with Zowe generated certificates.
    # certificate:
    #   # Type of certificate storage. Valid values are: PKCS12 or JCERACFKS
    #   type: JCERACFKS
    #   keyring:
    #     # **COMMONLY_CUSTOMIZED**
    #     # keyring name
    #     name: ZoweKeyring
    #     # **COMMONLY_CUSTOMIZED**
    #     # # Label of Zowe certificate. Optional, default value is localhost.
    #     # label: localhost
    #     # **COMMONLY_CUSTOMIZED**
    #     # # label of Zowe CA certificate. Optional, default value is localca.
    #     # caLabel: localca
    #   # # Distinguished name for Zowe generated certificates. All optional.
    #   # dname:
    #   #   caCommonName: ""
    #   #   commonName: ""
    #   #   orgUnit: ""
    #   #   org: ""
    #   #   locality: ""
    #   #   state: ""
    #   #   country: ""
    #   # # Validity days for Zowe generated certificates
    #   # validity: 3650
    #   # # Domain names and IPs should be added into certificate SAN
    #   # # If this field is not defined, `zwe init` command will use
    #   # # `zowe.externalDomains`.
    #   # # **NOTE**: due to the limitation of RACDCERT command, this field should
    #   # #           contain exactly 2 entries with the domain name and IP address.
    #   # san:
    #   #   - dvipa.my-company.com
    #   #   - 12.34.56.78

    # # >>>> Certificate setup scenario 4
    # # JCERACFKS (z/OS Keyring) and connect to existing certificate
    # certificate:
    #   # Type of certificate storage. Valid values are: PKCS12 or JCERACFKS
    #   type: JCERACFKS
    #   keyring:
    #     # **COMMONLY_CUSTOMIZED**
    #     # keyring name
    #     name: ZoweKeyring
    #     connect:
    #       # **COMMONLY_CUSTOMIZED**
    #       # Current owner of the existing certificate, can be SITE or an user ID.
    #       user: IBMUSER
    #       # **COMMONLY_CUSTOMIZED**
    #       # Label of the existing certificate will be connected to Zowe keyring.
    #       label: ""
    #   # **COMMONLY_CUSTOMIZED**
    #   # If you have other certificate authorities want to be trusted in Zowe keyring,
    #   # list the certificate labels here.
    #   # **NOTE**, due to the limitation of RACDCERT command, this field should
    #   #           contain maximum 2 entries.
    #   importCertificateAuthorities:
    #     - ""

    # # >>>> Certificate setup scenario 5
    # # JCERACFKS (z/OS Keyring) with importing certificate stored in data set
    # certificate:
    #   # Type of certificate storage. Valid values are: PKCS12 or JCERACFKS
    #   type: JCERACFKS
    #   keyring:
    #     # **COMMONLY_CUSTOMIZED**
    #     # keyring name
    #     name: ZoweKeyring
    #     # **COMMONLY_CUSTOMIZED**
    #     # # Label of Zowe certificate. Optional, default value is localhost.
    #     # label: localhost
    #     import:
    #       # **COMMONLY_CUSTOMIZED**
    #       # Name of the data set holds the certificate issued by other CA.
    #       # This data set should be in PKCS12 format and contain private key.
    #       dsName: ""
    #       # **COMMONLY_CUSTOMIZED**
    #       # Password for the PKCS12 data set.
    #       password: ""

    # >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
    # VSAM configurations if you are using VSAM as Caching Service storage
    vsam:
      # VSAM data set with Record-Level-Sharing enabled or not
      # Valid values could be: NONRLS or RLS.
      mode: NONRLS
      # Volume name if you are using VSAM in NONRLS mode
      volume: ""
      # Storage class name if you are using VSAM in RLS mode
      storageClass: ""

  # >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
  # **COMMONLY_CUSTOMIZED**
  # Zowe runtime (root) directory
  #
  # **NOTE**: if it's not specified and you passed "--update-config" argument
  # when you run "zwe init" command, this value will be updated with the Zowe
  # runtime where the "zwe" command is located.
  #
  # This value is required by ZWESLSTC to know where is Zowe runtime.
  runtimeDirectory: ""

  # **COMMONLY_CUSTOMIZED**
  # Where to store runtime logs
  logDirectory: /global/zowe/logs

  # **COMMONLY_CUSTOMIZED**
  # Zowe runtime workspace directory
  workspaceDirectory: /global/zowe/workspace

  # **COMMONLY_CUSTOMIZED**
  # Where extensions are installed
  extensionDirectory: /global/zowe/extensions

  # >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
  # runtime z/OS job name
  job:
    # Zowe JES job name
    name: ZWE1SV
    # Prefix of component address space
    prefix: ZWE1

  # >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
  # This is an ID you use to separate multiple Zowe installs when determining
  # resource names used in RBAC authorization checks such as dataservices with RBAC
  # expects this ID in SAF resources 
  rbacProfileIdentifier: "1"

  # >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
  # This is an ID that can be used by servers that distinguish their cookies from unrelated Zowe installs, 
  # for purposes such as to allow multiple copies of Zowe to be used within the same client
  cookieIdentifier: "1"

  # >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
  # **COMMONLY_CUSTOMIZED**
  # You can list your external domains how you want to access Zowe.
  # This should be the domain list you would like to put into your web browser
  # address bar.
  externalDomains:
    # this should be the domain name to access Zowe APIML Gateway
    - sample-domain.com
  
  # >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
  # This is the port you use to access Zowe Gateway from your web browser.
  #
  # In many use cases, this should be same as `components.gateway.port`. But in
  # some use cases, like containerization, this port could be different.
  externalPort: 7554

  # >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
  # You can un-comment and define any extra environment variables as key/value
  # pairs here.
  # environments:
  #   # Example of a global environment variable for all components
  #   MY_ENV_VAR: my_env_val

  #   # Another example to customize SSH port for VT Terminal Desktop app
  #   ZWED_SSH_PORT: 22
  #   ZWED_TN3270_PORT: 23

  # >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
  # Enable debug mode for zowe launch scripts
  launchScript:
    # set to "debug" or "trace" to display extra debug information
    logLevel: "INFO"

  # >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
  # Default Zowe certificate
  #
  # **NOTE**: these fields can be updated automatically if you pass
  # `--update-config` to `zwe init` command. The generated value will base on
  # your setup in `zowe.setup.certificate` section.
  certificate:
    keystore:
      type: PKCS12
      file: /global/zowe/keystore/localhost/localhost.keystore.p12
      password: password
      alias: localhost
    truststore:
      type: PKCS12
      file: /global/zowe/keystore/localhost/localhost.truststore.p12
      password: password
    pem:
      key: /global/zowe/keystore/localhost/localhost.key
      certificate: /global/zowe/keystore/localhost/localhost.cer
      certificateAuthorities: /global/zowe/keystore/local_ca/local_ca.cer

  # >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
  # How we want to verify SSL certificates of services. Valid values are:
  # - STRICT:    will validate if the certificate is trusted in our trust store and
  #              if the certificate Command Name and Subject Alternative Name (SAN)
  #              is validate. This is recommended for the best security.
  # - NONSTRICT: will validate if the certificate is trusted in our trust store.
  #              This mode does not validate certificate Common Name and Subject
  #              Alternative Name (SAN).
  # - DISABLED:  disable certificate validation. This is NOT recommended for
  #              security 
  verifyCertificates: STRICT


#-------------------------------------------------------------------------------
# Java configuration
#
# Some Zowe components requires Java. Define the path where you have your Java
# is installed.
#
# **NOTE**: this field can be updated automatically if you pass `--update-config`
# to `zwe init` command.
#-------------------------------------------------------------------------------
java:
  # **COMMONLY_CUSTOMIZED**
  # Path to your Java home directory
  home: ""


#-------------------------------------------------------------------------------
# node.js configuration
#
# Some Zowe components requires node.js. Define the path where you have your
# node.js is installed.
#
# **NOTE**: this field can be updated automatically if you pass `--update-config`
# to `zwe init` command.
#-------------------------------------------------------------------------------
node:
  # **COMMONLY_CUSTOMIZED**
  # Path to your node.js home directory
  home: ""


#-------------------------------------------------------------------------------
# z/OSMF configuration
#
# If your Zowe instance is configured to use z/OSMF for authentication or other
# features. You need to define how to access your z/OSMF instance.
#-------------------------------------------------------------------------------
zOSMF:
  # **COMMONLY_CUSTOMIZED**
  # host name of your z/OSMF instance
  host: dvipa.my-company.com
  # **COMMONLY_CUSTOMIZED**
  port: 443
  applId: IZUDFLT


#-------------------------------------------------------------------------------
# Zowe components default configurations
#
# This section includes default configurations for all Zowe components installed
# on the Zowe instance.
#
# Every component should define their own section under `components` with their
# component ID.
#
# For each component, they can always have "enabled" property and "certificate"
# property. More configurations for each component can be found in component
# manifest file.
#-------------------------------------------------------------------------------
components:

  # >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
  gateway:
    enabled: true
    port: 7554
    debug: false

    apiml:
      security:
        auth:
          provider: zosmf
          zosmf:
            jwtAutoconfiguration: auto
            serviceId: zosmf
        authorization:
          endpoint:
            enabled: false
          provider: ""
        x509:
          enabled: false
    server:
      internal:
      # gateway supports internal connector
        enabled: false
        port: 7550
        ssl:
          enabled: false
          # internal connector can use different certificate
          # certificate:
          #   keystore:
          #     alias: ""

    # If we customize this to use different external certificate, than should also
    # define "server.internal.ssl.certificate" and enable "server.internal.ssl.enabled".
    # certificate:
    #   keystore:
    #     alias: ""

  # >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
  metrics-service:
    enabled: false
    port: 7551
    debug: false

  # >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
  api-catalog:
    enabled: true
    port: 7552
    debug: false

  # >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
  discovery:
    enabled: true
    port: 7553
    debug: false
    # Define this value to match your number of Discovery StatefulSet if you are running containerized Zowe
    # replicas: 1

  # >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
  caching-service:
    enabled: true
    port: 7555
    debug: false

    storage:
      evictionStrategy: reject
      # can be inMemory, VSAM or redis
      mode: VSAM
      size: 10000
      vsam:
        # your VSAM data set created by "zwe init vsam" command or ZWECSVSM JCL
        # this is required if storage mode is VSAM
        name: ""

  # >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
  app-server:
    enabled: true
    port: 7556
    # we can customize any component with custom certificate
    # the missing definitions will be picked from "zowe.certificate"
    # certificate:
    #   keystore:
    #     alias: app-server
    #   pem:
    #     key: /global/zowe/keystore/localhost/localhost.keystore.app-server.key
    #     certificate: /global/zowe/keystore/localhost/localhost.keystore.app-server.cer-ebcdic

  # >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
  zss:
    enabled: true
    port: 7557
    crossMemoryServerName: ZWESIS_STD
    tls: true
    agent:
      jwt:
        fallback: true

  # >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
  jobs-api:
    enabled: false
    debug: false
    port: 7558

  # >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
  files-api:
    enabled: false
    debug: false
    port: 7559

  # >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
  explorer-jes:
    enabled: true

  # >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
  explorer-mvs:
    enabled: true

  # >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
  explorer-uss:
    enabled: true

  # >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
  # Each extension can have dedicated definition similar to core components.
  # my-extension:
  #   enabled: true


#-------------------------------------------------------------------------------
# Zowe high availability instances customizations
#
# This section includes customizations for each Zowe high availability instance.
#
# You can start each HA instance with `zwe start --ha-instance <ha-instance>`.
#-------------------------------------------------------------------------------
# haInstances:
#
#   # HA instance ID
#   lpar1:
#     # hostname where this instance will be started
#     hostname: lpar1.my-company.com
#     # Your &SYSNAME for this LPAR
#     # This sysname will be used to route your JES command to target system.
#     sysname: LPR1
#     # for this HA instance, we didn't customize "components", so it will use default value.
  
#   # HA instance ID, we will start 2 instances on LPAR2
#   # **NOTE**, we can only start one gateway in same LPAR.
#   lpar2a:
#     # hostname where this instance will be started
#     hostname: lpar2.my-company.com
#     # Your &SYSNAME for this LPAR
#     # This sysname will be used to route your JES command to target system.
#     sysname: LPR2

#     # These configurations will overwrite highest level default "components" configuration
#     components:
#       discovery:
#         # use customized port on this instance
#         port: 17553
#       api-catalog:
#         port: 17552
#       app-server:
#         # no app-server in this instance
#         enabled: false
#       zss:
#         # no app-server in this instance
#         enabled: false
#       jobs-api:
#         port: 18545
#         enabled: true
#       files-api:
#         port: 18547
#         enabled: true
#       caching-service:
#         port: 17555
#
#   lpar2b:
#     hostname: lpar2.my-company.com
#     # your &SYSNAME for this LPAR
#     sysname: LPR2

#     # These configurations will overwrite highest level default "components" configuration
#     components:
#       gateway:
#         enabled: false
#       discovery:
#         enabled: false
#       api-catalog:
#         enabled: false
#       app-server:
#         enabled: false
#         port: 28544
#       zss:
#         port: 28542
#       jobs-api:
#         enabled: true
#       files-api:
#         enabled: false
#       caching-service:
#         enabled: false