############## Search Guard 7 configuration ###############

# Add the following settings to your standard elasticsearch.yml 
# Settings must always be the same on all nodes in the cluster (there are a few exceptions though).
# This is not a complete list of all configuration otions.
# Please refer to https://docs.search-guard.com for more details and advanced configuration options.

#############################################################################################
# Transport layer SSL                                                                       #
#                                                                                           #
#############################################################################################
# Enable or disable node-to-node ssl encryption (default: true)
#searchguard.ssl.transport.enabled: false
# JKS or PKCS12 (default: JKS)
#searchguard.ssl.transport.keystore_type: PKCS12
# Relative path to the keystore file (mandatory, this stores the server certificates), must be placed under the config/ dir
#searchguard.ssl.transport.keystore_filepath: keystore_node1.jks
# Alias name (default: first alias which could be found)
#searchguard.ssl.transport.keystore_alias: my_alias
# Keystore password (default: changeit)
#searchguard.ssl.transport.keystore_password: changeit

# JKS or PKCS12 (default: JKS)
#searchguard.ssl.transport.truststore_type: PKCS12
# Relative path to the truststore file (mandatory, this stores the client/root certificates), must be placed under the config/ dir
#searchguard.ssl.transport.truststore_filepath: truststore.jks
# Alias name (default: trust all aliases)
#searchguard.ssl.transport.truststore_alias: my_alias
# Truststore password (default: changeit)
#searchguard.ssl.transport.truststore_password: changeit
# Enforce hostname verification (default: true)
#searchguard.ssl.transport.enforce_hostname_verification: true
# If hostname verification is enabled specify if hostname should be resolved (default: true)
#searchguard.ssl.transport.resolve_hostname: true

# As an alternative to JKS/PCKS12 based configuration 
# you can also use X.509 PEM certificates and PKCS #8 keys.
# This, for example, makes it pretty easy to configure letsencrypt certificates.

# Relative path to the certificates key file (PKCS #8), must be placed under the config/ dir
#searchguard.ssl.transport.pemkey_filepath: privkey.pem
# Key password (omit this setting if the key has no password)
#searchguard.ssl.transport.pemkey_password: "secret"
# X509 node certificate chain in PEM format, must be placed under the config/ dir
#searchguard.ssl.transport.pemcert_filepath: fullchain.pem
# Trusted certificates
#searchguard.ssl.transport.pemtrustedcas_filepath: chain.pem
    

# Enabled SSL cipher suites for transport protocol (only Java format is supported)
# WARNING: Expert setting, do only use if you know what you are doing
# If you set wrong values here this this could be a security risk
#searchguard.ssl.transport.enabled_ciphers:
#  - "TLS_DHE_RSA_WITH_AES_256_CBC_SHA"
#  - "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256"
  
# Enabled SSL protocols for transport protocol (only Java format is supported)
# WARNING: Expert setting, do only use if you know what you are doing
# If you set wrong values here this this could be a security risk  
#searchguard.ssl.transport.enabled_protocols:
#  - "TLSv1.2"

#############################################################################################
# HTTP/REST layer SSL                                                                       #
#                                                                                           #
#############################################################################################
# Enable or disable rest layer security - https, (default: false)
#searchguard.ssl.http.enabled: true
# JKS or PKCS12 (default: JKS)
#searchguard.ssl.http.keystore_type: PKCS12
# Relative path to the keystore file (this stores the server certificates), must be placed under the config/ dir
#searchguard.ssl.http.keystore_filepath: keystore_https_node1.jks
# Alias name (default: first alias which could be found)
#searchguard.ssl.http.keystore_alias: my_alias
# Keystore password (default: changeit)
#searchguard.ssl.http.keystore_password: changeit
# Do the clients (typically the browser or the proxy) have to authenticate themself to the http server, default is OPTIONAL
# To enforce authentication use REQUIRE, to completely disable client certificates use NONE
#searchguard.ssl.http.clientauth_mode: REQUIRE
# JKS or PKCS12 (default: JKS)
#searchguard.ssl.http.truststore_type: PKCS12
# Relative path to the truststore file (this stores the client certificates), must be placed under the config/ dir
#searchguard.ssl.http.truststore_filepath: truststore_https.jks
# Alias name (default: first alias which could be found)
#searchguard.ssl.http.truststore_alias: my_alias
# Truststore password (default: changeit)
#searchguard.ssl.http.truststore_password: changeit

# As an alternative to JKS/PCKS12 based configuration 
# you can also use X.509 PEM certificates and PKCS #8 keys.
# This, for example, makes it pretty easy to configure letsencrypt certificates.

# Relative path to the certificates key file (PKCS #8), must be placed under the config/ dir
#searchguard.ssl.http.pemkey_filepath: privkey.pem
# Key password (omit this setting if the key has no password)
#searchguard.ssl.http.pemkey_password: "secret"
# X509 node certificate chain in PEM format, must be placed under the config/ dir
#searchguard.ssl.http.pemcert_filepath: fullchain.pem
# Trusted certificates
#searchguard.ssl.http.pemtrustedcas_filepath: chain.pem

# Enabled SSL cipher suites for http protocol (only Java format is supported)
# WARNING: Expert setting, do only use if you know what you are doing
# If you set wrong values here this this could be a security risk
#searchguard.ssl.http.enabled_ciphers:
#  - "TLS_DHE_RSA_WITH_AES_256_CBC_SHA"
#  - "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256"

# Enabled SSL protocols for http protocol (only Java format is supported)
# WARNING: Expert setting, do only use if you know what you are doing
# If you set wrong values here this this could be a security risk  
#searchguard.ssl.http.enabled_protocols:
#  - "TLSv1.2"

# Enables the usage of custom SSLContext's for Transport clients
# This setting does only apply to Transport clients
# WARNING: Expert setting, do only use if you know what you are doing
# If you set wrong values here this this could be a security risk  
#searchguard.ssl.client.external_context_id: myid
    
# Class name of a class which is in classpath and implements com.floragunn.searchguard.ssl.transport.PrincipalExtractor
# used to resolve the string representation of an principal from a x509 certificate
# WARNING: Expert setting, do only use if you know what you are doing
# If you set wrong values here this this could be a security risk 
#searchguard.ssl.transport.principal_extractor_class: com.example.sg.MyPrincipalExtractor

# CRL validation of HTTP client certificates
# WARNING: Expert setting, do only use if you know what you are doing
# If you set wrong values here this this could be a security risk 
# Set to true to enable CRL validation (default is false)
#searchguard.ssl.http.crl.validate: true
# File based static revocation list, by default this is null
# if null then either OCSP or CRLDP needs to be enabled
# CRL file must be in config/ dir, so this path is relative here
#searchguard.ssl.http.crl.file_path: mycrl.crl
# Default is false (means we prefer OCSP over static CRL file)
#searchguard.ssl.http.crl.prefer_crlfile_over_ocsp: true
# Default is true (means we do not validate intermediate certificates)
#searchguard.ssl.http.crl.check_only_end_entities: false
# Default is false (means we use OCSP if available)
#searchguard.ssl.http.crl.disable_ocsp: true
# Default is false (means we use CRLDP if available)
#searchguard.ssl.http.crl.disable_crldp: true
# Sets the time (as unix epoch timestamp) for which the validity of the certification path should be determined
# If not set of set to -1 then the current time will be used
#searchguard.ssl.http.crl.validation_date: 1496070074


############## Common configuration settings ##############

# Enable or disable the Search Guard enterprise modules
# By default enterprise modules are enabled. If you use any of the modules in production you need
# to obtain a license. If you want to use the free Community Edition, you can switch
# all enterprise features off by setting the following key to false
searchguard.enterprise_modules_enabled: true

# Specify a list of DNs which denote the other nodes in the cluster.
# This settings support wildcards and regular expressions
# This setting only has effect if 'searchguard.cert.intercluster_request_evaluator_class' is not set.
searchguard.nodes_dn:
  - "CN=*.example.com, OU=SSL, O=Test, L=Test, C=DE"
  - "CN=node.other.com, OU=SSL, O=Test, L=Test, C=DE"

# Defines the DNs (distinguished names) of certificates
# to which admin privileges should be assigned (mandatory)
searchguard.authcz.admin_dn:
  - "CN=kirk,OU=client,O=client,l=tEst, C=De"

############## REST Management API configuration settings ##############
# Enable or disable role based access to the REST management API
# Default is that no role is allowed to access the REST management API.
#searchguard.restapi.roles_enabled: ["SGS_ALL_ACCESS","sg_xyz_role"]

# Disable particular endpoints and their HTTP methods for roles. 
# By default all endpoints/methods are allowed.
#searchguard.restapi.endpoints_disabled.<role>.<endpoint>: <array of http methods>
# Example:
#searchguard.restapi.endpoints_disabled.SGS_ALL_ACCESS.ACTIONGROUPS: ["PUT","POST","DELETE"]
#searchguard.restapi.endpoints_disabled.sg_xyz_role.LICENSE: ["DELETE"]

# The following endpoints exist:
# ACTIONGROUPS
# CACHE
# SGCONFIG
# LICENSE
# ROLES
# ROLESMAPPING
# INTERNALUSERS
# SYSTEMINFO
# PERMISSIONSINFO

############## Auditlog configuration settings ##############
# General settings

# Enable/disable rest request logging (default: true)
#searchguard.audit.enable_rest: true
# Enable/disable transport request logging (default: false)
#searchguard.audit.enable_transport: false
# Enable/disable bulk request logging (default: false)
# If enabled all subrequests in bulk requests will be logged too
#searchguard.audit.resolve_bulk_requests: false
# Disable some categories
#searchguard.audit.config.disabled_categories: ["AUTHENTICATED","GRANTED_PRIVILEGES"]
# Disable some requests (wildcard or regex of actions or rest request paths)
#searchguard.audit.ignore_requests: ["indices:data/read/*","*_bulk"]
# Tune threadpool size, default is 10 and 0 means disabled
#searchguard.audit.threadpool.size: 0
# Tune threadpool max size queue length, default is 100000
#searchguard.audit.threadpool.max_queue_len: 100000

# If enable_request_details is true then the audit log event will also contain
# details like the search query. Default is false. 
#searchguard.audit.enable_request_details: true
# Ignore users, e.g. do not log audit requests from that users (default: no ignored users)
#searchguard.audit.ignore_users: ['kibanaserver','some*user','/also.*regex possible/']"

# Destination of the auditlog events
searchguard.audit.type: internal_elasticsearch
#searchguard.audit.type: external_elasticsearch
#searchguard.audit.type: debug
#searchguard.audit.type: webhook

# external_elasticsearch settings
#searchguard.audit.config.http_endpoints: ['localhost:9200','localhost:9201','localhost:9202']"
# Auditlog index can be a static one or one with a date pattern (default is 'auditlog6')
#searchguard.audit.config.index: auditlog6 # make sure you secure this index properly
#searchguard.audit.config.index: "'auditlog6-'YYYY.MM.dd" #rotates index daily - make sure you secure this index properly
#searchguard.audit.config.type: auditlog
#searchguard.audit.config.username: auditloguser
#searchguard.audit.config.password: auditlogpassword
#searchguard.audit.config.enable_ssl: false
#searchguard.audit.config.verify_hostnames: false
#searchguard.audit.config.enable_ssl_client_auth: false
#searchguard.audit.config.cert_alias: mycert
#searchguard.audit.config.pemkey_filepath: key.pem
#searchguard.audit.config.pemkey_content: <...pem base 64 content>
#searchguard.audit.config.pemkey_password: secret
#searchguard.audit.config.pemcert_filepath: cert.pem
#searchguard.audit.config.pemcert_content: <...pem base 64 content>
#searchguard.audit.config.pemtrustedcas_filepath: ca.pem
#searchguard.audit.config.pemtrustedcas_content: <...pem base 64 content>

# webhook settings
#searchguard.audit.config.webhook.url: "http://mywebhook/endpoint"
# One of URL_PARAMETER_GET,URL_PARAMETER_POST,TEXT,JSON,SLACK
#searchguard.audit.config.webhook.format: JSON
#searchguard.audit.config.webhook.ssl.verify: false
#searchguard.audit.config.webhook.ssl.pemtrustedcas_filepath: ca.pem
#searchguard.audit.config.webhook.ssl.pemtrustedcas_content: <...pem base 64 content>

# log4j settings
#searchguard.audit.config.log4j.logger_name: auditlogger
#searchguard.audit.config.log4j.level: INFO

############## Kerberos configuration settings ##############
# If Kerberos authentication should be used you have to configure:

# The Path to the krb5.conf file
# Can be absolute or relative to the Elasticsearch config directory
#searchguard.kerberos.krb5_filepath: '/etc/krb5.conf'
            
# The Path to the keytab where the acceptor_principal credentials are stored.           
# Must be relative to the Elasticsearch config directory
#searchguard.kerberos.acceptor_keytab_filepath: 'eskeytab.tab'

# Acceptor (Server) Principal name, must be present in acceptor_keytab_path file
#searchguard.kerberos.acceptor_principal: 'HTTP/localhost'

############## Advanced configuration settings ##############
# Enable rest layer impersonation
# Allow users to impersonate as other users
#searchguard.authcz.rest_impersonation_user:
#  "picard":
#    - worf
#  "john":
#    - steve
#    - martin

# If this is set to true Search Guard will automatically initialize the configuration index
# with the files in the sgconfig directory if the index does not exist.
# WARNING: This will use well-known default passwords.
#          Use only in a private network/environment.
#searchguard.allow_default_init_sgindex: false

# If this is set to true then allow to startup with demo certificates.
# These are certificates issued by floragunn GmbH for demo purposes.
# WARNING: This certificates are well known and therefore unsafe
#          Use only in a private network/environment.
#searchguard.allow_unsafe_democertificates: false

############## Expert settings ##############
# WARNING: Expert settings, do only use if you know what you are doing
# If you set wrong values here this this could be a security risk
# or make Search Guard stop working

# Disable Search Guard
# WARNING: This can expose your configuration (including passwords) to the public.
#searchguard.disabled: false

# Only enable SSL, all other functionality like authentication will be disabled
# WARNING: This can expose your configuration (including passwords) to the public.
#searchguard.ssl_only