apiVersion: v1
kind: ConfigMap
metadata:
  name: ejbca-ca-init-configmap
data:
  cs_pkcs11_R3.cfg: |
    [Global]
    # Path to the logfile (name of logfile is attached by the API)
    # For unix:
    Logpath = /opt/utimaco

    # Loglevel (0 = NONE; 1 = ERROR; 2 = WARNING; 3 = INFO; 4 = TRACE)
    Logging = 0
    # Maximum size of the logfile in bytes (file is rotated with a backupfile if full)
    Logsize = 0

    # Created/Generated keys are stored in an external or internal database
    KeysExternal = false

    # If true, every session establishs its own connection
    SlotMultiSession = true

    # Maximum number of slots that can be used
    SlotCount = 10

    # If true, leading zeroes of decryption operations will be kept
    KeepLeadZeros = false

    # Configures load balancing mode ( == 0 ) or failover mode ( > 0 )
    # In failover mode, n specifies the interval in seconds after which a reconnection attempt to the failed CryptoServer is started.
    FallbackInterval = 0

    # Prevents expiring session after inactivity of 15 minutes
    KeepAlive = false

    # Timeout of the open connection command in ms
    ConnectionTimeout = 5000

    # Timeout of command execution in ms
    CommandTimeout = 60000

    # List of official PKCS#11 mechanisms which should be customized
    #CustomMechanisms = { CKM_AES_CBC CKM_AES_ECB }

    # Enforce thread-safety by using the operating system locking primitives
    #ForceOSLocking = true

    #[CryptoServer]
    # Device specifier (here: CryptoServer is internal PCI device)
    # For unix:
    #Device = /dev/cs2
    # For windows:
    #Device = PCI:0  

    [CryptoServer]
    # Device specifier (here: CryptoServer is CSLAN with IP address 192.168.0.1) 
    Device = 3001@utimaco-emulator

    #[CryptoServer]
    # Device specifier (here: CryptoServer is logical failover device of CSLANs with IP address 192.168.0.2 and IP address 192.168.0.3) 
    #Device = { 192.168.0.2 192.168.0.3 }

    #[CryptoServer]
    # Device specifier Simulator 
    #Device = { 3001@127.0.0.1 3003@127.0.0.1 }

    #[Slot]
    # Slotsection for slot with number 0
    #SlotNumber = 0

    #[KeyStorage]

    # Legacy SDB file
    #KeyStorageType = Legacy
    # Path to the external keystore
    # If KeyStore is defined the external keystore will be created and used at the defined location
    # For unix:
    #KeyStore = /tmp/P11.pks
    # For windows:
    #KeyStore = C:/ProgramData/Utimaco/PKCS11_R3/P11.pks

    # Database via ODBC
    #KeyStorageType = odbc
    #KeyStorageConfig = "DSN=PSQL Ucapi External Storage"

  after-deployed-pre.sh: |
    #!/bin/bash
    cd /opt/keyfactor/bin
    tokenPassword="$caTokenPassword"

    p11ng-cli.sh generatekeypair --alias signkey001 --key-spec RSA2048 --password $tokenPassword  \
            --lib-file /opt/keyfactor/p11proxy-client/p11proxy-client.so --slot slotX1 --slot-ref SLOT_LABEL
    p11ng-cli.sh generatekeypair --alias defaultkey001 --key-spec RSA2048 --key-usage SIGN_ENCRYPT --password $tokenPassword \
            --lib-file /opt/keyfactor/p11proxy-client/p11proxy-client.so --slot slotX1 --slot-ref SLOT_LABEL
    p11ng-cli.sh generatekeypair --alias signkey002 --key-spec RSA2048 --password $tokenPassword   \
            --lib-file /opt/keyfactor/p11proxy-client/p11proxy-client.so --slot slotX1 --slot-ref SLOT_LABEL
    p11ng-cli.sh generatekeypair --alias defaultkey002 --key-spec RSA2048 --key-usage SIGN_ENCRYPT --password $tokenPassword \
            --lib-file /opt/keyfactor/p11proxy-client/p11proxy-client.so --slot slotX1 --slot-ref SLOT_LABEL
    p11ng-cli.sh generatekeypair --alias testkey --key-spec RSA2048 --password $tokenPassword   \
            --lib-file /opt/keyfactor/p11proxy-client/p11proxy-client.so --slot slotX1 --slot-ref SLOT_LABEL

    echo "web.reqcert=false" >> /opt/keyfactor/ejbca/conf/web.properties

  configdump.json: |
    {
      "crypto-tokens": {
        "CaToken001": {
          "Object Type": "Crypto Token",
          "Version": 2,
          "Name": "CaToken001",
          "Used": true,
          "PKCS11 Library": "/opt/keyfactor/p11proxy-client/p11proxy-client.so",
          "PKCS11 Reference Type": "SLOT_LABEL",
          "PKCS11 Reference": "slotX1",
          "PKCS11 Attribute File": "",
          "Key Pair Info": [
            
          ],
          "Authentication Code": "${caTokenPassword}",
          "Type": "Pkcs11NgCryptoToken",
          "Active": true,
          "Auto Activation": true
        },
        "PeerToken": {
          "Object Type": "Crypto Token",
          "Version": 2,
          "Name": "PeerToken",
          "Used": true,
          "PKCS11 Library": "/opt/keyfactor/p11proxy-client/p11proxy-client.so",
          "PKCS11 Reference Type": "SLOT_LABEL",
          "PKCS11 Reference": "slotX2",
          "PKCS11 Attribute File": "",
          "Key Pair Info": [],
          "Authentication Code": "${peerTokenPassword}",
          "Type": "Pkcs11NgCryptoToken",
          "Active": true,
          "Auto Activation": true
        }
      },
      "certification-authorities": {
        "ManagementCA": {
          "Object Type": "Certification Authority",
          "Version": 2,
          "Name": "ManagementCA",
          "Type of CA": "X.509",
          "Serial Number Octet Size": 20,
          "Pre-produce OCSP Responses": false,
          "Microsoft CA Compatible Mode Used": false,
          "Store responses on-demand": false,
          "Pre-produce OCSP Responses Upon certificate issuance/revocation": false,
          "Certificate Profile": "ROOTCA",
          "Default Certificate Profile": "Not used",
          "Use Append-Only Table": false,
          "CA Token": {
            "Signature Algorithm": "SHA256WithRSA",
            "Encryption Algorithm": "SHA256WithRSA",
            "Crypto Token": "CaToken001",
            "Default Key": "defaultkey001",
            "Certificate Signing Key": "signkey001",
            "CRL Signing Key": "signkey001",
            "Key Encryption Key": "defaultkey001",
            "Test Key": "testkey",
            "Key Sequence Format": "Numeric",
            "Key Sequence": "00000"
          },
          "Enforce Unique Public Keys": false,
          "Enforce key renewal": false,
          "Enforce Unique DN": false,
          "User Storage": true,
          "Certificate Storage": true,
          "Accept Revocations for Non-Existing Entries": false,
          "Subject DN": "CN=ManagementCA,OU=SomeOrg",
          "Signed By": "Self Signed",
          "Validity": "20y",
          "Subject Alternative Name": "None",
          "Use UTF-8 in Policy Notice Text": true,
          "LDAP DN Order": true,
          "Authority Key Id Used": true,
          "CRL Number Used": true,
          "Partitioned CRL Used": false,
          "CRL Expiration Period": "1d",
          "CRL Issue Interval": "0m",
          "CRL Overlap Time": "10m",
          "Delta CRL Period": "0m",
          "Generate CRL Upon Revocation": false,
          "Allow Changing Revocation Reason": false,
          "Finish User": true,
          "CA Healthcheck Enabled": true,
          "Request Processor": null
        },
        "RootCA": {
          "Object Type": "Certification Authority",
          "Version": 2,
          "Name": "RootCA",
          "Type of CA": "X.509",
          "Serial Number Octet Size": 20,
          "Pre-produce OCSP Responses": false,
          "Microsoft CA Compatible Mode Used": false,
          "Store responses on-demand": false,
          "Pre-produce OCSP Responses Upon certificate issuance/revocation": false,
          "Certificate Profile": "ROOTCA",
          "Default Certificate Profile": "Not used",
          "Use Append-Only Table": false,
          "CA Token": {
            "Signature Algorithm": "SHA256WithRSA",
            "Encryption Algorithm": "SHA256WithRSA",
            "Crypto Token": "CaToken001",
            "Default Key": "defaultkey002",
            "Certificate Signing Key": "signkey002",
            "CRL Signing Key": "signkey002",
            "Key Encryption Key": "defaultkey002",
            "Test Key": "testkey",
            "Key Sequence Format": "Numeric",
            "Key Sequence": "00000"
          },
          "Enforce Unique Public Keys": false,
          "Enforce key renewal": false,
          "Enforce Unique DN": false,
          "User Storage": true,
          "Certificate Storage": true,
          "Accept Revocations for Non-Existing Entries": false,
          "Subject DN": "CN=RootCA,C=SE",
          "Signed By": "Self Signed",
          "Validity": "20y",
          "Subject Alternative Name": "None",
          "Use UTF-8 in Policy Notice Text": true,
          "LDAP DN Order": true,
          "Authority Key Id Used": true,
          "CRL Number Used": true,
          "Partitioned CRL Used": false,
          "CRL Expiration Period": "1d",
          "CRL Issue Interval": "0m",
          "CRL Overlap Time": "10m",
          "Delta CRL Period": "0m",
          "Generate CRL Upon Revocation": false,
          "Allow Changing Revocation Reason": false,
          "Finish User": true,
          "CA Healthcheck Enabled": true,
          "Request Processor": null
        }
      },
      "end-entity-profiles": {
        "eep001": {
          "Object Type": "End Entity Profile",
          "Version": 1,
          "Name": "ServerEndEntityProfile",
          "Description": "",
          "Default CA": "ManagementCA",
          "Available CAs": ["ManagementCA", "RootCA"],
          "Default Certificate Profile": "SERVER",
          "Available Certificate Profiles": ["SERVER"],
          "Default Token Type": "PEM File",
          "Available Token Types": [
            "User Generated",
            "PKCS12 File",
            "BCFKS File",
            "JKS File",
            "PEM File"
          ],
          "Subject DN": {
            "CN": [
              {
                "Required": true
              }
            ]
          },
          "Subject Alternative Name": {
            "DNSNAME": [
              {
                "Required": false
              },
              {
                "Required": false
              },
              {
                "Required": false
              },
              {
                "Required": false
              }
            ]
          }
        }
      },
      "available-protocols": {
        "available-protocol-configuration": {
          "Object Type": "Available Protocols",
          "Version": 1,
          "Name": "available-protocol-configuration",
          "ACME": true,
          "Certstore": true,
          "CMP": true,
          "CRLstore": true,
          "EST": true,
          "MSAE": true,
          "OCSP": true,
          "SCEP": true,
          "RA Web": true,
          "REST CA Management": true,
          "REST Certificate Management": true,
          "REST Coap Management": true,
          "REST Crypto Token Management": true,
          "REST End Entity Management": true,
          "REST End Entity Management V2": true,
          "REST Configdump": true,
          "REST Certificate Management V2": true,
          "REST SSH V1": true,
          "REST System V1": true,
          "Webdist": true,
          "Web Service": true,
          "ITS Certificate Management": false,
          "Custom header name for REST calls from browser": "X-Keyfactor-Requested-With"
        }
      },
      "admin-roles": {
        "Super Administrator Role": {
          "Object Type": "Role",
          "Version": 1,
          "Name": "Super Administrator Role",
          "Role Members": [
            {
              "Token Type": "CertificateAuthenticationToken",
              "Issuer": "ManagementCA",
              "Match With": "WITH_COMMONNAME",
              "Match Value": "AutomationAdmin"
            },
            {
              "Token Type": "CertificateAuthenticationToken",
              "Issuer": "ManagementCA",
              "Match With": "WITH_COMMONNAME",
              "Match Value": "SuperAdmin"
            },
            {
              "Token Type": "CliAuthenticationToken",
              "Issuer": null,
              "Match With": "USERNAME",
              "Match Value": "ejbca"
            },
            {
              "Token Type": "PublicAccessAuthenticationToken",
              "Issuer": null,
              "Match With": "TRANSPORT_CONFIDENTIAL",
              "Match Value": ""
            }
          ],
          "Namespace": "",
          "RA Style Id": 0,
          "Access Rules": {
            "/": "Allow"
          }
        }
      }
    }
