# Nuts Knooppunt Configuration
# This file demonstrates the configuration options available

strictmode: false

# mCSD (Mobile Care Services Discovery) configuration
mcsd:
  # Local FHIR directory configuration
  query:
    fhirbaseurl: "http://localhost:8080/fhir"

  # Exclude administration directories from being registered
  # Use this to prevent your own FHIR server from being added as an admin directory
  # This avoids syncing your own resources back to yourself
  adminexclude:
    - "http://localhost:8080/fhir"  # Exclude own query directory
    # - "https://fhir.other-excluded.org/fhir"  # Add more exclusions as needed

  # Resource types to synchronize from discovered mCSD directories
  # If not specified, defaults to: Organization, Endpoint, Location, HealthcareService, PractitionerRole, Practitioner
  # directoryresourcetypes:
  #   - "Organization"
  #   - "Endpoint"
  #   - "Location"
  #   - "HealthcareService"
  #   - "PractitionerRole"
  #   - "Practitioner"

# LRZA synchronization configuration
# Syncs the trusted national LRZA mCSD directory into the local query directory.
# The sync client is only enabled when lrzabaseurl is set.
lrza:
  # Base URL of the trusted LRZA source directory to synchronize from
  lrzabaseurl: "https://adressering.proeftuin.gf.irealisatie.nl/poc/FHIR/fhir"
  # FHIR base URL of the local mCSD Query Directory to synchronize into
  querybaseurl: "http://localhost:7050/fhir/knpt-mcsd-query"

  # The national LRZA environment requires a client certificate.
  # Option 1: PEM format (separate cert and key files). Point tlscertfile at the
  # full leaf + intermediates chain.
  #tlscertfile: "certs/proeftuin/provider.com-uzi-external-intermediate/provider.com-uzi-chain.crt"
  #tlskeyfile: "certs/proeftuin/star_provider_com_proeftuin.key"
  # Option 2: PKCS#12 format (.p12 or .pfx file with cert + key); tlskeyfile not needed
  #tlscertfile: "/path/to/cert.p12"
  # Password for an encrypted private key or .p12/.pfx file (optional)
  #tlskeypassword: "key password"
  # CA certificate to verify the LRZA server (only if it uses a private CA, not in
  # the system trust store). When set, it replaces the system trust store.
  #tlscafile: "certs/proeftuin/provider.com-uzi-external-intermediate/uzi-ca.crt"

# mCSD Admin configuration
mcsdadmin:
  # Base URL for FHIR server used by admin interface
  fhirbaseurl: "http://localhost:8080/fhir"

# Nuts node configuration
nuts:
  # Whether to enable the Nuts node component
  enabled: true

# MITZ Connector configuration
mitz:
  # MITZ base URL (paths are hardcoded in code)
  mitzbase: "http://localhost:8087/tst-us/mitz"
  # Gateway system OID (optional)
  gatewaysystem: "urn:oid:2.16.840.1.113883.2.4.6.6.1"
  # Source system OID (optional)
  sourcesystem: "urn:oid:2.16.840.1.113883.2.4.6.6.90000017"
  # mTLS client certificate configuration (optional)
  # Option 1: PEM format (separate cert and key files)
  #tlscertfile: "/path/to/client-cert.pem"
  #tlskeyfile: "/path/to/client-key.pem"
  # Option 2: PKCS#12 format (.p12 or .pfx file with cert + key)
  #tlscertfile: "/path/to/cert-file"
  # tlskeyfile is not needed for .p12/.pfx files
  # Password for encrypted private key or .p12/.pfx file (optional)
  #tlskeypassword: "key password"
  # CA certificate to trust MITZ server (if not in system trust store)
  #tlscafile: "/path/to/ca-file"

http:
  internal:
    url: http://localhost:8081
  public:
    url: http://localhost:8080

authn:
  clients:
    - id: "local"
      secret: "local-secret"
      redirecturls:
        - "http://localhost:8080/auth/test-callback"

pdp:
  enabled: true
  pip: 
    url: http://localhost:7050/fhir/policy-information-point