Установка и конфигурирование

## This is an example of `guacamole.properties` file as main configuration file for osmax-ira-guacamole-client backend

###############################################################################
# HTTP server properties section                                              #
###############################################################################

## Application name
application-name: osmax-ira-guacamole-client
## Main application port
application-server-port: 8080
## Prefix for temporary directory which will be used as a base directory for embedded Tomcat deployment
application-server-base-dir-prefix: osmax-ira-guacamole-client-

## To enable serving requests via HTTPS uncomment the following parameters:
#application-server-ssl: true
#application-server-ssl-keystore-path: /opt/osmax-ira-guacamole-client/keystore.jks
#application-server-ssl-keystore-password: keystore@12345
## Optionally if keystore specified by path is not in standard JKS format,
## use parameter below for specifying the truststore type (should be compatible with JSSE)
#application-server-ssl-keystore-type: jks

###############################################################################
# Guacamole server (guacd) integration properties section                     #
###############################################################################

## Guacamole server configuration
guacd-hostname: <guacamole server hostname>
guacd-port: 4822
## To enable SSL connection mode for Guacamole server uncomment the following parameters:
#guacd-ssl: true
#guacd-ssl-truststore-path: /etc/ssl/certs/java/cacerts
#guacd-ssl-truststore-password: changeit
## Optionally if truststore specified by path is not in standard JKS format,
## use parameter below for specifying the truststore type (should be compatible with JSSE)
#guacd-ssl-truststore-type: jks

## Additional configuration for managed connections
ignore-certs-in-rdp-connections: true
clipboard-encoding-in-vnc-connections: UTF-8

## Timeout in minutes for inactive sessions after which the session will be closed forcefully
api-session-timeout: 60

###############################################################################
# Guacamole extensions properties section                                     #
###############################################################################

## Extensions load order
extension-priority: postgresql,ldap,quickconnect,*

## Whitelist of language keys to allow as display language choices within the Guacamole interface
allowed-languages: en, ru

###############################################################################
# Guacamole PostgreSQL authentication extension properties section            #
###############################################################################

postgresql-username: <db-user-name>
postgresql-password: <db-user-password>
postgresql-url: jdbc:postgresql://<db-host>:<dp-port>/<db_name>

postgresql-default-max-connections-per-user: 1
postgresql-batch-size: 5000
## Timeout value '0' means there will be no timeout applied
postgresql-default-statement-timeout: 0
postgresql-socket-timeout: 0

## To enable SSL connection mode for DB uncomment the following parameters
## Use value 'required' for secure connections without certificates verification
## Use value 'verify-ca' for secure connections with certificates verification (but without hostname verification)
## Use value 'verify-full' for secure connections with certificates and hostname verifications
#postgresql-ssl-mode: verify-full
#postgresql-ssl-cert-file: /opt/osmax-ira-guacamole-client/postgresql.crt
#postgresql-ssl-key-file: /opt/osmax-ira-guacamole-client/postgresql.pk8
#postgresql-ssl-key-password: <ssl-key-file-password>
#postgresql-ssl-root-cert-file: /opt/osmax-ira-guacamole-client/root.crt

###############################################################################
# Guacamole LDAP authentication extension properties section                  #
###############################################################################

ldap-hostname: <ldap-host>
## To override default value of the LDAP port uncomment and set the parameter below.
## Otherwise, the LDAP port will be defined from 'ldap-encryption-method' parameter.
## For 'ssl' mode it will be 636, for 'none' and 'starttls' it will be 389
#ldap-port: 389

# LDAP integration parameters
ldap-user-base-dn: DC=domain,DC=local
ldap-group-base-dn: DC=domain,DC=local
ldap-username-attribute: sAMAccountName
ldap-group-name-attribute: sAMAccountName
ldap-member-attribute-type: dn
ldap-member-attribute: member
ldap-group-search-filter: (objectClass=*)
ldap-user-search-filter: (objectClass=*)
ldap-search-bind-dn: DC=domain,DC=local
ldap-search-bind-password: <password>

## To enable SSL connection mode for LDAP uncomment the following parameters:
## Use value 'ssl' for LDAPS connection
## Use value 'starttls' for secure connections to be negotiated over standard LDAP port for non-encrypted connections
#ldap-encryption-method: ssl
#ldap-ssl-truststore-path: /etc/ssl/certs/java/cacerts
#ldap-ssl-truststore-password: changeit
## Optionally if truststore specified by path is not in standard JKS format,
## use parameter below for specifying the truststore type (should be compatible with JSSE)
#ldap-ssl-truststore-type: jks
## For disabling SSL connection verification you can use option below
#ldap-trust-all-certs: true

###############################################################################
# Logging section                                                             #
###############################################################################

## Log level for root application logger
log-level: info

## Application main log file configuration
log-file: /var/log/osmax/ira-guacamole-client/osmax-ira-guacamole-client.log
log-file-rotation-suffix: yyyy-MM-dd
log-file-rotation-max-file-size: 10MB
log-file-rotation-max-history: 5

## Application audit log file configuration
audit-log-file: /var/log/osmax/ira-guacamole-client/audit-osmax-ira-guacamole-client.log
audit-log-file-rotation-suffix: yyyy-MM-dd
audit-log-file-rotation-max-file-size: 10MB
audit-log-file-rotation-max-history: 5

###############################################################################
# Guacamole Kerberos authentication extension properties section              #
###############################################################################

## Minimal required setup
kerberos-service-principal-name: <service_principal_name>
kerberos-service-principal-realm: <service.domain>
kerberos-keytab-path: </path/to/keytab/file>

## Password can be used only for debug purpose on non-production env, use keytab
#kerberos-service-principal-password: <service_principal_password>

## Debug log for Kerberos
#kerberos-debug: true

###############################################################################
# Kafka integration section                                                   #
###############################################################################
#kafka-bootstrap-servers: kafka:19092

## Kafka SSL connection parameters section.
## To enable SSL connection mode uncomment three following parameters:
#kafka-security-protocol: SSL
#kafka-ssl-truststore-location: /path/to/kafka.client.truststore.jks
#kafka-ssl-truststore-password: your-truststore-password

## Optionally if the custom truststore is used:
## To change the format use one of JKS, JCEKS, P12, PKCS12, PFX. Default format is JKS
#kafka-ssl-truststore-type: PKCS12

## To enable mutual TLS connection mode uncomment three following parameters, along with configuration above:
#kafka-ssl-keystore-location: /opt/osmax-provisioner/keystore.jks
#kafka-ssl-keystore-password: keystore@12345
## Optionally if the custom keystore is used:
## To change the format use one of JKS, JCEKS, P12, PKCS12, PFX. Default format is JKS
#kafka-ssl-keystore-type: PKCS12

###############################################################################
# Observability section                                                       #
###############################################################################

## If metrics publication to Kafka is enabled, bootstrap servers should be configured
## For setting target Kafka bootstrap servers and SSL configuration see Kafka integration section

## To enable metrics publication to Kafka uncomment the following parameters
#osmax-micrometer-export-kafka-enabled: true
#osmax-micrometer-export-kafka-topic: osmax-observer.metrics
## Kafka metrics publication frequency configuration
#osmax-micrometer-export-kafka-step-seconds: 60