server:
  port: ${SERVER_PORT:8081}
  # Spring ignores X-Forwarded-* unless this is set, so scheme/secure/requestUrl
  # report the raw connection by default. Keycloak has the same opt-in as
  # KC_PROXY_HEADERS. Flipping this to "native" is what the two-hop measurement
  # compares against.
  forward-headers-strategy: ${SERVER_FORWARD_HEADERS_STRATEGY:none}

spring:
  application:
    name: keycloak-pattern-api
  jackson:
    serialization:
      # /api/echo is read by humans and captured as evidence screenshots, so the
      # response is indented rather than relying on a browser's JSON viewer.
      indent-output: true
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: ${SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUER_URI:http://localhost:8080/realms/keycloak-patterns}
          jwk-set-uri: ${SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_JWK_SET_URI:http://localhost:8080/realms/keycloak-patterns/protocol/openid-connect/certs}

management:
  endpoint:
    health:
      probes:
        enabled: true
  endpoints:
    web:
      exposure:
        include: health,info