application.example.yml

kafkahq:
  server:
    base-path: "" # if behind a reverse proxy, path to kafkahq with trailing slash (optional). Example: kafkahq is
                  # behind a reverse proxy with url http://my-server/kafkahq, set base-path: "/kafkahq/".
                  # Not needed if you're behind a reverse proxy with subdomain http://kafkahq.my-server/
    access-log: # Access log configuration (optional)
      enabled: true # true by default
      name: org.kafkahq.log.access # Logger name
      format: "[Date: {}] [Duration: {} ms] [Url: {} {} {}] [Status: {}] [Ip: {}] [Length: {}] [Port: {}]" # Logger format

  # default kafka properties for each clients, available for admin / producer / consumer (optional)
  clients-defaults:
    consumer:
      properties:
        isolation.level: read_committed

  # list of kafka cluster available for kafkahq
  connections:
    my-cluster-plain-text: # url friendly name for the cluster
      properties: # standard kafka properties (optional)
        bootstrap.servers: "kafka:9092"
      schema-registry:
        url: "http://schema-registry:8085" # schema registry url (optional)
        basic-auth: # Basic Auth user / pass
          username: basic-auth-user
          password: basic-auth-pass
      connect:
        url: "http://connect:8083" # connect url (optional)
        basic-auth: # Basic Auth user / pass (optional)
          username: basic-auth-user
          password: basic-auth-pass
        ssl: # ssl store configuration (optional)
          trust-store: /app/truststore.jks
          trust-store-password: trust-store-password
          key-store: /app/truststore.jks
          key-store-password: key-store-password

    my-cluster-ssl:
      properties:
        bootstrap.servers: "kafka:9093"
        security.protocol: SSL
        ssl.truststore.location: /app/truststore.jks
        ssl.truststore.password: password
        ssl.keystore.location: /app/keystore.jks
        ssl.keystore.password: password
        ssl.key.password: password

    my-cluster-sasl:
      properties:
        bootstrap.servers: "kafka:9094"
        security.protocol: SASL_SSL
        sasl.mechanism: SCRAM-SHA-256
        sasl.jaas.config: org.apache.kafka.common.security.scram.ScramLoginModule required username="admin" password="password";
        ssl.truststore.location: /app/truststore.jks
        ssl.truststore.password: password
        ssl.keystore.location: /app/keystore.jks
        ssl.keystore.password: password
        ssl.key.password: password

  # Topic list display options (optional)
  topic:
    page-size: 25 # number of topics per page (default : 25)
    default-view: HIDE_INTERNAL # default list view (ALL, HIDE_INTERNAL, HIDE_INTERNAL_STREAM, HIDE_STREAM)
    internal-regexps: # list of regexp to be considered as internal (internal topic can't be deleted or updated)
      - "^_.*$"
      - "^.*_schemas$"
      - "^.*connect-config$"
      - "^.*connect-offsets$1"
      - "^.*connect-status$"
    stream-regexps: # list of regexp to be considered as internal stream topic
      - "^.*-changelog$"
      - "^.*-repartition$"
      - "^.*-rekey$"

  # Topic display data options (optional)
  topic-data:
    sort: OLDEST # default sort order (OLDEST, NEWEST) (default: OLDEST)
    size: 50 # max record per page (default: 50)
    poll-timeout: 1000 # The time, in milliseconds, spent waiting in poll if data is not available in the buffer.

  # Auth & Roles (optional)
  security:
    default-roles: # Roles available for all the user even unlogged user
      - topic/read
      - topic/insert
      - topic/delete
      - topic/config/update
      - node/read
      - node/config/update
      - topic/data/read
      - topic/data/insert
      - topic/data/delete
      - group/read
      - group/delete
      - group/offsets/update
      - registry/read
      - registry/insert
      - registry/update
      - registry/delete
      - registry/version/delete
      - connect/read
      - connect/insert
      - connect/update
      - connect/delete
      - connect/state/update

    # Basic auth configuration
    basic-auth:
      user: # Username
        password: pass # Password in sha256
        roles: # Role for current users
          - topic/read
          - group/read
          - group/delete