<%#
 Copyright 2013-2026 the original author or authors from the JHipster project.

 This file is part of the JHipster project, see https://www.jhipster.tech/
 for more information.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at

      https://www.apache.org/licenses/LICENSE-2.0

 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
-%>
<%#
 This is a fragment file, it will be merged into the root template if available.
 EJS fragments will process % delimiter tags in the template and & delimiter tags during the merge process.
-%>
<&_ if (fragment.introSection) { -&>
<%_ if (applicationTypeGateway || applicationTypeMicroservice) { _%>

This is a "<%- applicationType %>" application intended to be part of a microservice architecture, please refer to the [Doing microservices with JHipster][] page of the documentation for more information.
<%_ } _%>
<%_ if (serviceDiscoveryAny) { _%>

This application is configured for Service Discovery and Configuration with <%- serviceDiscoveryEureka ? 'the JHipster-Registry' : '' %><%- serviceDiscoveryConsul ? 'Consul' : '' %>. On launch, it will refuse to start if it is not able to connect to <%- serviceDiscoveryEureka ? 'the JHipster-Registry at [http://localhost:8761](http://localhost:8761)' : '' %><%- serviceDiscoveryConsul ? 'Consul at [http://localhost:8500](http://localhost:8500)' : '' %>.<% if (serviceDiscoveryEureka) { %> For more information, read our documentation on [JHipster Registry](<%- documentationArchiveUrl %>/jhipster-registry/).<% } %><% if (serviceDiscoveryConsul) { %> For more information, read our documentation on [Consul][<%- documentationArchiveUrl %>/consul/).<% } %>
<%_ } _%>

<&_ } -&>

<&_ if (fragment.structureSection) { -&>
Node is required for generation and recommended for development. `package.json` is always generated for a better development experience with prettier, commit hooks, scripts and so on.

In the project root, JHipster generates configuration files for tools like git, prettier, eslint, husky, and others that are well known and you can find references in the web.

<%_ if (backendTypeJavaAny) { %>
`/src/*` structure follows default <%- backendType %> structure.

<%_ } _%>
- `.yo-rc.json` - Yeoman configuration file
JHipster configuration is stored in this file at `generator-jhipster` key. You may find `generator-jhipster-*` for specific blueprints configuration.
- `.yo-resolve` (optional) - Yeoman conflict resolver
Allows to use a specific action when conflicts are found skipping prompts for files that matches a pattern. Each line should match `[pattern] [action]` with pattern been a [Minimatch](https://github.com/isaacs/minimatch#minimatch) pattern and action been one of skip (default if omitted) or force. Lines starting with `#` are considered comments and are ignored.
- `.jhipster/*.json` - JHipster entity configuration files
<%_ if (!skipClient) { %>
- `npmw` - wrapper to use locally installed npm.
JHipster installs Node and npm locally using the build tool by default. This wrapper makes sure npm is installed locally and uses it avoiding some differences different versions can cause. By using `./npmw` instead of the traditional `npm` you can configure a Node-less environment to develop or test your application.
<%_ } _%>
- `/src/main/docker` - Docker configurations for the application and services that the application depends on

<&_ } -&>

<&_ if (fragment.developmentSection) { -&>
<%_ if (skipClient) { _%>
To start your application in the dev profile, run:

```bash
<%- buildToolMaven ? './mvnw' : '' %><%- buildToolGradle ? './gradlew' : '' %>
```

For further instructions on how to develop with JHipster, have a look at [Using JHipster in development][].

<%_ } _%>
<%_ if (authenticationTypeOauth2) { -%>
### OAuth 2.0 / OpenID Connect

Congratulations! You've selected an excellent way to secure your JHipster application. If you're not sure what OAuth and OpenID Connect (OIDC) are, please see [What the Heck is OAuth?](https://developer.okta.com/blog/2017/06/21/what-the-heck-is-oauth)

To log in to your app, you'll need to have [Keycloak](https://keycloak.org) up and running. The JHipster Team has created a Docker container for you that has the default users and roles. Start Keycloak using the following command.

```bash
docker compose -f src/main/docker/keycloak.yml up
```

The security settings in `src/main/resources/config/application.yml` are configured for this image.

```yaml
spring:
  ...
  security:
    oauth2:
      client:
        provider:
          oidc:
            issuer-uri: http://localhost:9080/realms/jhipster
        registration:
          oidc:
            client-id: web_app
            client-secret: web_app
            scope: openid,profile,email
```

Some of Keycloak configuration is now done in build time and the other part before running the app, here is the [list](https://www.keycloak.org/server/all-config) of all build and configuration options.

Before moving to production, please make sure to follow this [guide](https://www.keycloak.org/server/configuration) for better security and performance.

Also, you should never use `start-dev` nor `KC_DB=dev-file` in production.

When using Kubernetes, importing should be done using init-containers (with a volume when using `db=dev-file`).

### Okta

If you'd like to use Okta instead of Keycloak, it's pretty quick.

First, you'll need to create a free developer account at <https://developer.okta.com/signup/>. After doing so, you'll get your own Okta domain, that has a name like `https://dev-123456.okta.com`.

Modify `src/main/resources/config/application.yml` to use your Okta settings.

```yaml
spring:
  ...
  security:
    oauth2:
      client:
        provider:
          oidc:
            issuer-uri: https://{yourOktaDomain}/oauth2/default
        registration:
          oidc:
            client-id: {clientId}
            client-secret: {clientSecret}
security:
```

Create an OIDC App in Okta to get a `{clientId}` and `{clientSecret}`. To do this, log in to your Okta Developer account and navigate to **Applications** > **Add Application**. Click **Web** and click the **Next** button. Give the app a name you’ll remember, specify `http://localhost:8080` as a Base URI, and `http://localhost:8080/login/oauth2/code/oidc` as a Login Redirect URI. Click **Done**, then Edit and add `http://localhost:8080` as a Logout redirect URI. Copy and paste the client ID and secret into your `application.yml` file.

Create a `ROLE_ADMIN` and `ROLE_USER` group and add users into them. Modify e2e tests to use this account when running integration tests.
  <%_ if (!skipClient) { _%>
You'll need to change credentials in `<%- locals.clientTestDir %>e2e/account/account.spec.ts` and `<%- locals.clientTestDir %>e2e/admin/administration.spec.ts`.
  <%_ } _%>

Navigate to **API** > **Authorization Servers**, click the **Authorization Servers** tab and edit the default one. Click the **Claims** tab and **Add Claim**. Name it "groups", and include it in the ID Token. Set the value type to "Groups" and set the filter to be a Regex of `.*`.

After making these changes, you should be good to go! If you have any issues, please post them to [Stack Overflow](https://stackoverflow.com/questions/tagged/jhipster). Make sure to tag your question with "jhipster" and "okta".

### Auth0

If you'd like to use [Auth0](https://auth0.com/) instead of Keycloak, follow the configuration steps below:

- Create a free developer account at [Sign Up - Auth0](https://auth0.com/signup). After successful sign-up, your account will be associated with a unique domain like `dev-xxx.us.auth0.com`
- Create a new application of type `Regular Web Applications`. Switch to the `Settings` tab, and configure your application settings like:
    - Allowed Callback URLs: `http://localhost:8080/login/oauth2/code/oidc`
    - Allowed Logout URLs: `http://localhost:8080/`
- Navigate to **User Management** > **Roles** and create new roles named `ROLE_ADMIN`, and `ROLE_USER`.
- Navigate to **User Management** > **Users** and create a new user account. Click on the **Role** tab to assign roles to the newly created user account.
- Navigate to **Auth Pipeline** > **Rules** and create a new Rule. Choose `Empty rule` template. Provide a meaningful name like `JHipster claims` and replace `Script` content with the following and Save.

```javascript
function (user, context, callback) {
  user.preferred_username = user.email;
  const roles = (context.authorization || {}).roles;

  function prepareCustomClaimKey(claim) {
    return `https://www.jhipster.tech/${claim}`;
  }

  const rolesClaim = prepareCustomClaimKey('roles');

  if (context.idToken) {
    context.idToken[rolesClaim] = roles;
  }

  if (context.accessToken) {
    context.accessToken[rolesClaim] = roles;
  }

  callback(null, user, context);
}
```

- In your `JHipster` application, modify `src/main/resources/config/application.yml` to use your Auth0 application settings:

```yaml
spring:
  ...
  security:
    oauth2:
      client:
        provider:
          oidc:
            # make sure to include the ending slash!
            issuer-uri: https://{your-auth0-domain}/
        registration:
          oidc:
            client-id: {clientId}
            client-secret: {clientSecret}
            scope: openid,profile,email
jhipster:
  ...
  security:
    oauth2:
      audience:
        - https://{your-auth0-domain}/api/v2/
```
<%_ } _%>
<&_ } -&>

<&_ if (fragment.testingSection) { -&>
### Spring Boot tests

To launch your application's tests, run:

```bash
<%_ if (buildToolMaven) { _%>
./mvnw verify
<%_ } else { _%>
./gradlew test integrationTest jacocoTestReport
<%_ } _%>
```

<&_ } -&>

<&_ if (fragment.productionSection) { -&>
### Packaging as jar

To build the final jar and optimize the <%- baseName %> application for production, run:

```bash
<%_ if (buildToolMaven) { _%>
./mvnw -Pprod clean verify
<%_ } _%>
<%_ if (buildToolGradle) { _%>
./gradlew -Pprod clean bootJar
<%_ } _%>
```

<%_ if (!skipClient) { _%>
This will concatenate and minify the client CSS and JavaScript files. It will also modify `index.html` so it references these new files.
<%_ } _%>
To ensure everything worked, run:

```bash
<%_ if (buildToolMaven) { _%>
java -jar target/*.jar
<%_ } _%>
<%_ if (buildToolGradle) { _%>
java -jar build/libs/*.jar
<%_ } _%>
```

<% if (!skipClient) { %>Then navigate to [http://localhost:<%- serverPort %>](http://localhost:<%- serverPort %>) in your browser.
<% } %>
Refer to [Using JHipster in production][] for more details.

### Packaging as war

To package your application as a war in order to deploy it to an application server, run:

```bash
<%_ if (buildToolMaven) { _%>
./mvnw -Pprod,war clean verify
<%_ } _%>
<%_ if (buildToolGradle) { _%>
./gradlew -Pprod -Pwar clean bootWar
<%_ } _%>
```

### JHipster Control Center

JHipster Control Center can help you manage and control your application(s). You can start a local control center server (accessible on http://localhost:7419) with:

```bash
docker compose -f src/main/docker/jhipster-control-center.yml up
```

<&_ } -&>

<&_ if (fragment.othersSection) { -&>

### Code quality using Sonar

Sonar is used to analyse code quality. You can start a local Sonar server (accessible on http://localhost:9001) with:

```bash
docker compose -f src/main/docker/sonar.yml up -d
```

Note: we have turned off forced authentication redirect for UI in [src/main/docker/sonar.yml](src/main/docker/sonar.yml) for out of the box experience while trying out SonarQube, for real use cases turn it back on.

You can run a Sonar analysis with using the [sonar-scanner](https://docs.sonarqube.org/display/SCAN/Analyzing+with+SonarQube+Scanner)<% if (buildTool) { %> or by using the <%- buildTool === 'maven' ? 'maven' : '' %><%- buildTool === 'gradle' ? 'gradle' : '' %> plugin<% } %>.

Then, run a Sonar analysis:

<%_ if (buildToolMaven) { _%>
```bash
./mvnw -Pprod clean verify sonar:sonar -Dsonar.login=admin -Dsonar.password=admin
```

If you need to re-run the Sonar phase, please be sure to specify at least the `initialize` phase since Sonar properties are loaded from the sonar-project.properties file.

```bash
./mvnw initialize sonar:sonar -Dsonar.login=admin -Dsonar.password=admin
```
<%_ } else if (buildToolGradle) { _%>
```bash
./gradlew -Pprod clean check jacocoTestReport sonarqube -Dsonar.login=admin -Dsonar.password=admin
```
<%_ } _%>

Additionally, Instead of passing `sonar.password` and `sonar.login` as CLI arguments, these parameters can be configured from [sonar-project.properties](sonar-project.properties) as shown below:

```bash
sonar.login=admin
sonar.password=admin
```

For more information, refer to the [Code quality page][].

### Docker Compose support

JHipster generates a number of Docker Compose configuration files in the [<%- dockerServicesDir %>](<%- dockerServicesDir %>) folder to launch required third party services.

For example, to start required services in Docker containers, run:

```bash
docker compose -f <%- dockerServicesDir %>services.yml up -d
```

To stop and remove the containers, run:

```bash
docker compose -f <%- dockerServicesDir %>services.yml down
```

[Spring Docker Compose Integration](https://docs.spring.io/spring-boot/reference/features/dev-services.html) is enabled by default. It's possible to disable it in `application.yml`:

```yaml
spring:
  ...
  docker:
    compose:
      enabled: false
```

You can also fully dockerize your application and all the services that it depends on.
To achieve this, first build a Docker image of your app by running:

```bash
npm run java:docker
```

Or build an arm64 Docker image when using an arm64 processor OS, i.e., Apple Silicon chips (M*), running:

```bash
npm run java:docker:arm64
```

Then run:

```bash
docker compose -f <%- dockerServicesDir %>app.yml up -d
```

For more information refer to [Docker and Docker-Compose](<%- documentationArchiveUrl %>/docker-compose/), this page also contains information on the Docker Compose sub-generator (`jhipster docker-compose`), which is able to generate Docker configurations for one or several JHipster applications.

## Continuous Integration (optional)

To configure CI for your project, run the ci-cd sub-generator (`jhipster ci-cd`), this will let you generate configuration files for a number of Continuous Integration systems. Consult the [Setting up Continuous Integration](<%- documentationArchiveUrl %>/setting-up-ci/) page for more information.

<&_ } -&>
<&_ if (fragment.referenceSection) { -&>
<%_ if (serviceDiscoveryEureka) { _%>
- [Service Discovery and Configuration with the JHipster-Registry](<%- documentationArchiveUrl %>/microservices-architecture/#jhipster-registry)
<%_ } _%>
<%_ if (serviceDiscoveryConsul) { _%>
- [Service Discovery and Configuration with Consul](<%- documentationArchiveUrl %>/microservices-architecture/#consul)
<%_ } _%>
<&_ } -&>