<?xml version="1.0" encoding="UTF-8"?>
<ae:configurations xmlns="http://icinga.org/api/config/parts/access/1.0" xmlns:ae="http://agavi.org/agavi/config/global/envelope/1.0">
    <ae:configuration>

        <!-- Document resources
            http://docs.icinga.org/latest/en/icinga-web-config.html#configweb-access
            https://wiki.icinga.org/display/howtos/access.xml -->
      
        <!-- Map your instances to hosts here -->
        <instances>
            <instance name="@api_cmd_instance@">localhost</instance>

            <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="@web_conf_dir@/access.xml" xpointer="xmlns(ae=http://agavi.org/agavi/config/global/envelope/1.0) xmlns(ac=http://icinga.org/api/config/parts/access/1.0) xpointer(//ae:configurations//ae:configuration/ac:instances/node())">
                <xi:fallback></xi:fallback>
            </xi:include>


            <!-- include user configs statically -->
        </instances>

        <!--
            Default settings that will be set if useDefaults is true
        -->
        <defaults>
            <defaultHost>localhost</defaultHost>
            <access>
                <!-- allowed to read to and from -->
                <readwrite>
                    <folders>
                        <resource name="icinga_objects">@icinga_objects_dir@</resource> 
                    </folders>
                    <files>
    <!--                <resource name="icinga_cfg">@icinga_cfg@</resource>-->  
                    </files>
                </readwrite>
                <!-- allowed to be read from -->
                <read>
                </read>
                <!-- allowed to be written to -->
                <write>
                    <files>
                        <resource name="icinga_pipe">@api_cmd_file@</resource>
                    </files>
                </write>
                <!-- allowed to be executed -->
                <execute>
                    <files>
                        <resource name="icinga_service">/etc/init.d/icinga</resource>
                       
                        <resource name="icinga_bin">@icinga_bin@</resource>
                        <resource name="echo">/bin/echo</resource>
                        <resource name="printf">printf</resource>
                        <resource name="cp">/bin/cp</resource>
                        <resource name="ls">/bin/ls</resource>
                        <resource name="grep">/bin/grep</resource>
                    </files>
                </execute>
            </access>
            <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="@web_conf_dir@/access.xml" xpointer="xmlns(ae=http://agavi.org/agavi/config/global/envelope/1.0) xmlns(ac=http://icinga.org/api/config/parts/access/1.0) xpointer(//ae:configurations//ae:configuration/ac:defaults/node())">
                <xi:fallback></xi:fallback>
            </xi:include>
        </defaults>
        
        
        <!-- Hosts that can be accessed via the console interface -->
        <hosts>
            <host name="localhost">
                <type>local</type>
                <!-- Only allow access to these files, folders or executables -->
                <access useDefaults="true">
                    <read>
                        <files>
                            <resource name="test">test</resource>
                        </files>  
                    </read>

                    
                </access>
            </host>
            
            <!--  Example for ssh connection with user/password auth -->
            <host name="vm_host1">
                <type>ssh</type>
                <ssh-config>
                    <host>localhost</host>
                    <port>22</port>
                    <auth>
                        <type>password</type>
                        <user>testuser</user>
                        <password>test</password>
                    </auth>
                </ssh-config> 
                
                <access useDefaults="true" />
               
            </host>


    <!--
              This is experimental, try to avoid password encrypted keyfiles when encountering errors
              Example for ssh connection with pubkey auth -->                   
    <!--    
            <host name="vm_host2">
                <type>ssh</type>
                <ssh-config>
                    <host>localhost</ae:parameter>
                    <port>22</ae:parameter>
                    <auth>
                        <type>key</type>
                        <user>testuser</user>   
                        <private-key>/usr/local/icinga-web/app/modules/Api/lib/.ssh/host1_rsa</private-key>
                        <password>secret123</password>
                    </auth>
                </ssh-config> 
                
            
                <access useDefaults="true" />
            </host>
    --> 

            <!-- include user configs statically -->

            <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="@web_conf_dir@/access.xml" 
                    xpointer="xmlns(ae=http://agavi.org/agavi/config/global/envelope/1.0) 
                    xmlns(ac=http://icinga.org/api/config/parts/access/1.0) 
                     xpointer(//ae:configurations//ae:configuration/ac:hosts/node())">
                <xi:fallback></xi:fallback>
            </xi:include>
        </hosts>

    </ae:configuration>
</ae:configurations>
