Configuration Reference

Every application.yml property, grouped by area. Secrets are shown as placeholders — real values live only in server-side configuration.

Server

Property	Default	Description
`server.port`	8181	HTTP port
`server.servlet.context-path`	`/pckzra`	Base URL path
`server.address`	0.0.0.0	Listen on all interfaces
`server.forward-headers-strategy`	native	Trust X-Forwarded-* from Nginx
`server.error.include-message`	always	Include error messages in responses
`server.error.include-stacktrace`	never	Never leak stack traces

Database & JPA

Property	Default	Description
`spring.datasource.url`	`jdbc:mariadb://192.168.0.50:3306/pckmiddle?useSSL=false&&characterEncoding=utf8&createDatabaseIfNotExist=true`	JDBC URL
`spring.datasource.username` / `password`	`<secret>`	Database credentials
`spring.datasource.hikari.maximum-pool-size`	20	Max connections
`spring.datasource.hikari.minimum-idle`	5	Idle connections
`spring.datasource.hikari.leak-detection-threshold`	60000	Connection leak warning (ms)
`spring.jpa.hibernate.ddl-auto`	validate	Entities must match migrated schema
`spring.flyway.enabled`	true	Run migrations on startup
`spring.flyway.baseline-on-migrate` / `validate-on-migrate`	true	Baseline and validate the schema history

Authentication (Oracle IDM & JWT)

Property	Default	Description
`auth.server.url`	`https://ors-idm.msaf.oraclerestaurants.com`	Oracle IDM base
`auth.server.jwk-set-endpoint`	`/oauth2/jwks`	JWKS path
`auth.client.id` / `secret`	`<secret>`	Oracle client credentials
`auth.jwt.validation-enabled`	false	ON/OFF switch for JWKS validation — currently off for UAT
`auth.jwt.issuer`	Oracle IDM URL	Expected token issuer
`auth.jwt.audience`	`server.zra.co.zm`	Expected audience
`auth.jwt.clock-skew`	300	Seconds of tolerance
`auth.jwt.jwks-cache-duration`	3600	JWKS cache seconds

External APIs

Property	Default	Description
`external.chrilan.base-url`	`https://zra.abc.co.zm/smartinv`	Chrilan Smart API base
`external.chrilan.timeout`	30000	Call timeout (ms)
`external.chrilan.retry.max-attempts` / `backoff-delay`	3 / 1000	Retry policy
`external.oracle-sts.base-url`	`https://msaf-sts.oraclemicros.com/api/v1`	Oracle STS base
`external.oracle-sts.oidc-authority`	Oracle IDM URL	PKCE authority
`external.oracle-sts.client-id` / `username` / `password`	`<secret>`	STS credentials (org `PCK`)
`external.taxint.bearer-token-required`	true	Require Bearer header on POS API

No Chrilan API key in configuration Chrilan API keys are stored per store in the database. There is deliberately no chrilan.api.key fallback property.

Menu sync

Property	Default	Description
`menu-sync.enabled`	true	Global sync switch
`menu-sync.interval-ms`	60000	Cycle interval (1 minute)

WhatsApp (Whapi)

Property	Default	Description
`whapi.api.enabled`	true	Enable WhatsApp OTP/notifications
`whapi.api.token`	`<secret>`	Whapi API token
`whapi.api.base-url`	`https://gate.whapi.cloud`	Gateway base URL

Frontend & CORS

Property	Default	Description
`frontend.base-url`	`https://server.zra.co.zm/pckzra`	Public base URL
`frontend.cors.allowed-origins`	`https://server.zra.co.zm`	Permitted origins
`frontend.cors.allowed-methods`	GET,POST,PUT,DELETE,OPTIONS	Permitted methods
`frontend.cors.allow-credentials`	false	No cross-origin credentials

Middleware behavior

Property	Default	Description
`middleware.request-logging.enabled` / `response-logging.enabled`	true	Payload capture
`middleware.transaction-logging.enabled` / `conversion-logging.enabled`	true	Database audit writes
`middleware.max-request-size`	10MB	Request body cap
`middleware.timeout.request` / `response`	30000 / 60000	Timeouts (ms)
`rate-limiting.enabled`	true	Rate limit switch
`rate-limiting.requests-per-minute` / `burst-capacity`	100 / 200	Rate limit policy

Conversion

Property	Default	Description
`conversion.fiscal-code-mapping.A`	STANDARD_RATED	VAT code mapping
`conversion.fiscal-code-mapping.D`	ZERO_RATED_BY_NATURE
`conversion.fiscal-code-mapping.E`	EXEMPT
`conversion.fiscal-code-mapping.T`	STANDARD_RATED

Monitoring & docs

Property	Default	Description
`management.endpoints.web.exposure.include`	health,info,metrics,prometheus,loggers	Exposed actuator endpoints
`management.endpoint.health.show-details`	always	Detailed health output
`management.metrics.export.prometheus.enabled`	true	Prometheus metrics
`springdoc.swagger-ui.path`	`/swagger-ui.html`	Swagger UI (try-it-out enabled)
`springdoc.api-docs.path`	`/v3/api-docs`	OpenAPI JSON

Async pool

Property	Default
`spring.task.execution.pool.core-size` / `max-size` / `queue-capacity`	4 / 20 / 200
`spring.task.execution.thread-name-prefix`	`Taxint-Chrilan-`