//
//  Licensed to the Apache Software Foundation (ASF) under one or more
//  contributor license agreements.  See the NOTICE file distributed with
//  this work for additional information regarding copyright ownership.
//  The ASF licenses this file to You under the Apache License, Version 2.0
//  (the "License"); you may not use this file except in compliance with
//  the License.  You may obtain a copy of the License at
//
//      https://www.apache.org/licenses/LICENSE-2.0
//
//  Unless required by applicable law or agreed to in writing, software
//  distributed under the License is distributed on an "AS IS" BASIS,
//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
//  See the License for the specific language governing permissions and
//  limitations under the License.
//

// Code generated by code-generation. DO NOT EDIT.

[cols="2,2a,2a,2a,4a"]
|===
|Name |Type |Default Value |Required |Description
|Name 4+|Opcua
|Code 4+|`opcua`
|Maven Dependency 4+|

[subs=attributes+]
----
<dependency>
  <groupId>org.apache.plc4x</groupId>
  <artifactId>plc4j-driver-opcua</artifactId>
  <version>{page-component-version}</version>
</dependency>
----
|Default Transport 4+|`tcp`
|Supported Transports 4+|
 - `tcp`
5+|Config options:
|`protocol-code` |STRING | | |
|`transport-code` |STRING | | |
|`transport-config` |STRING | | |
|`discovery` |BOOLEAN |true| |Controls the feature of the discovery endpoint of an OPC UA server which every server +
will propagate over an '<address>/discovery' endpoint. The most common issue here is that most servers are not correctly +
configured and propagate the wrong external IP or URL address. If that is the case you can disable the discovery by +
configuring it with a `false` value. +
 +
The discovery phase is always conducted using `NONE` security policy.
|`username` |STRING | | |A username to authenticate to the OPCUA server with.
|`password` |STRING | | |A password to authenticate to the OPCUA server with.
|`security-policy` |STRING |Basic256Sha256| |The security policy applied to communication channel between driver and OPC UA server. +
Possible options are `NONE`, `Basic128Rsa15`, `Basic256`, `Basic256Sha256`, `Aes128_Sha256_RsaOaep`, `Aes256_Sha256_RsaPss`. +
`NONE` means the channel is neither signed nor encrypted, so anything on the path can read and +
change what is exchanged; it also leaves the server unauthenticated. A policy that signs and +
encrypts needs a trust anchor for the server's certificate - see `tls.trust-store` and +
`server-certificate-file`.
|`message-security` |STRING |SIGN_ENCRYPT| |The security policy applied to messages exchanged after handshake phase. +
Possible options are `NONE`, `SIGN`, `SIGN_ENCRYPT`. +
This option is effective only when `securityPolicy` turns encryption (anything beyond `NONE`).
|`tls.keystore` |STRING | | |The Keystore file used to lookup client certificate and its private key.
|`tls.keystore-type` |STRING |pkcs12| |Keystore type used to access keystore and private key, defaults to PKCS (for Java 11+). +
Possible values are between others `jks`, `pkcs11`, `dks`, `jceks`.
|`tls.keystore-password` |STRING | | |Java keystore password used to access keystore and private key.
|`generated-key-size` |INT |2048| |Size in bits of the RSA key of the certificate the driver generates when no `tls.keystore` is configured. It is ignored when a key store is supplied, as the key then comes from that store. Some servers require a minimum size; 4096 is a common requirement.
|`server-certificate-file` |STRING | | |Filesystem location where server certificate is located, supported formats are `DER` and `PEM`.
|`tls.trust-store` |STRING | | |The trust store file used to verify server certificates and its chain.
|`tls.trust-store-type` |STRING |pkcs12| |Keystore type used to access keystore and private key, defaults to PKCS (for Java 11+). +
Possible values are between others `jks`, `pkcs11`, `dks`, `jceks`.
|`tls.trust-store-password` |STRING | | |Password used to open trust store.
|`allow-insecure-credentials` |BOOLEAN |false| |Allows a username and password to be sent over a channel that neither signs nor encrypts. +
Without this, a connection configured with credentials over an unprotected channel fails rather +
than putting the password on the wire where anything on the path can read it. Setting it warns.
|`browse-max-references-per-node` |INT |65536| |Largest number of references the driver will collect for a single node while browsing. +
A Browse is answered in batches, each batch handing back a continuation point for the next, and +
the driver follows them until the server stops. A server that never stops would otherwise grow +
the collected list without limit. The same number is asked of the server as its per-node maximum, +
so it can stop before the driver has to. Set to 0 for no limit.
|`browse-max-total-nodes` |INT |1000000| |Largest number of nodes a single browse will expand. A browse walks whatever tree the +
server describes, and the driver has no way to know how large that is before walking it, so this +
bounds a tree that turns out to be unreasonable - or endless, if the server keeps naming nodes it +
has not named before. Set to 0 for no limit.
|`browse-max-depth` |INT |64| |How deep a browse will recurse into the node tree. Already-visited nodes are never +
expanded twice, so a reference cycle terminates on its own, but a server naming a fresh node at +
every level describes a tree with no bottom. Set to 0 for no limit.
|`tls.verify` |BOOLEAN |true| |Verifies the OPC UA server's certificate. Set to false to trust any certificate the server presents. +
Turning it off is UNSAFE: it leaves the connection open to man-in-the-middle attacks and defeats the +
integrity/authenticity guarantees of a signed secure channel. Only do so for local testing. In production, +
establish trust with `tls.trust-store` (chain validation) or `server-certificate-file` (certificate +
pinning) instead.
|`channel-lifetime-ms` |LONG |3600000| |Time for which negotiated secure channel, its keys and session remains open. Value in milliseconds, by default 60 minutes.
|`min-channel-lifetime-ms` |LONG |5000| |Shortest secure-channel lifetime this client will work with, in milliseconds. A server may revise the requested channel-lifetime-ms downwards, and the renewal schedule is derived from whatever it returns - so a very short lifetime means very frequent renewals, on an executor shared by every OPC UA connection in this JVM. A server-supplied lifetime below this value is raised to it and a warning is logged. If a server genuinely needs faster renewal, lower this value to accept it; the default is far below any lifetime a conforming server negotiates.
|`session-timeout-ms` |LONG |120000| |Expiry time for opened secure session, value in milliseconds. Defaults to 2 minutes.
|`handshake-timeout-ms` |LONG |60000| |Timeout for all negotiation steps prior acceptance of application level operations - this timeout applies to open secure channel, create session and close calls. Defaults to 60 seconds.
|`request-timeout-ms` |LONG |30000| |Timeout for read/write/subscribe calls. Value in milliseconds.
|`endpoint-host` |STRING | | |Endpoint host used to establish secure channel connection. Used when client made connection to server which advertises different hostname than one used for network connection.
|`endpoint-port` |INT | | |Endpoint port used to establish secure channel. Used when client made connection to server which advertises different port number than one used for network connection.
|`subscription-queue-size` |LONG |1| |Server-side queue depth per monitored item for subscriptions. 1 (default) keeps only +
the latest value between publishes; higher values retain intermediate changes for fast +
change-of-state tags, whose sampling rate can exceed the publishing (cycle) interval.
5+|Transport config options:
5+|
+++
<h4>tcp</h4>
+++
|`tcp.connect-timeout-ms` |INT |5000| |
|`tcp.read-timeout-ms` |INT |0| |
|`tcp.write-timeout-ms` |INT |0| |
|`tcp.no-delay` |BOOLEAN |true| |
|`tcp.keep-alive` |BOOLEAN |false| |
|`tcp.send-buffer-size` |INT |81920| |
|`tcp.receive-buffer-size` |INT |81920| |
|`tcp.local-address` |STRING | | |
|`tcp.local-port` |INT |0| |
|===
