diff --git a/.gitignore b/.gitignore
index 2c4dab1fde2..5644f0046d9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -12,6 +12,9 @@
 *.iml
 .idea/
 
+# VS Code
+.vscode/
+
 # Mac OS X
 .DS_Store
 
diff --git a/fhir-parent/pom.xml b/fhir-parent/pom.xml
index 18f412a95bc..1fc749c2e0f 100644
--- a/fhir-parent/pom.xml
+++ b/fhir-parent/pom.xml
@@ -756,6 +756,11 @@
                         </execution>
                     </executions>
                 </plugin>
+                <plugin>
+                    <groupId>io.openliberty.tools</groupId>
+                    <artifactId>liberty-maven-plugin</artifactId>
+                    <version>3.4.0</version>
+                </plugin>
                 <plugin>
                     <groupId>com.spotify</groupId>
                     <artifactId>dockerfile-maven-plugin</artifactId>
diff --git a/fhir-server-webapp/pom.xml b/fhir-server-webapp/pom.xml
index d37e9d4c3ee..f0a2ced5ce6 100644
--- a/fhir-server-webapp/pom.xml
+++ b/fhir-server-webapp/pom.xml
@@ -87,9 +87,16 @@
             <artifactId>jakarta.servlet-api</artifactId>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>org.apache.derby</groupId>
+            <artifactId>derby</artifactId>
+            <version>${derby.version}</version>
+            <scope>test</scope>
+        </dependency>
     </dependencies>
 
     <build>
+        <finalName>${fhir.server.war.name}</finalName>
         <plugins>
             <plugin>
                 <artifactId>maven-war-plugin</artifactId>
@@ -97,6 +104,35 @@
                     <warName>${fhir.server.war.name}</warName>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>io.openliberty.tools</groupId>
+                <artifactId>liberty-maven-plugin</artifactId>
+                <configuration>
+                    <!-- <verifyTimeout>120</verifyTimeout> -->
+                    <!-- <bootstrapProperties>
+                        <default.http.port>9080</default.http.port>
+                        <default.https.port>9443</default.https.port>
+                    </bootstrapProperties> -->
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-dependency-plugin</artifactId>
+                <version>3.1.2</version>
+                <executions>
+                    <execution>
+                        <id>copy-derby-dependency</id>
+                        <phase>package</phase>
+                        <goals>
+                            <goal>copy-dependencies</goal>
+                        </goals>
+                        <configuration>
+                            <includeArtifactIds>derby</includeArtifactIds>
+                            <outputDirectory>${project.build.directory}/liberty/wlp/usr/shared/lib/derby/</outputDirectory>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
         </plugins>
     </build>
 
diff --git a/fhir-server-webapp/src/main/liberty/config/config/default/extension-search-parameters.json b/fhir-server-webapp/src/main/liberty/config/config/default/extension-search-parameters.json
new file mode 100644
index 00000000000..23e3adda7db
--- /dev/null
+++ b/fhir-server-webapp/src/main/liberty/config/config/default/extension-search-parameters.json
@@ -0,0 +1,9 @@
+{
+	"resourceType": "Bundle",
+	"id": "searchParams",
+	"meta": {
+		"lastUpdated": "2018-12-27T22:37:54.724+11:00"
+	},
+	"type": "collection",
+	"entry": []
+}
diff --git a/fhir-server-webapp/src/main/liberty/config/config/default/extension-search-parameters.md b/fhir-server-webapp/src/main/liberty/config/config/default/extension-search-parameters.md
new file mode 100644
index 00000000000..5c06f076d93
--- /dev/null
+++ b/fhir-server-webapp/src/main/liberty/config/config/default/extension-search-parameters.md
@@ -0,0 +1,52 @@
+Modify the Bundle to add your Search Parameter definitions.  
+
+An example as follows: 
+
+{
+	"resourceType": "Bundle",
+	"id": "searchParams",
+	"meta": {
+		"lastUpdated": "2019-07-12T22:37:54.724+11:00"
+	},
+	"type": "collection",
+	"entry": [{
+		"fullUrl": "http://ibm.com/fhir/SearchParameter/Patient-favorite-color",
+		"resource": {
+			"resourceType": "SearchParameter",
+			"id": "Patient-favorite-color",
+			"url": "http://ibm.com/fhir/SearchParameter/Patient-favorite-color",
+			"version": "4.0.0",
+			"name": "favorite-color",
+			"status": "draft",
+			"experimental": false,
+			"date": "2018-12-27T22:37:54+11:00",
+			"publisher": "IBM FHIR Server Test",
+			"contact": [{
+				"telecom": [{
+					"system": "url",
+					"value": "http://ibm.com/fhir"
+				}]
+			},
+			{
+				"telecom": [{
+					"system": "url",
+					"value": "http://ibm.com/fhir"
+				}]
+			}],
+			"description": "the patient's favorite color",
+			"code": "favorite-color",
+			"base": ["Patient"],
+			"type": "string",
+			"xpathUsage": "normal",
+			"xpath": "f:Patient/f:extension[@url='http://ibm.com/fhir/extension/Patient/favorite-color']/f:valueString",
+			"expression": "Patient.extension.where(url='http://ibm.com/fhir/extension/Patient/favorite-color').valueString",
+			"multipleOr": true,
+			"multipleAnd": true,
+			"modifier": []
+		}
+	}]
+}
+
+
+
+FHIR® is the registered trademark of HL7 and is used with the permission of HL7.
\ No newline at end of file
diff --git a/fhir-server-webapp/src/main/liberty/config/config/default/fhir-server-config-audit-cicd.json b/fhir-server-webapp/src/main/liberty/config/config/default/fhir-server-config-audit-cicd.json
new file mode 100644
index 00000000000..45a2485bb3e
--- /dev/null
+++ b/fhir-server-webapp/src/main/liberty/config/config/default/fhir-server-config-audit-cicd.json
@@ -0,0 +1,146 @@
+{
+    "__comment": "FHIR Server configuration",
+    "fhirServer": {
+        "core": {
+            "tenantIdHeaderName": "X-FHIR-TENANT-ID",
+            "datastoreIdHeaderName": "X-FHIR-DSID",
+            "checkReferenceTypes": true,
+            "conditionalDeleteMaxNumber": 10,
+            "serverRegistryResourceProviderEnabled": true,
+            "disabledOperations": ""
+        },
+        "security": {
+            "cors": true,
+            "basic": {
+                "enabled": true
+            },
+            "certificates": {
+                "enabled": true
+            },
+            "oauth": {
+                "enabled": false,
+                "regUrl": "https://<host>:9443/oauth2/endpoint/oauth2-provider/registration",
+                "authUrl": "https://<host>:9443/oauth2/endpoint/oauth2-provider/authorize",
+                "tokenUrl": "https://<host>:9443/oauth2/endpoint/oauth2-provider/token",
+                "smart": {
+                    "enabled": false,
+                    "scopes": ["openid",
+                    "profile",
+                    "fhirUser",
+                    "launch/patient",
+                    "patient/*.*",
+                    "offline_access"],
+                    "capabilities": ["sso-openid-connect",
+                    "launch-standalone",
+                    "client-public",
+                    "client-confidential-symmetric",
+                    "permission-offline",
+                    "context-standalone-patient",
+                    "permission-patient"]
+                }
+            }
+        },
+        "notifications": {
+            "common": {
+                "__comment_includeResourceTypes": ["QuestionnaireResponse",
+                "CarePlan",
+                "MedicationAdministration",
+                "Device",
+                "DeviceComponent",
+                "DeviceMetric",
+                "MedicationOrder",
+                "Observation"]
+            },
+            "websocket": {
+                "__comment": "only enable this for single-tenant, single-server deployments",
+                "enabled": false
+            },
+            "kafka": {
+                "enabled": false,
+                "topicName": "fhirNotifications",
+                "connectionProperties": {
+                    "group.id": "securing-kafka-group",
+                    "bootstrap.servers": "localhost:9093",
+                    "security.protocol": "SSL",
+                    "ssl.truststore.location": "resources/security/kafka.client.truststore.p12",
+                    "ssl.truststore.password": "change-password",
+                    "ssl.keystore.location": "resources/security/kafka.client.keystore.p12",
+                    "ssl.keystore.password": "change-password",
+                    "ssl.key.password": "change-password",
+                    "ssl.truststore.type": "PKCS12",
+                    "ssl.keystore.type": "PKCS12",
+                    "acks": "all",
+                    "retries": "60",
+                    "request.timeout.ms": "10000",
+                    "max.block.ms": "60000",
+                    "max.in.flight.requests.per.connection": "5"
+                }
+            },
+            "nats": {
+                "enabled": false,
+                "cluster": "nats-streaming",
+                "channel": "fhirNotifications",
+                "clientId": "fhir-server",
+                "servers": "nats://nats-node1:4222,nats://nats-node2:4222,nats://nats-node3:4222",
+                "useTLS": false,
+                "truststoreLocation": "resources/security/nats.client.truststore.jks",
+                "truststorePassword": "change-password",
+                "keystoreLocation": "resources/security/nats.client.keystore.jks",
+                "keystorePassword": "change-password"
+            }
+        },
+        "audit": {
+            "serviceClassName": "com.ibm.fhir.audit.impl.KafkaService",
+            "serviceProperties": {
+                "load": "config",
+                "mapper": "cadf",
+                "auditTopic": "FHIR_AUDIT",
+                "geoCity": "Hamil",
+                "geoState": "Texas",
+                "geoCounty": "USA",
+                "kafka": {
+                    "bootstrap.servers": "kafka-1:19092,kafka-2:29092",
+                    "security.protocol": "SSL",
+                    "ssl.protocol": "TLSv1.2",
+                    "ssl.enabled.protocols": "TLSv1.2",
+                    "ssl.endpoint.identification.algorithm": "",
+                    "ssl.keystore.filename": "/config/config/default/kafka.producer.keystore.jks",
+                    "ssl.key.credentials": "/config/config/default/producer_sslkey_creds",
+                    "ssl.keystore.location": "/config/config/default/kafka.producer.keystore.jks",
+                    "ssl.truststore.location": "/config/config/default/kafka.producer.truststore.jks",
+                    "ssl.client.auth": "requested",
+                    "ssl.keystore.credentials": "/config/config/default/producer_keystore_creds",
+                    "ssl.keystore.password": "change-password",
+                    "security.inter.broker.protocol": "SSL",
+                    "ssl.key.password": "change-password",
+                    "ssl.truststore.password": "change-password",
+                    "ssl.truststore.filename": "/config/config/default/kafka.producer.truststore.jks",
+                    "ssl.truststore.credentials": "/config/config/default/producer_truststore_creds"
+                }
+            }
+        },
+        "persistence": {
+            "factoryClassname": "com.ibm.fhir.persistence.jdbc.FHIRPersistenceJDBCFactory",
+            "common": {
+                "__comment": "Configuration properties common to all persistence layer implementations",
+                "updateCreateEnabled": true
+            },
+            "jdbc": {
+                "__comment": "Configuration properties for the JDBC persistence implementation",
+                "enableCodeSystemsCache": true,
+                "enableParameterNamesCache": true,
+                "enableResourceTypesCache": true
+            },
+            "datasources": {
+                "default": {
+                    "jndiName": "jdbc/bootstrap_default_default",
+                    "type": "derby",
+                    "currentSchema": "APP"
+                }
+            }
+        },
+        "bulkdata": {
+            "enabled": false
+        }
+    }
+}
diff --git a/fhir-server-webapp/src/main/liberty/config/config/default/fhir-server-config-audit-config.json b/fhir-server-webapp/src/main/liberty/config/config/default/fhir-server-config-audit-config.json
new file mode 100644
index 00000000000..7957a084744
--- /dev/null
+++ b/fhir-server-webapp/src/main/liberty/config/config/default/fhir-server-config-audit-config.json
@@ -0,0 +1,137 @@
+{
+    "__comment": "FHIR Server configuration",
+    "fhirServer": {
+        "core": {
+            "tenantIdHeaderName": "X-FHIR-TENANT-ID",
+            "datastoreIdHeaderName": "X-FHIR-DSID",
+            "checkReferenceTypes": true,
+            "conditionalDeleteMaxNumber": 10,
+            "serverRegistryResourceProviderEnabled": true,
+            "disabledOperations": ""
+        },
+        "security": {
+            "cors": true,
+            "basic": {
+                "enabled": true
+            },
+            "certificates": {
+                "enabled": true
+            },
+            "oauth": {
+                "enabled": false,
+                "regUrl": "https://<host>:9443/oauth2/endpoint/oauth2-provider/registration",
+                "authUrl": "https://<host>:9443/oauth2/endpoint/oauth2-provider/authorize",
+                "tokenUrl": "https://<host>:9443/oauth2/endpoint/oauth2-provider/token",
+                "smart": {
+                    "enabled": false,
+                    "scopes": ["openid", "profile", "fhirUser", "launch/patient", "patient/*.*", "offline_access"],
+                    "capabilities": [
+                        "sso-openid-connect",
+                        "launch-standalone",
+                        "client-public",
+                        "client-confidential-symmetric",
+                        "permission-offline",
+                        "context-standalone-patient",
+                        "permission-patient"
+                    ]
+                }
+            }
+        },
+        "notifications": {
+            "common": {
+                "__comment_includeResourceTypes": [
+                    "QuestionnaireResponse",
+                    "CarePlan",
+                    "MedicationAdministration",
+                    "Device",
+                    "DeviceComponent",
+                    "DeviceMetric",
+                    "MedicationOrder",
+                    "Observation"
+                ]
+            },
+            "websocket": {
+                "__comment": "only enable this for single-tenant, single-server deployments",
+                "enabled": false
+            },
+            "kafka": {
+                "enabled": false,
+                "topicName": "fhirNotifications",
+                "connectionProperties": {
+                    "group.id": "securing-kafka-group",
+                    "bootstrap.servers": "localhost:9093",
+                    "security.protocol": "SSL",
+                    "ssl.truststore.location": "resources/security/kafka.client.truststore.p12",
+                    "ssl.truststore.password": "change-password",
+                    "ssl.keystore.location": "resources/security/kafka.client.keystore.p12",
+                    "ssl.keystore.password": "change-password",
+                    "ssl.key.password": "change-password",
+                    "ssl.truststore.type": "PKCS12",
+                    "ssl.keystore.type": "PKCS12",
+                    "acks": "all",
+                    "retries": "60",
+                    "request.timeout.ms": "10000",
+                    "max.block.ms": "60000",
+                    "max.in.flight.requests.per.connection": "5"
+                }
+            },
+            "nats": {
+                "enabled": false,
+                "cluster": "nats-streaming",
+                "channel": "fhirNotifications",
+                "clientId": "fhir-server",
+                "servers": "nats://nats-node1:4222,nats://nats-node2:4222,nats://nats-node3:4222",
+                "useTLS": false,
+                "truststoreLocation": "resources/security/nats.client.truststore.jks",
+                "truststorePassword": "change-password",
+                "keystoreLocation": "resources/security/nats.client.keystore.jks",
+                "keystorePassword": "change-password"
+            }
+        },
+        "audit": {
+            "serviceClassName" : "com.ibm.fhir.audit.impl.KafkaService",
+            "serviceProperties": {
+                "load": "config",
+                "mapper": "cadf",
+                "auditTopic": "FHIR_AUDIT",
+                "geoCity": "Dallas",
+                "geoState": "TX",
+                "geoCounty": "US",
+                "kafka" : {
+                        "sasl.jaas.config": "org.apache.kafka.common.security.plain.PlainLoginModule required username=\"token\" password=\"apiKeyCanGoHere\";",
+                        "bootstrap.servers": "broker-1:9093,broker-2:9093",
+                        "sasl.mechanism": "PLAIN",
+                        "security.protocol": "SASL_SSL",
+                        "ssl.protocol": "TLSv1.2",
+                        "ssl.enabled.protocols": "TLSv1.2",
+                        "ssl.endpoint.identification.algorithm": "HTTPS"
+                },
+                "kafkaServers": "broker-1:9093,broker-2:9093",
+                "kafkaApiKey": "apiKeyCanGoHere"
+            }
+        },
+        "persistence": {
+            "factoryClassname": "com.ibm.fhir.persistence.jdbc.FHIRPersistenceJDBCFactory",
+            "common": {
+                "__comment": "Configuration properties common to all persistence layer implementations",
+                "updateCreateEnabled": true
+            },
+            "jdbc": {
+                "__comment": "Configuration properties for the JDBC persistence implementation",
+                "enableCodeSystemsCache": true,
+                "enableParameterNamesCache": true,
+                "enableResourceTypesCache": true
+            },
+            "datasources": {
+                "default": {
+                    "jndiName": "jdbc/bootstrap_default_default",
+                    "type": "derby",
+                    "currentSchema": "APP"
+                }
+            }
+        },
+        "bulkdata": {
+            "enabled": false
+        }
+    }
+}
diff --git a/fhir-server-webapp/src/main/liberty/config/config/default/fhir-server-config-audit-environment.json b/fhir-server-webapp/src/main/liberty/config/config/default/fhir-server-config-audit-environment.json
new file mode 100644
index 00000000000..6422b1f997b
--- /dev/null
+++ b/fhir-server-webapp/src/main/liberty/config/config/default/fhir-server-config-audit-environment.json
@@ -0,0 +1,124 @@
+{
+    "__comment": "FHIR Server configuration",
+    "fhirServer": {
+        "core": {
+            "tenantIdHeaderName": "X-FHIR-TENANT-ID",
+            "datastoreIdHeaderName": "X-FHIR-DSID",
+            "checkReferenceTypes": true,
+            "conditionalDeleteMaxNumber": 10,
+            "serverRegistryResourceProviderEnabled": true,
+            "disabledOperations": ""
+        },
+        "security": {
+            "cors": true,
+            "basic": {
+                "enabled": true
+            },
+            "certificates": {
+                "enabled": true
+            },
+            "oauth": {
+                "enabled": false,
+                "regUrl": "https://<host>:9443/oauth2/endpoint/oauth2-provider/registration",
+                "authUrl": "https://<host>:9443/oauth2/endpoint/oauth2-provider/authorize",
+                "tokenUrl": "https://<host>:9443/oauth2/endpoint/oauth2-provider/token",
+                "smart": {
+                    "enabled": false,
+                    "scopes": ["openid", "profile", "fhirUser", "launch/patient", "patient/*.*", "offline_access"],
+                    "capabilities": [
+                        "sso-openid-connect",
+                        "launch-standalone",
+                        "client-public",
+                        "client-confidential-symmetric",
+                        "permission-offline",
+                        "context-standalone-patient",
+                        "permission-patient"
+                    ]
+                }
+            }
+        },
+        "notifications": {
+            "common": {
+                "__comment_includeResourceTypes": [
+                    "QuestionnaireResponse",
+                    "CarePlan",
+                    "MedicationAdministration",
+                    "Device",
+                    "DeviceComponent",
+                    "DeviceMetric",
+                    "MedicationOrder",
+                    "Observation"
+                ]
+            },
+            "websocket": {
+                "__comment": "only enable this for single-tenant, single-server deployments",
+                "enabled": false
+            },
+            "kafka": {
+                "enabled": false,
+                "topicName": "fhirNotifications",
+                "connectionProperties": {
+                    "group.id": "securing-kafka-group",
+                    "bootstrap.servers": "localhost:9093",
+                    "security.protocol": "SSL",
+                    "ssl.truststore.location": "resources/security/kafka.client.truststore.p12",
+                    "ssl.truststore.password": "change-password",
+                    "ssl.keystore.location": "resources/security/kafka.client.keystore.p12",
+                    "ssl.keystore.password": "change-password",
+                    "ssl.key.password": "change-password",
+                    "ssl.truststore.type": "PKCS12",
+                    "ssl.keystore.type": "PKCS12",
+                    "acks": "all",
+                    "retries": "60",
+                    "request.timeout.ms": "10000",
+                    "max.block.ms": "60000",
+                    "max.in.flight.requests.per.connection": "5"
+                }
+            },
+            "nats": {
+                "enabled": false,
+                "cluster": "nats-streaming",
+                "channel": "fhirNotifications",
+                "clientId": "fhir-server",
+                "servers": "nats://nats-node1:4222,nats://nats-node2:4222,nats://nats-node3:4222",
+                "useTLS": false,
+                "truststoreLocation": "resources/security/nats.client.truststore.jks",
+                "truststorePassword": "change-password",
+                "keystoreLocation": "resources/security/nats.client.keystore.jks",
+                "keystorePassword": "change-password"
+            }
+        },
+        "audit": {
+            "serviceClassName" : "com.ibm.fhir.audit.impl.KafkaService",
+            "serviceProperties" : {
+                "auditTopic": "FHIR_AUDIT",
+                "geoCity": "Dallas",
+                "geoState": "TX",
+                "geoCounty": "US"
+            }
+        },
+        "persistence": {
+            "factoryClassname": "com.ibm.fhir.persistence.jdbc.FHIRPersistenceJDBCFactory",
+            "common": {
+                "__comment": "Configuration properties common to all persistence layer implementations",
+                "updateCreateEnabled": true
+            },
+            "jdbc": {
+                "__comment": "Configuration properties for the JDBC persistence implementation",
+                "enableCodeSystemsCache": true,
+                "enableParameterNamesCache": true,
+                "enableResourceTypesCache": true
+            },
+            "datasources": {
+                "default": {
+                    "jndiName": "jdbc/bootstrap_default_default",
+                    "type": "derby",
+                    "currentSchema": "APP"
+                }
+            }
+        },
+        "bulkdata": {
+            "enabled": false
+        }
+    }
+}
diff --git a/fhir-server-webapp/src/main/liberty/config/config/default/fhir-server-config-db2.json b/fhir-server-webapp/src/main/liberty/config/config/default/fhir-server-config-db2.json
new file mode 100644
index 00000000000..f2073c54cc0
--- /dev/null
+++ b/fhir-server-webapp/src/main/liberty/config/config/default/fhir-server-config-db2.json
@@ -0,0 +1,203 @@
+{
+    "__comment": "FHIR Server configuration",
+    "fhirServer": {
+        "core": {
+            "tenantIdHeaderName": "X-FHIR-TENANT-ID",
+            "datastoreIdHeaderName": "X-FHIR-DSID",
+            "originalRequestUriHeaderName": "X-FHIR-FORWARDED-URL",
+            "checkReferenceTypes": true,
+            "conditionalDeleteMaxNumber": 10,
+            "capabilityStatementCacheTimeout": 60,
+            "serverRegistryResourceProviderEnabled": true,
+            "disabledOperations": ""
+        },
+        "security": {
+            "cors": true,
+            "basic": {
+                "enabled": true
+            },
+            "certificates": {
+                "enabled": true
+            },
+            "oauth": {
+                "enabled": false,
+                "regUrl": "https://<host>:9443/oauth2/endpoint/oauth2-provider/registration",
+                "authUrl": "https://<host>:9443/oauth2/endpoint/oauth2-provider/authorize",
+                "tokenUrl": "https://<host>:9443/oauth2/endpoint/oauth2-provider/token",
+                "smart": {
+                    "enabled": false,
+                    "scopes": ["openid", "profile", "fhirUser", "launch/patient", "patient/*.*", "offline_access"],
+                    "capabilities": [
+                        "sso-openid-connect",
+                        "launch-standalone",
+                        "client-public",
+                        "client-confidential-symmetric",
+                        "permission-offline",
+                        "context-standalone-patient",
+                        "permission-patient"
+                    ]
+                }
+            }
+        },
+        "notifications": {
+            "common": {
+                "__comment_includeResourceTypes": [
+                    "QuestionnaireResponse",
+                    "CarePlan",
+                    "MedicationAdministration",
+                    "Device",
+                    "DeviceComponent",
+                    "DeviceMetric",
+                    "MedicationOrder",
+                    "Observation"
+                ]
+            },
+            "websocket": {
+                "enabled": true
+            },
+            "kafka": {
+                "enabled": false,
+                "topicName": "fhirNotifications",
+                "connectionProperties": {
+                    "group.id": "securing-kafka-group",
+                    "bootstrap.servers": "localhost:9093",
+                    "security.protocol": "SSL",
+                    "ssl.truststore.location": "resources/security/kafka.client.truststore.p12",
+                    "ssl.truststore.password": "change-password",
+                    "ssl.keystore.location": "resources/security/kafka.client.keystore.p12",
+                    "ssl.keystore.password": "change-password",
+                    "ssl.key.password": "change-password",
+                    "ssl.truststore.type": "PKCS12",
+                    "ssl.keystore.type": "PKCS12",
+                    "acks": "all",
+                    "retries": "60",
+                    "request.timeout.ms": "10000",
+                    "max.block.ms": "60000",
+                    "max.in.flight.requests.per.connection": "5"
+                }
+            },
+            "nats": {
+                "enabled": true,
+                "cluster": "nats-streaming",
+                "channel": "fhirNotifications",
+                "clientId": "fhir-server",
+                "servers": "nats://nats-node1:4222,nats://nats-node2:4222,nats://nats-node3:4222",
+                "useTLS": false,
+                "truststoreLocation": "resources/security/nats.client.truststore.jks",
+                "truststorePassword": "change-password",
+                "keystoreLocation": "resources/security/nats.client.keystore.jks",
+                "keystorePassword": "change-password"
+            }
+        },
+        "audit": {
+            "serviceClassName" : "com.ibm.fhir.audit.impl.NopService",
+            "serviceProperties" : {
+            }
+        },
+        "persistence": {
+            "factoryClassname": "com.ibm.fhir.persistence.jdbc.FHIRPersistenceJDBCFactory",
+            "common": {
+                "__comment": "Configuration properties common to all persistence layer implementations",
+                "updateCreateEnabled": true
+            },
+            "jdbc": {
+                "__comment": "Configuration properties for the JDBC persistence implementation",
+                "enableCodeSystemsCache": true,
+                "enableParameterNamesCache": true,
+                "enableResourceTypesCache": true
+            },
+            "datasources": {
+                "default": {
+                    "type": "db2",
+                    "currentSchema": "fhirdata",
+                    "tenantKey": "<the-tenant-key>",
+                    "hints" : {
+                      "search.reopt": "ONCE"
+                    }
+                }
+            }
+        },
+        "bulkdata": {
+            "enabled": true,
+            "core": {
+                "api": {
+                    "url": "https://localhost:9443/ibm/api/batch",
+                    "user": "fhiradmin",
+                    "password": "change-password",
+                    "truststore": "resources/security/fhirTrustStore.p12",
+                    "truststorePassword": "change-password", 
+                    "trustAll": true
+                },
+                "cos" : { 
+                    "partUploadTriggerSizeMB": 10,
+                    "objectSizeThresholdMB": 200,
+                    "objectResourceCountThreshold": 200000,
+                    "useServerTruststore": true
+                },
+                "file" : { 
+                    "writeTriggerSizeMB": 1,
+                    "sizeThresholdMB": 200,
+                    "resourceCountThreshold": 200000
+                },
+                "pageSize": 100,
+                "batchIdEncryptionKey": "change-password",
+                "maxPartitions": 3, 
+                "maxInputs": 5
+            },
+            "storageProviders": {
+                "default" : {
+                    "type": "file",
+                    "_type": "ibm-cos|aws-s3|file|https|azure-blob",
+                    "validBaseUrls": [],
+                    "fileBase": "/output/bulkdata",
+                    "enableParquet": false,
+                    "disableBaseUrlValidation": true,
+                    "disableOperationOutcomes": true,
+                    "duplicationCheck": false, 
+                    "validateResources": false
+                },
+                "minio" : {
+                    "type": "aws-s3",
+                    "bucketName": "fhirbulkdata",
+                    "location": "us",
+                    "endpointInternal": "https://minio:9000",
+                    "endpointExternal": "https://localhost:9000",
+                    "auth" : {
+                        "type": "hmac",
+                        "accessKeyId": "minio",
+                        "secretAccessKey": "change-password"
+                    },
+                    "enableParquet": false,
+                    "disableBaseUrlValidation": true,
+                    "disableOperationOutcomes": true,
+                    "duplicationCheck": false, 
+                    "validateResources": false, 
+                    "create": false,
+                    "presigned": true
+                },
+                "azure" : {
+                    "type": "azure-blob",
+                    "_type": "ibm-cos|aws-s3|file|https|azure-blob",
+                    "bucketName": "fhirbulkdata",
+                    "auth" : {
+                        "type": "connection",
+                        "connection": "DefaultEndpointsProtocol=https;AccountName=XYZ;AccountKey=XYZKEY;EndpointSuffix=core.windows.net"
+                    },
+                    "disableOperationOutcomes": true,
+                    "duplicationCheck": false, 
+                    "validateResources": false, 
+                    "create": false
+                }
+            }
+        },
+        "operations": {
+            "erase": {
+                "enabled": true,
+                "allowedRoles": [
+                    "FHIROperationAdmin",
+                    "FHIRUsers"
+                ]
+            }
+        }
+    }
+}
diff --git a/fhir-server-webapp/src/main/liberty/config/config/default/fhir-server-config-notifications-cicd.json b/fhir-server-webapp/src/main/liberty/config/config/default/fhir-server-config-notifications-cicd.json
new file mode 100644
index 00000000000..6fa67308d4e
--- /dev/null
+++ b/fhir-server-webapp/src/main/liberty/config/config/default/fhir-server-config-notifications-cicd.json
@@ -0,0 +1,156 @@
+{
+    "__comment": "FHIR Server configuration",
+    "fhirServer": {
+        "core": {
+            "tenantIdHeaderName": "X-FHIR-TENANT-ID",
+            "datastoreIdHeaderName": "X-FHIR-DSID",
+            "checkReferenceTypes": true,
+            "conditionalDeleteMaxNumber": 10,
+            "serverRegistryResourceProviderEnabled": true,
+            "disabledOperations": ""
+        },
+        "security": {
+            "cors": true,
+            "basic": {
+                "enabled": true
+            },
+            "certificates": {
+                "enabled": true
+            },
+            "oauth": {
+                "enabled": false,
+                "regUrl": "https://<host>:9443/oauth2/endpoint/oauth2-provider/registration",
+                "authUrl": "https://<host>:9443/oauth2/endpoint/oauth2-provider/authorize",
+                "tokenUrl": "https://<host>:9443/oauth2/endpoint/oauth2-provider/token",
+                "smart": {
+                    "enabled": false,
+                    "scopes": ["openid",
+                    "profile",
+                    "fhirUser",
+                    "launch/patient",
+                    "patient/*.*",
+                    "offline_access"],
+                    "capabilities": ["sso-openid-connect",
+                    "launch-standalone",
+                    "client-public",
+                    "client-confidential-symmetric",
+                    "permission-offline",
+                    "context-standalone-patient",
+                    "permission-patient"]
+                }
+            }
+        },
+        "notifications": {
+            "common": {
+                "includeResourceTypes": [
+                    "Patiennt",
+                    "QuestionnaireResponse",
+                    "CarePlan",
+                    "MedicationAdministration",
+                    "Device",
+                    "DeviceComponent",
+                    "DeviceMetric",
+                    "MedicationOrder",
+                    "Observation"]
+            },
+            "websocket": {
+                "__comment": "only enable this for single-tenant, single-server deployments",
+                "enabled": false
+            },
+            "kafka": {
+                "enabled": true,
+                "topicName": "FHIR_NOTIFICATIONS",
+                "connectionProperties": {
+                    "group.id": "securing-kafka-group",
+                    "bootstrap.servers": "kafka-1:19092,kafka-2:29092",
+                    "security.protocol": "SSL",
+                    "ssl.protocol": "TLSv1.2",
+                    "ssl.enabled.protocols": "TLSv1.2",
+                    "ssl.endpoint.identification.algorithm": "",
+                    "ssl.keystore.filename": "/config/config/default/kafka.producer.keystore.jks",
+                    "ssl.key.credentials": "/config/config/default/producer_sslkey_creds",
+                    "ssl.keystore.location": "/config/config/default/kafka.producer.keystore.jks",
+                    "ssl.truststore.location": "/config/config/default/kafka.producer.truststore.jks",
+                    "ssl.client.auth": "requested",
+                    "ssl.keystore.credentials": "/config/config/default/producer_keystore_creds",
+                    "ssl.keystore.password": "change-password",
+                    "security.inter.broker.protocol": "SSL",
+                    "ssl.key.password": "change-password",
+                    "ssl.truststore.password": "change-password",
+                    "ssl.truststore.filename": "/config/config/default/kafka.producer.truststore.jks",
+                    "ssl.truststore.credentials": "/config/config/default/producer_truststore_creds",
+                    "acks": "all",
+                    "retries": "60",
+                    "request.timeout.ms": "10000",
+                    "max.block.ms": "60000",
+                    "max.in.flight.requests.per.connection": "5"
+                }
+            },
+            "nats": {
+                "enabled": false,
+                "cluster": "nats-streaming",
+                "channel": "fhirNotifications",
+                "clientId": "fhir-server",
+                "servers": "nats://nats-node1:4222,nats://nats-node2:4222,nats://nats-node3:4222",
+                "useTLS": false,
+                "truststoreLocation": "resources/security/nats.client.truststore.jks",
+                "truststorePassword": "change-password",
+                "keystoreLocation": "resources/security/nats.client.keystore.jks",
+                "keystorePassword": "change-password"
+            }
+        },
+        "audit": {
+            "serviceClassName": "com.ibm.fhir.audit.impl.NopService",
+            "serviceProperties": {
+                "load": "config",
+                "mapper": "cadf",
+                "auditTopic": "FHIR_AUDIT",
+                "geoCity": "Hamil",
+                "geoState": "Texas",
+                "geoCounty": "USA",
+                "kafka": {
+                    "bootstrap.servers": "kafka-1:19092,kafka-2:29092",
+                    "security.protocol": "SSL",
+                    "ssl.protocol": "TLSv1.2",
+                    "ssl.enabled.protocols": "TLSv1.2",
+                    "ssl.endpoint.identification.algorithm": "",
+                    "ssl.keystore.filename": "/config/config/default/kafka.producer.keystore.jks",
+                    "ssl.key.credentials": "/config/config/default/producer_sslkey_creds",
+                    "ssl.keystore.location": "/config/config/default/kafka.producer.keystore.jks",
+                    "ssl.truststore.location": "/config/config/default/kafka.producer.truststore.jks",
+                    "ssl.client.auth": "requested",
+                    "ssl.keystore.credentials": "/config/config/default/producer_keystore_creds",
+                    "ssl.keystore.password": "change-password",
+                    "security.inter.broker.protocol": "SSL",
+                    "ssl.key.password": "change-password",
+                    "ssl.truststore.password": "change-password",
+                    "ssl.truststore.filename": "/config/config/default/kafka.producer.truststore.jks",
+                    "ssl.truststore.credentials": "/config/config/default/producer_truststore_creds"
+                }
+            }
+        },
+        "persistence": {
+            "factoryClassname": "com.ibm.fhir.persistence.jdbc.FHIRPersistenceJDBCFactory",
+            "common": {
+                "__comment": "Configuration properties common to all persistence layer implementations",
+                "updateCreateEnabled": true
+            },
+            "jdbc": {
+                "__comment": "Configuration properties for the JDBC persistence implementation",
+                "enableCodeSystemsCache": true,
+                "enableParameterNamesCache": true,
+                "enableResourceTypesCache": true
+            },
+            "datasources": {
+                "default": {
+                    "jndiName": "jdbc/bootstrap_default_default",
+                    "type": "derby",
+                    "currentSchema": "APP"
+                }
+            }
+        },
+        "bulkdata": {
+            "enabled": false
+        }
+    }
+}
diff --git a/fhir-server-webapp/src/main/liberty/config/config/default/fhir-server-config-postgresql.json b/fhir-server-webapp/src/main/liberty/config/config/default/fhir-server-config-postgresql.json
new file mode 100644
index 00000000000..a60f91cd9d8
--- /dev/null
+++ b/fhir-server-webapp/src/main/liberty/config/config/default/fhir-server-config-postgresql.json
@@ -0,0 +1,82 @@
+{
+    "__comment": "FHIR Server configuration",
+    "fhirServer": {
+        "core": {
+            "tenantIdHeaderName": "X-FHIR-TENANT-ID",
+            "datastoreIdHeaderName": "X-FHIR-DSID",
+            "originalRequestUriHeaderName": "X-FHIR-FORWARDED-URL",
+            "checkReferenceTypes": true,
+            "conditionalDeleteMaxNumber": 10,
+            "serverRegistryResourceProviderEnabled": true,
+            "disabledOperations": ""
+        },
+        "security": {
+            "cors": true,
+            "basic": {
+                "enabled": true
+            },
+            "certificates": {
+                "enabled": true
+            },
+            "oauth": {
+                "enabled": false,
+                "regUrl": "https://<host>:9443/oauth2/endpoint/oauth2-provider/registration",
+                "authUrl": "https://<host>:9443/oauth2/endpoint/oauth2-provider/authorize",
+                "tokenUrl": "https://<host>:9443/oauth2/endpoint/oauth2-provider/token",
+                "smart": {
+                    "enabled": false,
+                    "scopes": ["openid", "profile", "fhirUser", "launch/patient", "patient/*.*", "offline_access"],
+                    "capabilities": [
+                        "sso-openid-connect",
+                        "launch-standalone",
+                        "client-public",
+                        "client-confidential-symmetric",
+                        "permission-offline",
+                        "context-standalone-patient",
+                        "permission-patient"
+                    ]
+                }
+            }
+        },
+        "audit": {
+            "serviceClassName" : "com.ibm.fhir.audit.impl.NopService",
+            "serviceProperties" : {
+            }
+        },
+        "persistence": {
+            "factoryClassname": "com.ibm.fhir.persistence.jdbc.FHIRPersistenceJDBCFactory",
+            "common": {
+                "__comment": "Configuration properties common to all persistence layer implementations",
+                "updateCreateEnabled": true
+            },
+            "jdbc": {
+                "__comment": "Configuration properties for the JDBC persistence implementation",
+                "enableCodeSystemsCache": true,
+                "enableParameterNamesCache": true,
+                "enableResourceTypesCache": true
+            },
+            "datasources": {
+                "default": {
+                    "type": "postgresql",
+                    "currentSchema": "fhirdata",
+                    "searchOptimizerOptions": {
+                        "from_collapse_limit": 12,
+                        "join_collapse_limit": 12
+                    }
+                }
+            }
+        },
+        "bulkdata": {
+            "enabled": false
+        },
+        "operations": {
+            "erase": {
+                "enabled": true,
+                "allowedRoles": [
+                    "FHIROperationAdmin",
+                    "FHIRUsers"
+                ]
+            }
+        }
+    }
+}
diff --git a/fhir-server-webapp/src/main/liberty/config/config/default/fhir-server-config.json b/fhir-server-webapp/src/main/liberty/config/config/default/fhir-server-config.json
new file mode 100644
index 00000000000..e08fe80beeb
--- /dev/null
+++ b/fhir-server-webapp/src/main/liberty/config/config/default/fhir-server-config.json
@@ -0,0 +1,208 @@
+{
+    "__comment": "FHIR Server configuration",
+    "fhirServer": {
+        "core": {
+            "tenantIdHeaderName": "X-FHIR-TENANT-ID",
+            "datastoreIdHeaderName": "X-FHIR-DSID",
+            "originalRequestUriHeaderName": "X-FHIR-FORWARDED-URL",
+            "checkReferenceTypes": true,
+            "conditionalDeleteMaxNumber": 10,
+            "serverRegistryResourceProviderEnabled": true,
+            "disabledOperations": ""
+        },
+        "search": {
+            "useStoredCompartmentParam": true
+        },
+        "security": {
+            "cors": true,
+            "basic": {
+                "enabled": true
+            },
+            "certificates": {
+                "enabled": true
+            },
+            "oauth": {
+                "enabled": false,
+                "regUrl": "https://<host>:9443/oauth2/endpoint/oauth2-provider/registration",
+                "authUrl": "https://<host>:9443/oauth2/endpoint/oauth2-provider/authorize",
+                "tokenUrl": "https://<host>:9443/oauth2/endpoint/oauth2-provider/token",
+                "smart": {
+                    "enabled": false,
+                    "scopes": ["openid", "profile", "fhirUser", "launch/patient", "patient/*.*", "offline_access"],
+                    "capabilities": [
+                        "sso-openid-connect",
+                        "launch-standalone",
+                        "client-public",
+                        "client-confidential-symmetric",
+                        "permission-offline",
+                        "context-standalone-patient",
+                        "permission-patient"
+                    ]
+                }
+            }
+        },
+        "notifications": {
+            "common": {
+                "__comment_includeResourceTypes": [
+                    "QuestionnaireResponse",
+                    "CarePlan",
+                    "MedicationAdministration",
+                    "Device",
+                    "DeviceComponent",
+                    "DeviceMetric",
+                    "MedicationOrder",
+                    "Observation"
+                ]
+            },
+            "websocket": {
+                "__comment": "only enable this for single-tenant, single-server deployments",
+                "enabled": false
+            },
+            "kafka": {
+                "enabled": false,
+                "topicName": "fhirNotifications",
+                "connectionProperties": {
+                    "group.id": "securing-kafka-group",
+                    "bootstrap.servers": "localhost:9093",
+                    "security.protocol": "SSL",
+                    "ssl.truststore.location": "resources/security/kafka.client.truststore.p12",
+                    "ssl.truststore.password": "change-password",
+                    "ssl.keystore.location": "resources/security/kafka.client.keystore.p12",
+                    "ssl.keystore.password": "change-password",
+                    "ssl.key.password": "change-password",
+                    "ssl.truststore.type": "PKCS12",
+                    "ssl.keystore.type": "PKCS12",
+                    "acks": "all",
+                    "retries": "60",
+                    "request.timeout.ms": "10000",
+                    "max.block.ms": "60000",
+                    "max.in.flight.requests.per.connection": "5"
+                }
+            },
+            "nats": {
+                "enabled": false,
+                "cluster": "nats-streaming",
+                "channel": "fhirNotifications",
+                "clientId": "fhir-server",
+                "servers": "nats://nats-node1:4222,nats://nats-node2:4222,nats://nats-node3:4222",
+                "useTLS": false,
+                "truststoreLocation": "resources/security/nats.client.truststore.jks",
+                "truststorePassword": "change-password",
+                "keystoreLocation": "resources/security/nats.client.keystore.jks",
+                "keystorePassword": "change-password"
+            }
+        },
+        "audit": {
+            "serviceClassName" : "com.ibm.fhir.audit.impl.NopService",
+            "serviceProperties" : {
+            }
+        },
+        "persistence": {
+            "factoryClassname": "com.ibm.fhir.persistence.jdbc.FHIRPersistenceJDBCFactory",
+            "common": {
+                "__comment": "Configuration properties common to all persistence layer implementations",
+                "updateCreateEnabled": true
+            },
+            "jdbc": {
+                "__comment": "Configuration properties for the JDBC persistence implementation",
+                "enableCodeSystemsCache": true,
+                "enableParameterNamesCache": true,
+                "enableResourceTypesCache": true
+            },
+            "datasources": {
+                "default": {
+                    "jndiName": "jdbc/bootstrap_default_default",
+                    "type": "derby",
+                    "currentSchema": "APP"
+                },
+                "_db2sample": {
+                    "type": "db2",
+                    "tenantKey": "<the-tenant-key>",
+                    "currentSchema": "fhirdata",
+                    "hints" : {
+                      "search.reopt": "ONCE"
+                    }
+                },
+                "_pgsample": {
+                    "type": "postgresql",
+                    "currentSchema": "fhirdata",
+                    "searchOptimizerOptions": {
+                        "from_collapse_limit": 12,
+                        "join_collapse_limit": 12
+                    }
+                }
+            }
+        },
+        "bulkdata": {
+            "enabled": true,
+            "core": {
+                "api": {
+                    "url": "https://localhost:9443/ibm/api/batch",
+                    "user": "fhiradmin",
+                    "password": "change-password",
+                    "truststore": "resources/security/fhirTrustStore.p12",
+                    "truststorePassword": "change-password", 
+                    "trustAll": true
+                },
+                "cos" : { 
+                    "partUploadTriggerSizeMB": 10,
+                    "objectSizeThresholdMB": 200,
+                    "objectResourceCountThreshold": 200000,
+                    "useServerTruststore": true,
+                    "presignedExpiry": 86400
+                },
+                "file" : { 
+                    "writeTriggerSizeMB": 1,
+                    "sizeThresholdMB": 200,
+                    "resourceCountThreshold": 200000
+                },
+                "pageSize": 100,
+                "batchIdEncryptionKey": "change-password",
+                "maxPartitions": 3, 
+                "maxInputs": 5,
+                "maxChunkReadTime": "90000",
+                "systemExportImpl": "fast",
+                "defaultExportProvider": "default",
+                "defaultImportProvider": "default"
+            },
+            "storageProviders": {
+                "default" : {
+                    "type": "file",
+                    "_type": "ibm-cos|aws-s3|file|https|azure-blob",
+                    "validBaseUrls": [],
+                    "fileBase": "/output/bulkdata",
+                    "bucketName": "fhir-performance",
+                    "location": "us",
+                    "endpointInternal": "https://s3.us-east.cloud-object-storage.appdomain.cloud",
+                    "endpointExternal": "https://s3.us-east.cloud-object-storage.appdomain.cloud",
+                    "auth" : {
+                        "type": "hmac",
+                        "accessKeyId": "key",
+                        "secretAccessKey": "secret"
+                    },
+                    "_iam_auth" : {
+                        "type": "iam",
+                        "iamApiKey": "apiKey",
+                        "iamResourceInstanceId": "resourceId"
+                    },
+                    "enableParquet": false,
+                    "disableBaseUrlValidation": true,
+                    "disableOperationOutcomes": true,
+                    "duplicationCheck": false, 
+                    "validateResources": false, 
+                    "create": false,
+                    "presigned": true
+                }
+            }
+        },
+        "operations": {
+            "erase": {
+                "enabled": true,
+                "allowedRoles": [
+                    "FHIROperationAdmin",
+                    "FHIRUsers"
+                ]
+            }
+        }
+    }
+}
diff --git a/fhir-server-webapp/src/main/liberty/config/configDropins/defaults/bulkdata.xml b/fhir-server-webapp/src/main/liberty/config/configDropins/defaults/bulkdata.xml
new file mode 100644
index 00000000000..2fa1e548062
--- /dev/null
+++ b/fhir-server-webapp/src/main/liberty/config/configDropins/defaults/bulkdata.xml
@@ -0,0 +1,40 @@
+<server description="fhir-server">
+    <!-- 
+        By default, in-memory derby is used for job repository, no configuration is needed.
+        If you need an alternative, check the disabled folder for your persistence datastore/provider.
+    -->
+    <featureManager>
+        <feature>batch-1.0</feature>
+        <feature>batchManagement-1.0</feature>
+        <feature>jdbc-4.1</feature>
+        <feature>servlet-4.0</feature>
+        <feature>transportSecurity-1.0</feature>
+    </featureManager>
+
+    <authorization-roles id="com.ibm.ws.batch">
+        <security-role id="batchAdmin" name="batchAdmin">
+            <user id="batchAdminUser" name="fhiradmin"/>
+        </security-role>
+        <security-role id="batchSubmitter" name="batchSubmitter">
+            <user id="batchSubmitterUser" name="fhiruser"/>
+        </security-role>
+        <security-role id="batchMonitor" name="batchMonitor">
+            <user id="batchMonitorUser1" name="fhiradmin"/>
+            <user id="batchMonitorUser2" name="fhiruser"/>
+        </security-role>
+    </authorization-roles>
+
+    <webApplication id="fhir-bulkdata-webapp" location="fhir-bulkdata-webapp.war" name="fhir-bulkdata-webapp">
+        <classloader privateLibraryRef="fhirUserLib"/>
+        <application-bnd>
+            <security-role id="users" name="FHIRUsers">
+                <group id="bulkUsersGroup" name="FHIRUsers"/>
+            </security-role>
+        </application-bnd>
+    </webApplication>
+
+    <batchPersistence jobStoreRef="BatchDatabaseStore"/>
+    
+    <variable name="BATCH_DB_SCHEMA" defaultValue="FHIR_JBATCH"/>
+    <databaseStore dataSourceRef="fhirbatchDS" id="BatchDatabaseStore" schema="${BATCH_DB_SCHEMA}" tablePrefix="" createTables="false"/>
+</server>
diff --git a/fhir-server-webapp/src/main/liberty/config/configDropins/defaults/datasource.xml b/fhir-server-webapp/src/main/liberty/config/configDropins/defaults/datasource.xml
new file mode 100644
index 00000000000..3571c4c7aff
--- /dev/null
+++ b/fhir-server-webapp/src/main/liberty/config/configDropins/defaults/datasource.xml
@@ -0,0 +1,15 @@
+<server>
+    <!-- ============================================================== -->
+    <!-- This datasource aligns with the Apache Derby database that is  -->
+    <!-- created by the ibmcom/ibm-fhir-server BOOTSTRAP_DB process.    -->
+    <!-- ============================================================== -->
+
+    <!-- ============================================================== -->
+    <!-- TENANT: default; DSID: default; TYPE: read-write               -->
+    <!-- ============================================================== -->
+    <dataSource id="bootstrapDefaultDefault" jndiName="jdbc/bootstrap_default_default" type="javax.sql.XADataSource" statementCacheSize="200" syncQueryTimeoutWithTransactionTimeout="true" validationTimeout="30s" isolationLevel="TRANSACTION_READ_COMMITTED">
+        <jdbcDriver javax.sql.XADataSource="org.apache.derby.jdbc.EmbeddedXADataSource" libraryRef="sharedLibDerby"/>
+        <properties.derby.embedded databaseName="derby/fhirDB"/>
+        <connectionManager maxPoolSize="50" minPoolSize="10"/>
+    </dataSource>
+</server>
diff --git a/fhir-server-webapp/src/main/liberty/config/configDropins/defaults/keystore.xml b/fhir-server-webapp/src/main/liberty/config/configDropins/defaults/keystore.xml
new file mode 100644
index 00000000000..e3f265ce8df
--- /dev/null
+++ b/fhir-server-webapp/src/main/liberty/config/configDropins/defaults/keystore.xml
@@ -0,0 +1,4 @@
+<server description="fhir-server">
+    <!-- This empty config file is here to prevent the openliberty docker.ci from generating a new keystore. -->
+    <!-- The ssl config, along with the keystore and truststore config, are defined in the main server.xml -->
+</server>
\ No newline at end of file
diff --git a/fhir-server-webapp/src/main/liberty/config/configDropins/defaults/openapi.xml b/fhir-server-webapp/src/main/liberty/config/configDropins/defaults/openapi.xml
new file mode 100644
index 00000000000..0ed602121de
--- /dev/null
+++ b/fhir-server-webapp/src/main/liberty/config/configDropins/defaults/openapi.xml
@@ -0,0 +1,9 @@
+<server>
+    <featureManager>
+        <feature>mpOpenAPI-2.0</feature>
+    </featureManager>
+    
+    <!-- This is the openapi definition for the IBM FHIR Server -->
+    <webApplication id="fhir-openapi" location="fhir-openapi.war" name="fhir-openapi">
+    </webApplication>
+</server>
\ No newline at end of file
diff --git a/fhir-server-webapp/src/main/liberty/config/configDropins/defaults/transaction-manager.xml b/fhir-server-webapp/src/main/liberty/config/configDropins/defaults/transaction-manager.xml
new file mode 100644
index 00000000000..310e0889d41
--- /dev/null
+++ b/fhir-server-webapp/src/main/liberty/config/configDropins/defaults/transaction-manager.xml
@@ -0,0 +1,7 @@
+<server description="fhir-server">
+    <featureManager>
+        <feature>jdbc-4.1</feature>
+    </featureManager>
+    <variable name="FHIR_TRANSACTION_MANAGER_TIMEOUT" defaultValue="120s"/>
+    <transaction totalTranLifetimeTimeout="${FHIR_TRANSACTION_MANAGER_TIMEOUT}"/>
+</server>
\ No newline at end of file
diff --git a/fhir-server-webapp/src/main/liberty/config/configDropins/defaults/trustDefault.xml b/fhir-server-webapp/src/main/liberty/config/configDropins/defaults/trustDefault.xml
new file mode 100644
index 00000000000..40d2eeef69c
--- /dev/null
+++ b/fhir-server-webapp/src/main/liberty/config/configDropins/defaults/trustDefault.xml
@@ -0,0 +1,4 @@
+<server description="fhir-server">
+    <ssl id="defaultSSLConfig" trustDefaultCerts="${SEC_TLS_TRUSTDEFAULTCERTS}"/>
+    <variable name="SEC_TLS_TRUSTDEFAULTCERTS" defaultValue="true"/>
+</server>
\ No newline at end of file
diff --git a/fhir-server-webapp/src/main/liberty/config/configDropins/disabled/README.md b/fhir-server-webapp/src/main/liberty/config/configDropins/disabled/README.md
new file mode 100644
index 00000000000..b3cff423560
--- /dev/null
+++ b/fhir-server-webapp/src/main/liberty/config/configDropins/disabled/README.md
@@ -0,0 +1,13 @@
+This readme applies to all files in this folder:
+
+# Datasources used for server integration tests
+
+```
+datasource-db2.xml
+datasource-derby.xml
+datasource-postgresql.xml
+```
+
+These files are copied to the overrides folder and renamed to datasource.xml.
+
+Only one of these datasource definition files should be copied into the target Liberty configDropins/overrides folder. If more than one of these is present at the same time it will break the Liberty configuration because the datasource ids and JNDI location are common among the files.
\ No newline at end of file
diff --git a/fhir-server-webapp/src/main/liberty/config/configDropins/disabled/cors.xml b/fhir-server-webapp/src/main/liberty/config/configDropins/disabled/cors.xml
new file mode 100644
index 00000000000..078dd720ad4
--- /dev/null
+++ b/fhir-server-webapp/src/main/liberty/config/configDropins/disabled/cors.xml
@@ -0,0 +1,6 @@
+<server description="fhir-server">
+    <!-- Enable CORS (Cross Origin Resource Sharing) -->
+    <cors allowCredentials="true" allowedMethods="GET, PUT, POST"
+        allowedHeaders="Content-Type, Authorization, Accept, Origin"
+        allowedOrigins="*" domain="/fhir-server/api/v4" maxAge="3600"/>
+</server>
\ No newline at end of file
diff --git a/fhir-server-webapp/src/main/liberty/config/configDropins/disabled/datasource-db2.xml b/fhir-server-webapp/src/main/liberty/config/configDropins/disabled/datasource-db2.xml
new file mode 100644
index 00000000000..fa317fb413e
--- /dev/null
+++ b/fhir-server-webapp/src/main/liberty/config/configDropins/disabled/datasource-db2.xml
@@ -0,0 +1,18 @@
+<server>
+    <!-- ============================================================== -->
+    <!-- TENANT: default; DSID: default; TYPE: read-write               -->
+    <!-- ============================================================== -->
+    <dataSource id="fhirDefaultDefault" jndiName="jdbc/fhir_default_default" type="javax.sql.XADataSource" statementCacheSize="200" syncQueryTimeoutWithTransactionTimeout="true" validationTimeout="30s" isolationLevel="TRANSACTION_READ_COMMITTED">
+        <jdbcDriver javax.sql.XADataSource="com.ibm.db2.jcc.DB2XADataSource" libraryRef="sharedLibDb2"/>
+        <properties.db2.jcc
+             serverName="db2"
+             portNumber="50000"
+             user="fhirserver"
+             password="change-password"
+             databaseName="FHIRDB"
+             currentSchema="FHIRDATA"
+             driverType="4"
+         />
+        <connectionManager maxPoolSize="200" minPoolSize="40"/>
+    </dataSource>
+</server>
diff --git a/fhir-server-webapp/src/main/liberty/config/configDropins/disabled/datasource-derby.xml b/fhir-server-webapp/src/main/liberty/config/configDropins/disabled/datasource-derby.xml
new file mode 100644
index 00000000000..a365dc543d0
--- /dev/null
+++ b/fhir-server-webapp/src/main/liberty/config/configDropins/disabled/datasource-derby.xml
@@ -0,0 +1,28 @@
+<server>
+    <!-- ============================================================== -->
+    <!-- TENANT: tenant1; DSID: profile; TYPE: read-write               -->
+    <!-- ============================================================== -->
+    <dataSource id="fhirTenant1Profile" jndiName="jdbc/fhir_tenant1_profile" type="javax.sql.XADataSource" statementCacheSize="200" syncQueryTimeoutWithTransactionTimeout="true" validationTimeout="30s" isolationLevel="TRANSACTION_READ_COMMITTED">
+        <jdbcDriver javax.sql.XADataSource="org.apache.derby.jdbc.EmbeddedXADataSource" libraryRef="sharedLibDerby"/>
+        <properties.derby.embedded databaseName="derby/profile"/>
+        <connectionManager maxPoolSize="50" minPoolSize="10"/>
+    </dataSource>
+
+    <!-- ============================================================== -->
+    <!-- TENANT: tenant1; DSID: reference; TYPE: read-write             -->
+    <!-- ============================================================== -->
+    <dataSource id="fhirTenant1Reference" jndiName="jdbc/fhir_tenant1_reference" type="javax.sql.XADataSource" statementCacheSize="200" syncQueryTimeoutWithTransactionTimeout="true" validationTimeout="30s" isolationLevel="TRANSACTION_READ_COMMITTED">
+        <jdbcDriver javax.sql.XADataSource="org.apache.derby.jdbc.EmbeddedXADataSource" libraryRef="sharedLibDerby"/>
+        <properties.derby.embedded databaseName="derby/reference"/>
+        <connectionManager maxPoolSize="50" minPoolSize="10"/>
+    </dataSource>
+
+    <!-- ============================================================== -->
+    <!-- TENANT: tenant1; DSID: study1; TYPE: read-write                -->
+    <!-- ============================================================== -->
+    <dataSource id="fhirTenant1Study1" jndiName="jdbc/fhir_tenant1_study1" type="javax.sql.XADataSource" statementCacheSize="200" syncQueryTimeoutWithTransactionTimeout="true" validationTimeout="30s" isolationLevel="TRANSACTION_READ_COMMITTED">
+        <jdbcDriver javax.sql.XADataSource="org.apache.derby.jdbc.EmbeddedXADataSource" libraryRef="sharedLibDerby"/>
+        <properties.derby.embedded databaseName="derby/study1"/>
+        <connectionManager maxPoolSize="50" minPoolSize="10"/>
+    </dataSource>
+</server>
diff --git a/fhir-server-webapp/src/main/liberty/config/configDropins/disabled/datasource-postgresql.xml b/fhir-server-webapp/src/main/liberty/config/configDropins/disabled/datasource-postgresql.xml
new file mode 100644
index 00000000000..55e4e0c1aed
--- /dev/null
+++ b/fhir-server-webapp/src/main/liberty/config/configDropins/disabled/datasource-postgresql.xml
@@ -0,0 +1,17 @@
+<server>
+    <!-- ============================================================== -->
+    <!-- TENANT: default; DSID: default; TYPE: read-write               -->
+    <!-- ============================================================== -->
+    <dataSource id="fhirDefaultDefault" jndiName="jdbc/fhir_default_default" type="javax.sql.XADataSource" statementCacheSize="200" syncQueryTimeoutWithTransactionTimeout="true" validationTimeout="30s">
+        <jdbcDriver javax.sql.XADataSource="org.postgresql.xa.PGXADataSource" libraryRef="sharedLibPostgres"/>
+        <properties.postgresql
+             serverName="postgres_postgres_1"
+             portNumber="5432"
+             databaseName="fhirdb"
+             user="fhirserver"
+             password="change-password"
+             currentSchema="fhirdata"
+         />
+        <connectionManager maxPoolSize="200" minPoolSize="40"/>
+    </dataSource>
+</server>
diff --git a/fhir-server-webapp/src/main/liberty/config/configDropins/disabled/db2-cloud/bulkdata.xml b/fhir-server-webapp/src/main/liberty/config/configDropins/disabled/db2-cloud/bulkdata.xml
new file mode 100644
index 00000000000..501254d9612
--- /dev/null
+++ b/fhir-server-webapp/src/main/liberty/config/configDropins/disabled/db2-cloud/bulkdata.xml
@@ -0,0 +1,55 @@
+<server description="fhir-server">
+    <!-- 
+        This configDropin work with the IBM Cloud hosted Db2 and securityMechanism 15 (apiKey)
+    -->
+    <featureManager>
+        <feature>batch-1.0</feature>
+        <feature>batchManagement-1.0</feature>
+        <feature>jdbc-4.1</feature>
+        <feature>servlet-4.0</feature>
+        <feature>transportSecurity-1.0</feature>
+    </featureManager>
+
+    <authorization-roles id="com.ibm.ws.batch">
+        <security-role id="batchAdmin" name="batchAdmin">
+            <user id="batchAdminUser" name="fhiradmin"/>
+        </security-role>
+        <security-role id="batchSubmitter" name="batchSubmitter">
+            <user id="batchSubmitterUser" name="fhiruser"/>
+        </security-role>
+        <security-role id="batchMonitor" name="batchMonitor">
+            <user id="batchMonitorUser1" name="fhiradmin"/>
+            <user id="batchMonitorUser2" name="fhiruser"/>
+        </security-role>
+    </authorization-roles>
+
+    <webApplication id="fhir-bulkdata-webapp" location="fhir-bulkdata-webapp.war" name="fhir-bulkdata-webapp">
+        <classloader privateLibraryRef="configResources,fhirUserLib"/>
+        <application-bnd>
+            <security-role id="users" name="FHIRUsers">
+                <group id="bulkUsersGroup" name="FHIRUsers"/>
+            </security-role>
+        </application-bnd>
+    </webApplication>
+
+    <variable name="BATCH_DB_NAME" defaultValue="BLUDB"/>
+    <variable name="BATCH_DB_SCHEMA" defaultValue="FHIR_JBATCH"/>
+    <variable name="BATCH_DB_PORT" defaultValue="50001"/>
+
+    <dataSource id="fhirbatchDS" jndiName="jdbc/fhirbatchDB"  type="javax.sql.XADataSource" statementCacheSize="200" syncQueryTimeoutWithTransactionTimeout="true">
+        <jdbcDriver javax.sql.XADataSource="com.ibm.db2.jcc.DB2XADataSource" libraryRef="sharedLibDb2"/>
+        <properties.db2.jcc
+            apiKey="${BATCH_DB_APIKEY}"
+            serverName="${BATCH_DB_HOSTNAME}"
+            currentSchema="${BATCH_DB_SCHEMA}"
+            databaseName="${BATCH_DB_NAME}"
+            driverType="4"
+            pluginName="IBMIAMauth"
+            portNumber="${BATCH_DB_PORT}"
+            securityMechanism="15"
+            sslConnection="true" />
+    </dataSource>
+
+    <batchPersistence jobStoreRef="BatchDatabaseStore"/>
+    <databaseStore dataSourceRef="fhirbatchDS" id="BatchDatabaseStore" schema="${BATCH_DB_SCHEMA}" tablePrefix="" createTables="false"/>
+</server>
diff --git a/fhir-server-webapp/src/main/liberty/config/configDropins/disabled/db2/bulkdata.xml b/fhir-server-webapp/src/main/liberty/config/configDropins/disabled/db2/bulkdata.xml
new file mode 100644
index 00000000000..cb7ecf7bddc
--- /dev/null
+++ b/fhir-server-webapp/src/main/liberty/config/configDropins/disabled/db2/bulkdata.xml
@@ -0,0 +1,58 @@
+<server description="fhir-server">
+    <!-- 
+        This configDropin work with Db2 and user-password
+    -->
+    <featureManager>
+        <feature>batch-1.0</feature>
+        <feature>batchManagement-1.0</feature>
+        <feature>jdbc-4.1</feature>
+        <feature>servlet-4.0</feature>
+        <feature>transportSecurity-1.0</feature>
+    </featureManager>
+
+    <authorization-roles id="com.ibm.ws.batch">
+        <security-role id="batchAdmin" name="batchAdmin">
+            <user id="batchAdminUser" name="fhiradmin"/>
+        </security-role>
+        <security-role id="batchSubmitter" name="batchSubmitter">
+            <user id="batchSubmitterUser" name="fhiruser"/>
+        </security-role>
+        <security-role id="batchMonitor" name="batchMonitor">
+            <user id="batchMonitorUser1" name="fhiradmin"/>
+            <user id="batchMonitorUser2" name="fhiruser"/>
+        </security-role>
+    </authorization-roles>
+
+    <webApplication id="fhir-bulkdata-webapp" location="fhir-bulkdata-webapp.war" name="fhir-bulkdata-webapp">
+        <classloader privateLibraryRef="configResources,fhirUserLib"/>
+        <application-bnd>
+            <security-role id="users" name="FHIRUsers">
+                <group id="bulkUsersGroup" name="FHIRUsers"/>
+            </security-role>
+        </application-bnd>
+    </webApplication>
+
+    <variable name="BATCH_DB_HOSTNAME" defaultValue="localhost"/>
+    <variable name="BATCH_DB_PORT" defaultValue="50000"/>
+    <variable name="BATCH_DB_NAME" defaultValue="FHIRDB"/>
+    <variable name="BATCH_DB_SCHEMA" defaultValue="FHIR_JBATCH"/>
+    <variable name="BATCH_DB_USER" defaultValue="db2inst1"/>
+    <variable name="BATCH_DB_PASS" defaultValue=""/>
+    <variable name="BATCH_DB_SSL" defaultValue="true"/>
+
+    <dataSource id="fhirbatchDS" jndiName="jdbc/fhirbatchDB" type="javax.sql.XADataSource" statementCacheSize="200" syncQueryTimeoutWithTransactionTimeout="true">
+        <jdbcDriver javax.sql.XADataSource="com.ibm.db2.jcc.DB2XADataSource" libraryRef="sharedLibDb2"/>
+        <properties.db2.jcc
+            serverName="${BATCH_DB_HOSTNAME}"
+            currentSchema="${BATCH_DB_SCHEMA}"
+            databaseName="${BATCH_DB_NAME}"
+            driverType="4"
+            portNumber="${BATCH_DB_PORT}"
+            sslConnection="${BATCH_DB_SSL}"
+            user="${BATCH_DB_USER}"
+            password="${BATCH_DB_PASS}"/>
+    </dataSource>
+
+    <batchPersistence jobStoreRef="BatchDatabaseStore"/>
+    <databaseStore dataSourceRef="fhirbatchDS" id="BatchDatabaseStore" schema="${BATCH_DB_SCHEMA}" tablePrefix="" createTables="false"/>
+</server>
diff --git a/fhir-server-webapp/src/main/liberty/config/configDropins/disabled/jvm.options b/fhir-server-webapp/src/main/liberty/config/configDropins/disabled/jvm.options
new file mode 100644
index 00000000000..53cd8148142
--- /dev/null
+++ b/fhir-server-webapp/src/main/liberty/config/configDropins/disabled/jvm.options
@@ -0,0 +1,7 @@
+# Reduced heap size for constrained environments
+
+# Initial heap size (same as max so no reallocations will occur)
+-Xms3072M
+
+# Maximum heap size
+-Xmx3072M
\ No newline at end of file
diff --git a/fhir-server-webapp/src/main/liberty/config/configDropins/disabled/jwtRS.xml b/fhir-server-webapp/src/main/liberty/config/configDropins/disabled/jwtRS.xml
new file mode 100644
index 00000000000..ab521345842
--- /dev/null
+++ b/fhir-server-webapp/src/main/liberty/config/configDropins/disabled/jwtRS.xml
@@ -0,0 +1,31 @@
+<server description="fhir-server">
+    <featureManager>
+        <!-- mpJwt-1.1 is already enabled in the default server.xml, but it doesn't hurt to repeat it here -->
+        <feature>mpJwt-1.1</feature>
+    </featureManager>
+
+    <!-- Override the application-bnd binding of the main webapp -->
+    <webApplication contextRoot="fhir-server/api/v4" id="fhir-server-webapp" location="fhir-server.war" name="fhir-server-webapp">
+        <application-bnd id="bind">
+            <security-role id="users" name="FHIRUsers">
+                <group id="usersGroup" access-id="group:https://localhost:8443/auth/realms/test/fhirUser"/>
+            </security-role>
+        </application-bnd>
+    </webApplication>
+
+    <!-- The MP JWT configuration that injects the caller's JWT into a
+         ResourceScoped bean for inspection. -->
+    <mpJwt id="jwtConsumer"
+           jwksUri="http://keycloak:8080/auth/realms/test/protocol/openid-connect/certs"
+           issuer="https://localhost:8443/auth/realms/test"
+           audiences="http://fhir-server:9080/fhir-server/api/v4"
+           userNameAttribute="sub"
+           groupNameAttribute="group"
+           authFilterRef="filter"/>
+
+    <authFilter id="filter">
+        <requestUrl urlPattern="/fhir-server" />
+        <requestUrl matchType="notContain" urlPattern="/fhir-server/api/v4/metadata" />
+        <requestUrl matchType="notContain" urlPattern="/fhir-server/api/v4/.well-known/smart-configuration" />
+    </authFilter>
+</server>
diff --git a/fhir-server-webapp/src/main/liberty/config/configDropins/disabled/postgres/bulkdata.xml b/fhir-server-webapp/src/main/liberty/config/configDropins/disabled/postgres/bulkdata.xml
new file mode 100644
index 00000000000..60a74d2e59e
--- /dev/null
+++ b/fhir-server-webapp/src/main/liberty/config/configDropins/disabled/postgres/bulkdata.xml
@@ -0,0 +1,54 @@
+<server description="fhir-server">
+    <!-- 
+        This configDropin work with PostgreSQL and user-password
+    -->
+    <featureManager>
+        <feature>batch-1.0</feature>
+        <feature>batchManagement-1.0</feature>
+    </featureManager>
+    
+    <batchPersistence jobStoreRef="BatchDatabaseStore"/>
+    <databaseStore id="BatchDatabaseStore" dataSourceRef="fhirbatchDS" schema="FHIR_JBATCH" tablePrefix="" createTables="false"/>
+
+    <authorization-roles id="com.ibm.ws.batch">
+        <security-role id="batchAdmin" name="batchAdmin">
+            <user id="batchAdminUser" name="fhiradmin"/>
+        </security-role>
+        <security-role id="batchSubmitter" name="batchSubmitter">
+            <user id="batchSubmitterUser" name="fhiruser"/>
+        </security-role>
+        <security-role id="batchMonitor" name="batchMonitor">
+            <user id="batchMonitorUser1" name="fhiradmin"/>
+            <user id="batchMonitorUser2" name="fhiruser"/>
+        </security-role>
+    </authorization-roles>
+
+    <webApplication id="fhir-bulkdata-webapp" location="fhir-bulkdata-webapp.war" name="fhir-bulkdata-webapp">
+        <classloader privateLibraryRef="configResources,fhirUserLib"/>
+        <application-bnd>
+            <security-role id="users" name="FHIRUsers">
+                <group id="bulkUsersGroup" name="FHIRUsers"/>
+            </security-role>
+        </application-bnd>
+    </webApplication>
+
+    <variable name="BATCH_DB_NAME" defaultValue="FHIRDB"/>
+    <variable name="BATCH_DB_SCHEMA" defaultValue="FHIR_JBATCH"/>
+    <variable name="BATCH_DB_PORT" defaultValue="5432"/>
+    <variable name="BATCH_DB_USER" defaultValue="fhirserver"/>
+    <variable name="BATCH_DB_PASS" defaultValue=""/>
+    <variable name="BATCH_DB_SSL" defaultValue="true"/>
+    <variable name="BATCH_DB_SSL_CERT_PATH" defaultValue=""/>
+
+    <dataSource id="fhirbatchDS" jndiName="jdbc/fhirbatchDB" type="javax.sql.XADataSource" statementCacheSize="200" syncQueryTimeoutWithTransactionTimeout="true">
+        <jdbcDriver javax.sql.XADataSource="org.postgresql.xa.PGXADataSource" libraryRef="sharedLibPostgres"/>
+        <properties.postgresql
+            databaseName="${BATCH_DB_NAME}"
+            portNumber="${BATCH_DB_PORT}"
+            serverName="${BATCH_DB_HOSTNAME}"
+            user="${BATCH_DB_USER}"
+            password="${BATCH_DB_PASS}" 
+            ssl="${BATCH_DB_SSL}"
+            sslCert="${BATCH_DB_SSL_CERT_PATH}"/>
+    </dataSource>
+</server>
diff --git a/fhir-server-webapp/src/main/liberty/config/configDropins/overrides/.empty b/fhir-server-webapp/src/main/liberty/config/configDropins/overrides/.empty
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/fhir-server-webapp/src/main/liberty/config/resources/security/fhirKeyStore.p12 b/fhir-server-webapp/src/main/liberty/config/resources/security/fhirKeyStore.p12
new file mode 100644
index 00000000000..718148f9444
Binary files /dev/null and b/fhir-server-webapp/src/main/liberty/config/resources/security/fhirKeyStore.p12 differ
diff --git a/fhir-server-webapp/src/main/liberty/config/resources/security/fhirTrustStore.p12 b/fhir-server-webapp/src/main/liberty/config/resources/security/fhirTrustStore.p12
new file mode 100644
index 00000000000..5413314c6f3
Binary files /dev/null and b/fhir-server-webapp/src/main/liberty/config/resources/security/fhirTrustStore.p12 differ
diff --git a/fhir-server-webapp/src/main/liberty/config/resources/security/kafka.client.keystore.p12 b/fhir-server-webapp/src/main/liberty/config/resources/security/kafka.client.keystore.p12
new file mode 100644
index 00000000000..799fb7f82f3
Binary files /dev/null and b/fhir-server-webapp/src/main/liberty/config/resources/security/kafka.client.keystore.p12 differ
diff --git a/fhir-server-webapp/src/main/liberty/config/resources/security/kafka.client.truststore.p12 b/fhir-server-webapp/src/main/liberty/config/resources/security/kafka.client.truststore.p12
new file mode 100644
index 00000000000..a680e8e1b2d
Binary files /dev/null and b/fhir-server-webapp/src/main/liberty/config/resources/security/kafka.client.truststore.p12 differ
diff --git a/fhir-server-webapp/src/main/liberty/config/server.env b/fhir-server-webapp/src/main/liberty/config/server.env
new file mode 100644
index 00000000000..ee2c923f826
--- /dev/null
+++ b/fhir-server-webapp/src/main/liberty/config/server.env
@@ -0,0 +1 @@
+TZ=UTC
\ No newline at end of file
diff --git a/fhir-server-webapp/src/main/liberty/config/server.xml b/fhir-server-webapp/src/main/liberty/config/server.xml
new file mode 100644
index 00000000000..d2bc1701ba5
--- /dev/null
+++ b/fhir-server-webapp/src/main/liberty/config/server.xml
@@ -0,0 +1,119 @@
+<server description="fhir-server">
+
+    <!-- Enable features -->
+    <featureManager>
+        <feature>transportSecurity-1.0</feature>
+        <feature>appSecurity-2.0</feature>
+        <feature>jaxrs-2.1</feature>
+        <feature>servlet-4.0</feature>
+        <feature>jsonp-1.1</feature>
+        <!-- the db2 jcc driver for 11.5.0.0 doesn't fully implement jdbc-4.2 -->
+        <feature>jdbc-4.1</feature>
+        <feature>websocket-1.1</feature>
+        <feature>localConnector-1.0</feature>
+        <!-- mpJwt-1.2 isn't used by default,
+             but we include it here to avoid NoClassDefFound in our classes that *can* use it -->
+        <feature>mpJwt-1.2</feature>
+    </featureManager>
+
+    <!-- Disable welcome page so that internal server info won't be revealed in responses
+         to requests with an invalid context root.
+    -->
+    <httpDispatcher enableWelcomePage="false"/>
+    <!-- Disable X-Powered-By header to avoid leaking information and
+         override the default error pages to avoid showing stack traces
+         for nonsensical queries like requests for a JSP page that doesn't exist.
+    -->
+    <webContainer disableXPoweredBy="true"
+        displayTextWhenNoErrorPageDefined="Unexpected request/response. Please check the URL and try again."
+        deferServletLoad="false"/>
+
+    <!-- IBM FHIR Server's keystore and truststore configuration -->
+    <ssl id="defaultSSLConfig" keyStoreRef="defaultKeyStore" trustStoreRef="defaultTrustStore" clientAuthenticationSupported="true" sslProtocol="TLSv1.2"/>
+    <keyStore id="defaultKeyStore" location="${server.config.dir}/resources/security/fhirKeyStore.p12" password="change-password"/>
+    <keyStore id="defaultTrustStore" location="${server.config.dir}/resources/security/fhirTrustStore.p12" password="change-password"/>
+
+    <!-- This entry defines the ports that the server will listen on.
+        By default, the httpPort is disabled (set to "-1").
+        Modify the port #'s as needed to satisfy your config requirements.
+        Note: on Linux, the server must be running with root priviledges in order to
+        listen on ports <= 1024.
+     -->
+    <httpEndpoint id="defaultHttpEndpoint" host="*" httpPort="9080" httpsPort="9443" onError="FAIL"/>
+
+    <!--
+        The trace specification can be set via the TRACE_SPEC environment variable (or by overriding it below).
+        
+        Example trace specifications: 
+        <logging traceSpecification="*=info:com.ibm.fhir.*=finer" traceFormat="BASIC"/>
+        <logging traceSpecification="*=info:com.ibm.fhir.persistence.jdbc.dao.impl.*=fine" traceFormat="BASIC"/>
+        <logging traceSpecification="${TRACE_SPEC}" traceFileName="${TRACE_FILE}" traceFormat="${TRACE_FORMAT}" consoleLogLevel="${WLP_LOGGING_CONSOLE_LOGLEVEL}"/>
+        
+        To send the trace messages to standard out, set TRACE_FILE to "stdout".
+    -->
+    <variable name="TRACE_SPEC" defaultValue="*=info"/>
+    <variable name="TRACE_FILE" defaultValue="trace.log"/>
+    <variable name="TRACE_FORMAT" defaultValue="BASIC"/>
+    <variable name="WLP_LOGGING_CONSOLE_LOGLEVEL" defaultValue="INFO"/>
+    <logging traceSpecification="${TRACE_SPEC}" traceFileName="${TRACE_FILE}" traceFormat="${TRACE_FORMAT}" consoleLogLevel="${WLP_LOGGING_CONSOLE_LOGLEVEL}"/>
+
+    <!-- Automatically expand WAR files and EAR files -->
+    <applicationManager autoExpand="true"/>
+
+    <applicationMonitor updateTrigger="mbean"/>
+
+    <!-- This is the main IBM FHIR Server REST API war -->
+    <webApplication id="fhir-server-webapp" contextRoot="fhir-server/api/v4" location="fhir-server.war" name="fhir-server-webapp">
+        <classloader privateLibraryRef="fhirUserLib"/>
+        <!-- Include id attributes to make it easier to override this via dropinConfig -->
+        <application-bnd id="bind">
+            <security-role id="users" name="FHIRUsers">
+                <group id="usersGroup" name="FHIRUsers"/>
+            </security-role>
+        </application-bnd>
+    </webApplication>
+
+    <!--
+        This sharedlib can contain user-contributed jars that are intended to augment
+        the IBM FHIR Server installation (persistence interceptors, persistence layer impl's,
+        custom operation impl's, etc.)
+     -->
+    <library id="fhirUserLib">
+        <fileset dir="${server.config.dir}/userlib" includes="*.jar"/>
+    </library>
+
+    <!-- Shared library definitions for the supported database types -->
+    <library id="sharedLibDb2">
+        <fileset dir="${shared.resource.dir}/lib/db2" includes="*.jar"/>
+    </library>
+    <library id="sharedLibDerby">
+        <fileset dir="${shared.resource.dir}/lib/derby" includes="*.jar"/>
+    </library>
+    <library id="sharedLibPostgres">
+        <fileset dir="${shared.resource.dir}/lib/postgresql" includes="*.jar"/>
+    </library>
+
+    <webAppSecurity allowFailOverToBasicAuth="true" singleSignonEnabled="false"/>
+    
+    <cors domain="/"
+        allowedOrigins="*"
+        allowedMethods="GET, DELETE, POST, PUT, HEAD"
+        allowedHeaders="*"
+        maxAge="3600" />
+
+    <!-- Variables for the users so they can be overriden by environment variables -->
+    <variable name="FHIR_USER_PASSWORD" defaultValue="change-password"/>
+    <variable name="FHIR_ADMIN_PASSWORD" defaultValue="change-password"/>
+
+    <!-- Define a basic user registry with a few users. -->
+    <basicRegistry id="basic" realm="BasicRealm">
+        <user name="fhiruser" password="${FHIR_USER_PASSWORD}"/>
+        <user name="fhiradmin" password="${FHIR_ADMIN_PASSWORD}"/>
+        <group name="FHIRUsers">
+            <member name="fhiruser"/>
+        </group>
+        <group name="clientAdministrator">
+            <member name="fhiruser"/>
+        </group>
+    </basicRegistry>
+</server>