config.yaml

# API server listen address
# Defauls to: ":8080" which will listen on all avalable interfaces.
# Overwrite with environment variable: DEPLOYMENTS_LISTEN

listen: :8080

# HTTP Server middleware environment
# Available values:
#   dev - development environment
#   prod - production environment
# Defaults to: prod
# Overwrite with environment variable: DEPLOYMENTS_MIDDLEWARE

# middleware: dev

# HTTPS configuration
# To enable listening using HTTPS protocol please uncomment and configure following section.
# All fields in https section are required if any set.
# Defaults to: unset
# Overwrite with environment variables:
# - DEPLOYMENTS_HTTPS_CERTIFICATE
# - DEPLOYMENTS_HTTPS_KEY

# https:
#     certificate: /path/to/certificate
#     key: /path/to/private_key

# Mongodb connection string
# Defaults to: "mongodb://mongo-deployments:27017"
# Overwrite with environment variable: DEPLOYMENTS_MONGO_URL

mongo-url: "mongodb://mongo-deployments:27017"

# Enable SSL for mongo connections
# Defaults to: false
# Overwrite with environment variable: DEPLOYMENTS_MONGO_SSL

# mongo_ssl: false

# SkipVerify controls whether a mongo client verifies the
# server's certificate chain and host name.
# If InsecureSkipVerify is true, accepts any certificate
# presented by the server and any host name in that certificate.
# Defaults to: false
# Overwrite with environment variable: DEPLOYMENTS_MONGO_SSL_SKIPVERIFY

# mongo_ssl_skipverify: false

# Mongodb username
# Overwrites username set in connection string.
# Defaults to: none
# Overwrite with environment variable: DEPLOYMENTS_MONGO_USERNAME

# mongo_username: user

# Mongodb password
# Overwrites password set in connection string.
# Defaults to: none
# Overwrite with environment variable: DEPLOYMENTS_MONGO_PASSWORD

# mongo_password: secret

# Inventory service address
# Defaults to: http://mender-inventory:8080
# Env key: DEPLOYMENTS_INVENTORY_ADDR
inventory_addr: "http://mender-inventory:8080"

# Workflows service address
# Defaults to: http://mender-workflows-servers:8080
# Env key: DEPLOYMENTS_MENDER_WORKFLOWS

mender-workflows: "http://mender-workflows-server:8080"


# This is a flag that turns off the new API end-points related to releases
# Defaults to: false
# Overwrite with environment variable: DEPLOYMENTS_DISABLE_NEW_RELEASES_FEATURE

# disable_new_releases_feature: false


storage:
    # storage.default: Default storage service
    # Must be one of ["aws", "azure"]
    # Defaults to: "aws"
    # Env key: DEPLOYMENTS_STORAGE_DEFAULT
    default: "aws"

    # storage.bucket: Name of the bucket (azure: container) to store artifacts.
    #
    # Bucket should allow PUT/GET methods using CORS, example CORS conifg:
    #     <CORSConfiguration>
    #     <CORSRule>
    #         <AllowedOrigin>*</AllowedOrigin>
    #         <AllowedMethod>PUT</AllowedMethod>
    #         <AllowedMethod>GET</AllowedMethod>
    #         <MaxAgeSeconds>3000</MaxAgeSeconds>
    #         <AllowedHeader>*</AllowedHeader>
    #     </CORSRule>
    #     </CORSConfiguration>
    #
    # Defaults to: "mender-artifact-storage"
    # Overwrite with environment variable: DEPLOYMENTS_STORAGE_BUCKET
    bucket: "mender-artifact-storage"

    # storage.proxy_uri: Rewrites presigned URLs to target proxy instead of the
    # direct URL to the backend.
    # Overwrite with environment variable: DEPLOYMENTS_STORAGE_PROXY_URI
    # proxy_uri

    # storage.max_image_size: Maximum image size in bytes.
    # Defaults to: 10GiB
    # Overwrite with environment variable: DEPLOYMENTS_STORAGE_MAX_IMAGE_SIZE
    # max_image_size: 10737418240

    # storage.max_generate_data_size: Maximum data size for requests to 
    # generate artifacts.
    # Defaults to: 512MiB
    # Overwrite with environment variable: DEPLOYMENTS_STORAGE_MAX_GENERATE_DATA_SIZE
    # max_generate_data_size: 536870912

    # Download link expiry duration
    # Number of second a presigned download URL is valid
    # Defaults to: 900 (15 minutes)
    # Override with environment variable: DEPLOYMENTS_STORAGE_DOWNLOAD_EXPIRE_SECONDS
    # download_expire_seconds: 900

    # Upload link expiry duration
    # Number of second a presigned upload URL is valid
    # Defaults to: 3600 (60 minutes)
    # Override with environment variable: DEPLOYMENTS_STORAGE_UPLOAD_EXPIRE_SECONDS
    # upload_expire_seconds: 3600

    # Direct upload feature flag
    # Enables functionality to request direct upload links to the object
    # storage backend for optimizing data transfer. This feature is disabled
    # by default.
    # Overwrite with environment variable: DEPLOYMENTS_STORAGE_ENABLE_DIRECT_UPLOAD
    # enable_direct_upload: false

    # Direct upload skip verification flag
    # Turns off the verification and the download of the artifact in the direct upload
    # scenario. This feature is disabled by default.
    # Overwrite with environment variable: DEPLOYMENTS_STORAGE_DIRECT_UPLOAD_SKIP_VERIFY
    # direct_upload_skip_verify: false


# AWS configuration section
aws:

    # AWS region for minio shoud be "us-east-1"
    # Defaults to: us-east-1
    # Overwrite with environment variable: DEPLOYMENTS_AWS_REGION

    region: us-east-1

    # S3 bucket where the uploaded images will be stored and served from.
    # Bucket is required to be created before running the service.
    # Bucket should allow PUT/GET methods using CORS, example CORS conifg:
    #     <CORSConfiguration>
    #     <CORSRule>
    #         <AllowedOrigin>*</AllowedOrigin>
    #         <AllowedMethod>PUT</AllowedMethod>
    #         <AllowedMethod>GET</AllowedMethod>
    #         <MaxAgeSeconds>3000</MaxAgeSeconds>
    #         <AllowedHeader>*</AllowedHeader>
    #     </CORSRule>
    #     </CORSConfiguration>
    # Defaults to: "mender-artifact-storage"
    # Overwrite with environment variable: DEPLOYMENTS_AWS_BUCKET
    # DEPRECATED: (alias for storage.bucket)
    # bucket: mender-artifact-storage

    # Force S3 URI style to path
    #
    # AWS S3 supports two diffrent URI styles:
    # - virtual-hosted (https://bucket-name.s3.Region.amazonaws.com/key)
    # - path-style (https://s3.Region.amazonaws.com/bucket-name/key)
    #
    # Buckets created after September 30, 2020, will support only virtual
    # hosted-style requests. Path-style requests will continue to be supported
    # for buckets created on or before this date.
    #
    # For more information, see Amazon S3 Path Deprecation Plan:
    # https://aws.amazon.com/blogs/aws/amazon-s3-path-deprecation-plan-the-rest-of-the-story/
    #
    # When minio (or alternative S3 implementations) is in use, path
    # style URI are used.
    #
    # Defaults to: true (path-style), set false to enable virtual-hosted style
    # Overwrite with environment variable: DEPLOYMENTS_AWS_FORCE_PATH_STYLE

    # force_path_style: true

    # Use S3 Transfer Acceleration
    # Enable the S3 Transfer Acceleration for the operations that support it.
    # Defaults to: false
    # Overwrite with environment variable: DEPLOYMENTS_AWS_USE_ACCELERATE
    #
    # use_accelerate: false

    # Unsigned Headers excluded from AWS Signature v4 if present.
    # Defaults to "Accept-Encoding" to remain compatible with GCS.
    # Also accepts space separated list of header keys.
    # Overwrite with environment variable: DEPLOYMENTS_AWS_UNSIGNED_HEADERS
    #
    # unsigned_headers: ["Accept-Encoding"]

    # S3 URI (for mender-deployment)
    # Defaults to: none (s3.amazonaws.com)
    # Overwrite with environment variable: DEPLOYMENTS_AWS_URI

    # uri: example.com

    # S3 EXTERNAL URI (for devices)
    # Defaults to: none (S3 URI)
    # Overwrite with environment variable: DEPLOYMENTS_AWS_EXTERNAL_URI

    # uri: external.example.com

    # Maximum image size
    # Defaults to: 10GB
    # Overwrite with environment variable: DEPLOYMENTS_AWS_MAX_IMAGE_SIZE
    # DEPRECATED: alias for storage.max_image_size

    # max_image_size: 10737418240

    # Download link expiry duration
    # Number of second a presigned download URL is valid
    # Defaults to: 900 (15 minutes)
    # Override with environment variable: DEPLOYMENTS_AWS_DOWNLOAD_EXPIRE_SECONDS
    # DEPRECATED: alias for storage.download_expire_seconds
    # download_expire_seconds: 900

    # Download link expiry duration
    # Number of second a presigned upload URL is valid
    # Defaults to: 3600 (60 minutes)
    # Override with environment variable: DEPLOYMENTS_AWS_UPLOAD_EXPIRE_SECONDS
    # DEPRECATED: alias for storage.upload_expire_seconds
    # upload_expire_seconds: 3600

    # AWS credentials can be provided with described below methods (checked in sequence):
    #
    # Environment variables:
    # AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY.
    # If you're working with temporary security credentials,
    # you can also keep the session token in AWS_SESSION_TOKEN.
    #
    # If you're testing with a fake s3 environment, you can specify the uri endpoint with: DEPLOYMENTS_AWS_URI
    #
    # Credentials File:
    # Instead of keeping credentials in environment variables,
    # you can put credentials into a single file that's located in: ~/.aws/credentials
    # An important point is that the default location for the credentials file is a user directory.
    #
    # The format for the credentials is the same for all the SDKs and the AWS CLI:
    #
    #     [default]
    #     aws_access_key_id = ACCESS_KEY
    #     aws_secret_access_key = SECRET_KEY
    #     aws_session_token = TOKEN
    #
    # The aws_session_token value is needed only if you're including temporary security credentials in the file.
    #
    # Alternatively they can be provided directly using "auth" section.
    #
    # Token is optional, it is needed if working with temporaty credentials.
    #
    # In case when none of the credential retrieving methods are set, service will default to retrieving authentication
    # credentials locally from AWS IAM which is prefered method then running the service in EC2
    #
    # Overwrite with environment variables:
    # - DEPLOYMENTS_AWS_AUTH_KEY
    # - DEPLOYMENTS_AWS_AUTH_SECRET
    # - DEPLOYMENTS_AWS_AUTH_TOKEN

    # auth:
    #     key: ACCESS_KEY
    #     secret: SECRET_KEY
    #     token: TOKEN

azure:

  # auth sets the client authentication for the Azure Blob Storage API.
  # Either a connection_string or a shared_key can be specified, the former take
  # presedence if both are specified. The credentials MUST be a shared access key
  # to the storage account.
  # auth:

    # connection_string configures the shared access key to the storage account
    # using the connection string format.
    # NOTE: If set, the shared_key configuration will have no effect.
    # Environment variable: DEPLOYMENTS_AZURE_AUTH_CONNECTION_STRING
    #
    # connection_string: "DefaultEndpointsProtocol=https;AccountName=myStorageAccount;AccountKey=base64encodedsecret=;EndpointSuffix=core.windows.net"

    # shared_key sets the authentication credentials as separate parameters
    # allowing to fully customize the storage account URL.
    # shared_key:

      # account_name is the name of the storage account that will be used for
      # storing artifacts.
      # Environment variable: DEPLOYMENTS_AZURE_AUTH_SHARED_KEY_ACCOUNT_NAME
      #
      # account_name: "myStorageAccount"

      # account_key sets the base64-encoded key for authenticating with Azure
      # Blob Storage API.
      # Environment variable: DEPLOYMENTS_AZURE_AUTH_SHARED_KEY_ACCOUNT_KEY
      #
      # account_key: "base64encodedsecret="

      # uri optionally sets the service URI for the storage account. defaults to
      # 'https://<account_name>.core.windows.net' if left unspecified.
      # Environment variable: DEPLOYMENTS_AZURE_AUTH_SHARED_KEY_URI
      #
      # uri: "https://myStorageAccount.not.windows.net"


presign:
  # Presign algorithm
  # Signature algorithm used for generating URL signature for signed URLs.
  # Currently only HMAC256 is supported and this configuration is ignored.
  # enum: ["HMAC256"]
  # Defaults to: HMAC256
  # Override with environment variable: DEPLOYMENTS_PRESIGN_ALGORITHM
  algorithm: "HMAC256"

  # Presign secret
  # The secret used for signing URLs. For HMAC256 the value must be a valid
  # base64 encoded secret, for public key signatures it must be a path to a
  # private key. (Public key signatures are not yet supported).
  # Defaults to: "" (randomly geneated string of bytes)
  # Override with environment variable: DEPLOYMENTS_PRESIGN_SECRET
  secret: ""

  # Link expiry duration
  # Number of second a presigned URL is valid
  # Defaults to: 900 (15 minutes)
  # Override with environment variable: DEPLOYMENTS_PRESIGN_EXPIRE_SECONDS
  expire_seconds: 900

  # URL format [url_scheme]://[(X-Forwarded-Host|url_hostname)[<path(generated)>]

  # Presign hostname
  # This is the hostname (to the gateway proxy) used for generating
  # signed download URLs. If left empty, the service will attempt to use
  # X-Forwarded-Host forwarded by the proxy.
  # Defaults to: "" (use X-Forwarded-Host)
  # Overwrite with environment variable: DEPLOYMENTS_PRESIGN_URL_HOSTNAME
  url_hostname: ""
  # Presign URL scheme
  # This value is used as the url scheme for generating signed URLs.
  # Defaults to: https
  # Overwrite with environment variable: DEPLOYMENTS_PRESIGN_URL_SCHEME
  url_scheme: "https"

# mender-reporting addr
# Defaults to: "" (disabled by default; searches go to inventory)
# Overwrite with environment variable: DEPLOYMENTS_REPORTING_ADDR

#reporting_addr: "http://mender-reporting:8080"