@harperfast/harper 5.0.4 → 5.0.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/config-app.schema.json +77 -0
- package/config-root.schema.json +643 -0
- package/dist/security/keys.js +1 -1
- package/package.json +13 -10
- package/schema.graphql +245 -0
- package/security/keys.js +1 -1
- package/studio/web/assets/{index-CjeZNBFc.js → index-D07pIqJt.js} +2 -2
- package/studio/web/assets/{index-CjeZNBFc.js.map → index-D07pIqJt.js.map} +1 -1
- package/studio/web/index.html +1 -1
|
@@ -0,0 +1,643 @@
|
|
|
1
|
+
{
|
|
2
|
+
"$schema": "https://json-schema.org/draft-06/schema",
|
|
3
|
+
"$id": "https://harper.fast/schema/config-root.schema.json",
|
|
4
|
+
"title": "HarperDB Root Configuration",
|
|
5
|
+
"description": "JSON Schema for harperdb-config.yaml as documented in docs.html. This focuses on the primary, documented configuration sections and keys. Unknown properties are allowed for forward compatibility.",
|
|
6
|
+
"type": "object",
|
|
7
|
+
"properties": {
|
|
8
|
+
"rootPath": {
|
|
9
|
+
"type": "string",
|
|
10
|
+
"description": "Root folder where Harper persists data, config, logs, and components. Default: user's home directory"
|
|
11
|
+
},
|
|
12
|
+
"componentsRoot": {
|
|
13
|
+
"type": "string",
|
|
14
|
+
"description": "Path to the folder containing local component files. Default: <ROOTPATH>/components"
|
|
15
|
+
},
|
|
16
|
+
"http": {
|
|
17
|
+
"type": "object",
|
|
18
|
+
"description": "HTTP server configuration for the main component server.",
|
|
19
|
+
"additionalProperties": true,
|
|
20
|
+
"properties": {
|
|
21
|
+
"sessionAffinity": {
|
|
22
|
+
"description": "Route multiple requests from the same client to the same thread. Use 'ip' or a header name.",
|
|
23
|
+
"type": ["string", "null"]
|
|
24
|
+
},
|
|
25
|
+
"compressionThreshold": {
|
|
26
|
+
"type": "integer",
|
|
27
|
+
"minimum": 0,
|
|
28
|
+
"description": "Responses larger than this threshold (bytes) will be compressed for clients that accept compression. Default: 1200"
|
|
29
|
+
},
|
|
30
|
+
"cors": { "type": "boolean", "description": "Enable Cross Origin Resource Sharing. Default: true" },
|
|
31
|
+
"corsAccessList": {
|
|
32
|
+
"type": ["array", "null"],
|
|
33
|
+
"description": "List of allowed origins for CORS.",
|
|
34
|
+
"items": { "type": "string" }
|
|
35
|
+
},
|
|
36
|
+
"corsAccessControlAllowHeaders": {
|
|
37
|
+
"type": "string",
|
|
38
|
+
"description": "Comma-separated list of header keys for Access-Control-Allow-Headers on OPTIONS requests. Default: 'Accept, Content-Type, Authorization'"
|
|
39
|
+
},
|
|
40
|
+
"headersTimeout": {
|
|
41
|
+
"type": "integer",
|
|
42
|
+
"description": "Milliseconds to wait for complete HTTP headers. Default: 60000"
|
|
43
|
+
},
|
|
44
|
+
"maxHeaderSize": {
|
|
45
|
+
"type": "integer",
|
|
46
|
+
"description": "Maximum allowed size of HTTP headers in bytes. Default: 16394"
|
|
47
|
+
},
|
|
48
|
+
"requestQueueLimit": {
|
|
49
|
+
"type": "integer",
|
|
50
|
+
"description": "Max estimated request queue time (ms) before rejecting with 503. Default: 20000"
|
|
51
|
+
},
|
|
52
|
+
"keepAliveTimeout": { "type": "integer", "description": "Keep-alive inactivity timeout in ms. Default: 30000" },
|
|
53
|
+
"port": { "type": "integer", "description": "HTTP port. Default: 9926" },
|
|
54
|
+
"securePort": { "type": ["integer", "null"], "description": "HTTPS port. Requires valid certificate + key." },
|
|
55
|
+
"http2": { "type": "boolean", "description": "Enable HTTP/2. Default: false" },
|
|
56
|
+
"timeout": { "type": "integer", "description": "Request timeout (ms). Default: 120000" },
|
|
57
|
+
"mtls": {
|
|
58
|
+
"description": "Enable and configure mTLS authentication for HTTP.",
|
|
59
|
+
"oneOf": [
|
|
60
|
+
{ "type": "boolean" },
|
|
61
|
+
{
|
|
62
|
+
"type": "object",
|
|
63
|
+
"additionalProperties": false,
|
|
64
|
+
"properties": {
|
|
65
|
+
"user": {
|
|
66
|
+
"type": ["string", "null"],
|
|
67
|
+
"description": "Authenticate all authorized mTLS connections as this user. Default: common name from certificate or null to not auto-auth."
|
|
68
|
+
},
|
|
69
|
+
"required": {
|
|
70
|
+
"type": "boolean",
|
|
71
|
+
"description": "Require client certificates for all HTTP connections. Default: false"
|
|
72
|
+
},
|
|
73
|
+
"certificateVerification": {
|
|
74
|
+
"description": "Enable certificate revocation checking (CRL/OCSP).",
|
|
75
|
+
"oneOf": [
|
|
76
|
+
{ "type": "boolean" },
|
|
77
|
+
{
|
|
78
|
+
"type": "object",
|
|
79
|
+
"additionalProperties": false,
|
|
80
|
+
"properties": {
|
|
81
|
+
"failureMode": {
|
|
82
|
+
"type": "string",
|
|
83
|
+
"enum": ["fail-open", "fail-closed"],
|
|
84
|
+
"description": "Global behavior when verification fails. Default: 'fail-closed'"
|
|
85
|
+
},
|
|
86
|
+
"crl": {
|
|
87
|
+
"type": "object",
|
|
88
|
+
"additionalProperties": false,
|
|
89
|
+
"properties": {
|
|
90
|
+
"enabled": { "type": "boolean", "description": "Enable CRL checking. Default: true" },
|
|
91
|
+
"timeout": {
|
|
92
|
+
"type": "number",
|
|
93
|
+
"description": "Max ms to wait for CRL download. Default: 10000"
|
|
94
|
+
},
|
|
95
|
+
"cacheTtl": { "type": "number", "description": "CRL cache TTL (ms). Default: 86400000" },
|
|
96
|
+
"gracePeriod": {
|
|
97
|
+
"type": "number",
|
|
98
|
+
"description": "Grace period after CRL nextUpdate (ms). Default: 86400000"
|
|
99
|
+
},
|
|
100
|
+
"failureMode": {
|
|
101
|
+
"type": "string",
|
|
102
|
+
"enum": ["fail-open", "fail-closed"],
|
|
103
|
+
"description": "CRL-specific failure mode. Default: 'fail-closed'"
|
|
104
|
+
}
|
|
105
|
+
}
|
|
106
|
+
},
|
|
107
|
+
"ocsp": {
|
|
108
|
+
"type": "object",
|
|
109
|
+
"additionalProperties": false,
|
|
110
|
+
"properties": {
|
|
111
|
+
"enabled": { "type": "boolean", "description": "Enable OCSP checking. Default: true" },
|
|
112
|
+
"timeout": {
|
|
113
|
+
"type": "number",
|
|
114
|
+
"description": "Max ms to wait for OCSP response. Default: 5000"
|
|
115
|
+
},
|
|
116
|
+
"cacheTtl": {
|
|
117
|
+
"type": "number",
|
|
118
|
+
"description": "Cache TTL for successful OCSP (ms). Default: 3600000"
|
|
119
|
+
},
|
|
120
|
+
"errorCacheTtl": {
|
|
121
|
+
"type": "number",
|
|
122
|
+
"description": "Cache TTL for OCSP errors (ms). Default: 300000"
|
|
123
|
+
},
|
|
124
|
+
"failureMode": {
|
|
125
|
+
"type": "string",
|
|
126
|
+
"enum": ["fail-open", "fail-closed"],
|
|
127
|
+
"description": "OCSP-specific failure mode. Default: 'fail-closed'"
|
|
128
|
+
}
|
|
129
|
+
}
|
|
130
|
+
}
|
|
131
|
+
}
|
|
132
|
+
}
|
|
133
|
+
]
|
|
134
|
+
}
|
|
135
|
+
}
|
|
136
|
+
}
|
|
137
|
+
]
|
|
138
|
+
},
|
|
139
|
+
"logging": {
|
|
140
|
+
"allOf": [{ "$ref": "#/definitions/loggerConfig" }],
|
|
141
|
+
"properties": {
|
|
142
|
+
"timing": { "type": "boolean", "description": "Log timing information for HTTP requests." },
|
|
143
|
+
"headers": { "type": "boolean", "description": "Log HTTP headers (verbose)." },
|
|
144
|
+
"id": { "type": "boolean", "description": "Assign/log unique id per request." }
|
|
145
|
+
}
|
|
146
|
+
}
|
|
147
|
+
}
|
|
148
|
+
},
|
|
149
|
+
|
|
150
|
+
"threads": {
|
|
151
|
+
"type": "object",
|
|
152
|
+
"description": "Harper worker thread configuration.",
|
|
153
|
+
"additionalProperties": true,
|
|
154
|
+
"properties": {
|
|
155
|
+
"count": { "type": "number", "description": "Number of worker threads. Default: logical CPU count minus one" },
|
|
156
|
+
"debug": {
|
|
157
|
+
"oneOf": [
|
|
158
|
+
{ "type": "boolean" },
|
|
159
|
+
{
|
|
160
|
+
"type": "object",
|
|
161
|
+
"additionalProperties": false,
|
|
162
|
+
"properties": {
|
|
163
|
+
"port": { "type": "integer", "description": "Port for debugging the main thread (default 9229)" },
|
|
164
|
+
"startingPort": {
|
|
165
|
+
"type": "integer",
|
|
166
|
+
"description": "Starting port to assign unique debugging ports per thread"
|
|
167
|
+
},
|
|
168
|
+
"host": { "type": "string", "description": "Debug host interface (default 127.0.0.1)" },
|
|
169
|
+
"waitForDebugger": { "type": "boolean", "description": "Wait for debugger before starting" }
|
|
170
|
+
}
|
|
171
|
+
}
|
|
172
|
+
]
|
|
173
|
+
},
|
|
174
|
+
"maxHeapMemory": { "type": "number", "description": "Heap memory limit per thread (MB)." },
|
|
175
|
+
"heapSnapshotNearLimit": { "type": "boolean", "description": "Take a heap snapshot when near the heap limit." }
|
|
176
|
+
}
|
|
177
|
+
},
|
|
178
|
+
|
|
179
|
+
"replication": {
|
|
180
|
+
"type": "object",
|
|
181
|
+
"description": "Harper replication configuration for clustering and data replication.",
|
|
182
|
+
"additionalProperties": true,
|
|
183
|
+
"properties": {
|
|
184
|
+
"hostname": { "type": "string", "description": "Hostname of this Harper instance." },
|
|
185
|
+
"url": { "type": "string", "description": "URL of this Harper instance." },
|
|
186
|
+
"databases": {
|
|
187
|
+
"description": "Databases to replicate. '*' for all, array of names, or array with objects to mark sharded databases.",
|
|
188
|
+
"oneOf": [
|
|
189
|
+
{ "type": "string" },
|
|
190
|
+
{
|
|
191
|
+
"type": "array",
|
|
192
|
+
"items": {
|
|
193
|
+
"oneOf": [
|
|
194
|
+
{ "type": "string" },
|
|
195
|
+
{
|
|
196
|
+
"type": "object",
|
|
197
|
+
"additionalProperties": false,
|
|
198
|
+
"properties": {
|
|
199
|
+
"name": { "type": "string" },
|
|
200
|
+
"sharded": { "type": "boolean" }
|
|
201
|
+
},
|
|
202
|
+
"required": ["name"]
|
|
203
|
+
}
|
|
204
|
+
]
|
|
205
|
+
}
|
|
206
|
+
}
|
|
207
|
+
]
|
|
208
|
+
},
|
|
209
|
+
"routes": {
|
|
210
|
+
"type": "array",
|
|
211
|
+
"description": "Routes to connect to other nodes. Each route can be a string or an object with hostname, port, and optional startTime.",
|
|
212
|
+
"items": {
|
|
213
|
+
"oneOf": [
|
|
214
|
+
{ "type": "string" },
|
|
215
|
+
{
|
|
216
|
+
"type": "object",
|
|
217
|
+
"additionalProperties": false,
|
|
218
|
+
"properties": {
|
|
219
|
+
"hostname": { "type": "string" },
|
|
220
|
+
"port": { "type": "integer" },
|
|
221
|
+
"startTime": {
|
|
222
|
+
"type": "string",
|
|
223
|
+
"format": "date-time",
|
|
224
|
+
"description": "ISO 8601 UTC start time to begin replication."
|
|
225
|
+
}
|
|
226
|
+
},
|
|
227
|
+
"required": ["hostname", "port"]
|
|
228
|
+
}
|
|
229
|
+
]
|
|
230
|
+
}
|
|
231
|
+
},
|
|
232
|
+
"startTime": { "type": "string", "format": "date-time", "description": "Start replication from this time." },
|
|
233
|
+
"revokedCertificates": {
|
|
234
|
+
"type": "array",
|
|
235
|
+
"items": { "type": "string" },
|
|
236
|
+
"description": "Array of revoked certificate serial numbers."
|
|
237
|
+
},
|
|
238
|
+
"port": { "type": "integer", "description": "Replication insecure port." },
|
|
239
|
+
"securePort": { "type": "integer", "description": "Replication secure port. Default: 9933" },
|
|
240
|
+
"enableRootCAs": {
|
|
241
|
+
"type": "boolean",
|
|
242
|
+
"description": "Verify certificates against Node.js bundled CA store. Default: true"
|
|
243
|
+
},
|
|
244
|
+
"mtls": {
|
|
245
|
+
"type": "object",
|
|
246
|
+
"description": "mTLS settings for replication connections (always required).",
|
|
247
|
+
"additionalProperties": true,
|
|
248
|
+
"properties": {
|
|
249
|
+
"certificateVerification": {
|
|
250
|
+
"description": "Enable certificate revocation checking (CRL/OCSP) for peer certificates.",
|
|
251
|
+
"oneOf": [
|
|
252
|
+
{ "type": "boolean" },
|
|
253
|
+
{
|
|
254
|
+
"type": "object",
|
|
255
|
+
"additionalProperties": false,
|
|
256
|
+
"properties": {
|
|
257
|
+
"failureMode": { "type": "string", "enum": ["fail-open", "fail-closed"] },
|
|
258
|
+
"crl": {
|
|
259
|
+
"type": "object",
|
|
260
|
+
"additionalProperties": false,
|
|
261
|
+
"properties": {
|
|
262
|
+
"enabled": { "type": "boolean" },
|
|
263
|
+
"timeout": { "type": "number" },
|
|
264
|
+
"cacheTtl": { "type": "number" },
|
|
265
|
+
"gracePeriod": { "type": "number" },
|
|
266
|
+
"failureMode": { "type": "string", "enum": ["fail-open", "fail-closed"] }
|
|
267
|
+
}
|
|
268
|
+
},
|
|
269
|
+
"ocsp": {
|
|
270
|
+
"type": "object",
|
|
271
|
+
"additionalProperties": false,
|
|
272
|
+
"properties": {
|
|
273
|
+
"enabled": { "type": "boolean" },
|
|
274
|
+
"timeout": { "type": "number" },
|
|
275
|
+
"cacheTtl": { "type": "number" },
|
|
276
|
+
"errorCacheTtl": { "type": "number" },
|
|
277
|
+
"failureMode": { "type": "string", "enum": ["fail-open", "fail-closed"] }
|
|
278
|
+
}
|
|
279
|
+
}
|
|
280
|
+
}
|
|
281
|
+
}
|
|
282
|
+
]
|
|
283
|
+
}
|
|
284
|
+
}
|
|
285
|
+
},
|
|
286
|
+
"blobTimeout": { "type": "number", "description": "Max time (ms) to wait for blob transfer. Default: 120000" },
|
|
287
|
+
"failOver": {
|
|
288
|
+
"type": "boolean",
|
|
289
|
+
"description": "Attempt fail-over to different node when unreachable. Default: true"
|
|
290
|
+
},
|
|
291
|
+
"shard": { "type": "integer", "description": "Shard id for this instance." },
|
|
292
|
+
"logging": { "$ref": "#/definitions/loggerConfig" }
|
|
293
|
+
}
|
|
294
|
+
},
|
|
295
|
+
|
|
296
|
+
"localStudio": {
|
|
297
|
+
"type": "object",
|
|
298
|
+
"additionalProperties": false,
|
|
299
|
+
"properties": {
|
|
300
|
+
"enabled": { "type": "boolean", "description": "Enable local Harper Studio GUI. Default: false" }
|
|
301
|
+
}
|
|
302
|
+
},
|
|
303
|
+
|
|
304
|
+
"logging": {
|
|
305
|
+
"type": "object",
|
|
306
|
+
"description": "Logging configuration for Harper.",
|
|
307
|
+
"additionalProperties": true,
|
|
308
|
+
"properties": {
|
|
309
|
+
"auditLog": { "type": "boolean", "description": "Enable structured table transaction logging. Default: false" },
|
|
310
|
+
"file": { "type": "boolean", "description": "Log to file. Default: true" },
|
|
311
|
+
"auditRetention": {
|
|
312
|
+
"type": ["string", "number"],
|
|
313
|
+
"description": "Retention of audit logs (e.g. '3d'). Default: 3d"
|
|
314
|
+
},
|
|
315
|
+
"level": {
|
|
316
|
+
"type": "string",
|
|
317
|
+
"enum": ["trace", "debug", "info", "warn", "error", "fatal", "notify"],
|
|
318
|
+
"description": "Verbosity of text event logs. Default: warn"
|
|
319
|
+
},
|
|
320
|
+
"console": { "type": "boolean", "description": "Log console.* output to log file. Default: true" },
|
|
321
|
+
"root": { "type": "string", "description": "Directory where log files are written. Default: <ROOTPATH>/log" },
|
|
322
|
+
"path": { "type": "string", "description": "Log file path. Default: <ROOTPATH>/log/hdb.log" },
|
|
323
|
+
"rotation": {
|
|
324
|
+
"type": "object",
|
|
325
|
+
"additionalProperties": false,
|
|
326
|
+
"properties": {
|
|
327
|
+
"enabled": { "type": "boolean", "description": "Enable log rotation. Default: true" },
|
|
328
|
+
"compress": { "type": "boolean", "description": "Compress rotated logs with gzip. Default: false" },
|
|
329
|
+
"interval": { "type": ["string", "null"], "description": "Time between rotations (e.g. '1D','6H','30M')." },
|
|
330
|
+
"maxSize": { "type": ["string", "null"], "description": "Max size before rotation (e.g. '100M', '1G')." },
|
|
331
|
+
"path": { "type": "string", "description": "Directory to store rotated logs. Default: <ROOTPATH>/log" }
|
|
332
|
+
}
|
|
333
|
+
},
|
|
334
|
+
"stdStreams": { "type": "boolean", "description": "Log to stdout/stderr. Default: false" },
|
|
335
|
+
"auditAuthEvents": {
|
|
336
|
+
"type": "object",
|
|
337
|
+
"additionalProperties": false,
|
|
338
|
+
"properties": {
|
|
339
|
+
"logFailed": { "type": "boolean", "description": "Log failed authentication events. Default: false" },
|
|
340
|
+
"logSuccessful": {
|
|
341
|
+
"type": "boolean",
|
|
342
|
+
"description": "Log successful authentication events. Default: false"
|
|
343
|
+
}
|
|
344
|
+
}
|
|
345
|
+
},
|
|
346
|
+
"external": {
|
|
347
|
+
"$ref": "#/definitions/loggerConfig",
|
|
348
|
+
"description": "Logging configuration for external components that use the logger API."
|
|
349
|
+
}
|
|
350
|
+
}
|
|
351
|
+
},
|
|
352
|
+
|
|
353
|
+
"authentication": {
|
|
354
|
+
"type": "object",
|
|
355
|
+
"description": "Default authentication settings.",
|
|
356
|
+
"additionalProperties": true,
|
|
357
|
+
"properties": {
|
|
358
|
+
"authorizeLocal": {
|
|
359
|
+
"type": "boolean",
|
|
360
|
+
"description": "Automatically authorize requests from loopback IP as superuser. Default: true"
|
|
361
|
+
},
|
|
362
|
+
"cacheTTL": { "type": "number", "description": "Milliseconds an authentication can be cached. Default: 30000" },
|
|
363
|
+
"enableSessions": { "type": "boolean", "description": "Enable cookie-based sessions. Default: true" },
|
|
364
|
+
"operationTokenTimeout": {
|
|
365
|
+
"type": "string",
|
|
366
|
+
"description": "Operation token expiry duration (e.g. '1d'). Default: 1d"
|
|
367
|
+
},
|
|
368
|
+
"refreshTokenTimeout": {
|
|
369
|
+
"type": "string",
|
|
370
|
+
"description": "Refresh token expiry duration (e.g. '1d'). Default: 1d"
|
|
371
|
+
},
|
|
372
|
+
"logging": { "$ref": "#/definitions/loggerConfig" }
|
|
373
|
+
}
|
|
374
|
+
},
|
|
375
|
+
|
|
376
|
+
"operationsApi": {
|
|
377
|
+
"type": "object",
|
|
378
|
+
"description": "Operations API configuration. Values default to http configuration when not provided.",
|
|
379
|
+
"additionalProperties": true,
|
|
380
|
+
"properties": {
|
|
381
|
+
"network": {
|
|
382
|
+
"type": "object",
|
|
383
|
+
"additionalProperties": true,
|
|
384
|
+
"properties": {
|
|
385
|
+
"cors": { "type": "boolean" },
|
|
386
|
+
"corsAccessList": { "type": ["array", "null"], "items": { "type": "string" } },
|
|
387
|
+
"domainSocket": {
|
|
388
|
+
"type": "string",
|
|
389
|
+
"description": "Unix domain socket path for CLI access. Default: <ROOTPATH>/hdb/operations-server"
|
|
390
|
+
},
|
|
391
|
+
"headersTimeout": { "type": "integer" },
|
|
392
|
+
"keepAliveTimeout": { "type": "integer" },
|
|
393
|
+
"port": { "type": "integer", "description": "Operations API HTTP port. Default: 9925" },
|
|
394
|
+
"securePort": { "type": ["integer", "null"] },
|
|
395
|
+
"timeout": { "type": "integer" }
|
|
396
|
+
}
|
|
397
|
+
},
|
|
398
|
+
"tls": {
|
|
399
|
+
"$ref": "#/definitions/tlsConfig",
|
|
400
|
+
"description": "TLS configuration overriding root TLS for Operations API"
|
|
401
|
+
}
|
|
402
|
+
}
|
|
403
|
+
},
|
|
404
|
+
|
|
405
|
+
"storage": {
|
|
406
|
+
"type": "object",
|
|
407
|
+
"description": "Storage engine configuration.",
|
|
408
|
+
"additionalProperties": true,
|
|
409
|
+
"properties": {
|
|
410
|
+
"writeAsync": {
|
|
411
|
+
"type": "boolean",
|
|
412
|
+
"description": "Disable fsync for faster writes (risk of data loss on crash). Default: false"
|
|
413
|
+
},
|
|
414
|
+
"caching": { "type": "boolean", "description": "Enable in-memory caching of records. Default: true" },
|
|
415
|
+
"compression": {
|
|
416
|
+
"oneOf": [
|
|
417
|
+
{ "type": "boolean" },
|
|
418
|
+
{
|
|
419
|
+
"type": "object",
|
|
420
|
+
"additionalProperties": false,
|
|
421
|
+
"properties": {
|
|
422
|
+
"dictionary": { "type": ["string", "null"], "description": "Path to compression dictionary file." },
|
|
423
|
+
"threshold": {
|
|
424
|
+
"type": "number",
|
|
425
|
+
"description": "Only entries larger than this many bytes will be compressed."
|
|
426
|
+
}
|
|
427
|
+
}
|
|
428
|
+
}
|
|
429
|
+
],
|
|
430
|
+
"description": "Enable/Configure compression (LZ4). Default: true"
|
|
431
|
+
},
|
|
432
|
+
"compactOnStart": { "type": "boolean", "description": "Compact non-system databases on start. Default: false" },
|
|
433
|
+
"compactOnStartKeepBackup": {
|
|
434
|
+
"type": "boolean",
|
|
435
|
+
"description": "Keep backups created by compactOnStart. Default: false"
|
|
436
|
+
},
|
|
437
|
+
"maxTransactionQueueTime": {
|
|
438
|
+
"type": "string",
|
|
439
|
+
"description": "Max write queue time before rejecting (e.g. '45s')."
|
|
440
|
+
},
|
|
441
|
+
"noReadAhead": { "type": "boolean", "description": "Advise OS to not read ahead. Default: false" },
|
|
442
|
+
"prefetchWrites": { "type": "boolean", "description": "Load data prior to write transactions. Default: true" },
|
|
443
|
+
"path": { "type": "string", "description": "Directory for all database files. Default: <rootPath>/database" },
|
|
444
|
+
"blobPaths": {
|
|
445
|
+
"oneOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }],
|
|
446
|
+
"description": "Path or array of paths for blob storage. Default: <rootPath>/blobs"
|
|
447
|
+
},
|
|
448
|
+
"pageSize": { "type": "number", "description": "Database page size (bytes). Default: OS default" },
|
|
449
|
+
"reclamation": {
|
|
450
|
+
"type": "object",
|
|
451
|
+
"description": "Reclamation process configuration.",
|
|
452
|
+
"additionalProperties": true
|
|
453
|
+
},
|
|
454
|
+
"logging": { "$ref": "#/definitions/loggerConfig" }
|
|
455
|
+
}
|
|
456
|
+
},
|
|
457
|
+
|
|
458
|
+
"tls": {
|
|
459
|
+
"description": "TLS certificates/keys/settings for HTTPS and MQTT. Can be a single object or an array (SNI).",
|
|
460
|
+
"oneOf": [
|
|
461
|
+
{ "$ref": "#/definitions/tlsConfig" },
|
|
462
|
+
{ "type": "array", "items": { "$ref": "#/definitions/tlsConfig" } }
|
|
463
|
+
]
|
|
464
|
+
},
|
|
465
|
+
|
|
466
|
+
"mqtt": {
|
|
467
|
+
"type": "object",
|
|
468
|
+
"description": "MQTT server configuration.",
|
|
469
|
+
"additionalProperties": true,
|
|
470
|
+
"properties": {
|
|
471
|
+
"port": { "type": "number", "description": "Insecure MQTT port. Default: 1883" },
|
|
472
|
+
"securePort": { "type": "number", "description": "Secure MQTT port. Default: 8883" },
|
|
473
|
+
"webSocket": { "type": "boolean", "description": "Enable MQTT over WebSockets (on http port). Default: true" },
|
|
474
|
+
"requireAuthentication": {
|
|
475
|
+
"type": "boolean",
|
|
476
|
+
"description": "Require authentication for MQTT connections. Default: true"
|
|
477
|
+
},
|
|
478
|
+
"mtls": {
|
|
479
|
+
"oneOf": [
|
|
480
|
+
{ "type": "boolean" },
|
|
481
|
+
{
|
|
482
|
+
"type": "object",
|
|
483
|
+
"additionalProperties": false,
|
|
484
|
+
"properties": {
|
|
485
|
+
"user": {
|
|
486
|
+
"type": ["string", "null"],
|
|
487
|
+
"description": "Authenticate all authorized mTLS connections as this user (or null for none). Default: Common Name"
|
|
488
|
+
},
|
|
489
|
+
"required": {
|
|
490
|
+
"type": "boolean",
|
|
491
|
+
"description": "Require client certificates for all MQTT connections. Default: false"
|
|
492
|
+
},
|
|
493
|
+
"certificateAuthority": {
|
|
494
|
+
"type": "string",
|
|
495
|
+
"description": "Override CA path for MQTT. Default: tls.certificateAuthority"
|
|
496
|
+
},
|
|
497
|
+
"certificateVerification": {
|
|
498
|
+
"oneOf": [
|
|
499
|
+
{ "type": "boolean" },
|
|
500
|
+
{
|
|
501
|
+
"type": "object",
|
|
502
|
+
"additionalProperties": false,
|
|
503
|
+
"properties": {
|
|
504
|
+
"timeout": {
|
|
505
|
+
"type": "number",
|
|
506
|
+
"description": "Max ms to wait for OCSP response. Default: 5000"
|
|
507
|
+
},
|
|
508
|
+
"cacheTtl": {
|
|
509
|
+
"type": "number",
|
|
510
|
+
"description": "Cache TTL (ms) for verification results. Default: 3600000"
|
|
511
|
+
},
|
|
512
|
+
"failureMode": {
|
|
513
|
+
"type": "string",
|
|
514
|
+
"enum": ["fail-open", "fail-closed"],
|
|
515
|
+
"description": "Behavior on verification failure. Default: 'fail-open'"
|
|
516
|
+
}
|
|
517
|
+
}
|
|
518
|
+
}
|
|
519
|
+
]
|
|
520
|
+
}
|
|
521
|
+
}
|
|
522
|
+
}
|
|
523
|
+
]
|
|
524
|
+
},
|
|
525
|
+
"logging": { "$ref": "#/definitions/loggerConfig" }
|
|
526
|
+
}
|
|
527
|
+
},
|
|
528
|
+
|
|
529
|
+
"databases": {
|
|
530
|
+
"type": "object",
|
|
531
|
+
"description": "Optional mapping of databases and tables to file system paths.",
|
|
532
|
+
"additionalProperties": {
|
|
533
|
+
"type": "object",
|
|
534
|
+
"additionalProperties": false,
|
|
535
|
+
"properties": {
|
|
536
|
+
"path": { "type": "string", "description": "Path for all files of this database." },
|
|
537
|
+
"auditPath": { "type": "string", "description": "Path for audit log database files for this database." },
|
|
538
|
+
"tables": {
|
|
539
|
+
"type": "object",
|
|
540
|
+
"additionalProperties": {
|
|
541
|
+
"type": "object",
|
|
542
|
+
"additionalProperties": false,
|
|
543
|
+
"properties": {
|
|
544
|
+
"path": { "type": "string", "description": "Path for this table's files." }
|
|
545
|
+
},
|
|
546
|
+
"required": ["path"]
|
|
547
|
+
}
|
|
548
|
+
}
|
|
549
|
+
}
|
|
550
|
+
}
|
|
551
|
+
},
|
|
552
|
+
|
|
553
|
+
"analytics": {
|
|
554
|
+
"type": "object",
|
|
555
|
+
"additionalProperties": false,
|
|
556
|
+
"properties": {
|
|
557
|
+
"aggregatePeriod": {
|
|
558
|
+
"type": "number",
|
|
559
|
+
"description": "Seconds between aggregation of raw analytics. Default: 60"
|
|
560
|
+
},
|
|
561
|
+
"replicate": {
|
|
562
|
+
"type": "boolean",
|
|
563
|
+
"description": "Replicate aggregated analytics across cluster. Default: false"
|
|
564
|
+
},
|
|
565
|
+
"storageInterval": {
|
|
566
|
+
"type": "number",
|
|
567
|
+
"description": "Number of aggregation cycles between node storage measurements. 0 to disable. Default: 10"
|
|
568
|
+
},
|
|
569
|
+
"logging": { "$ref": "#/definitions/loggerConfig" }
|
|
570
|
+
}
|
|
571
|
+
}
|
|
572
|
+
},
|
|
573
|
+
|
|
574
|
+
"additionalProperties": true,
|
|
575
|
+
|
|
576
|
+
"definitions": {
|
|
577
|
+
"loggerConfig": {
|
|
578
|
+
"type": "object",
|
|
579
|
+
"additionalProperties": true,
|
|
580
|
+
"properties": {
|
|
581
|
+
"path": { "type": "string" },
|
|
582
|
+
"root": { "type": "string" },
|
|
583
|
+
"level": { "type": "string", "enum": ["trace", "debug", "info", "warn", "error", "fatal", "notify"] },
|
|
584
|
+
"tag": { "type": "string" },
|
|
585
|
+
"stdStreams": { "type": "boolean" }
|
|
586
|
+
}
|
|
587
|
+
},
|
|
588
|
+
"tlsConfig": {
|
|
589
|
+
"type": "object",
|
|
590
|
+
"additionalProperties": false,
|
|
591
|
+
"properties": {
|
|
592
|
+
"certificate": {
|
|
593
|
+
"type": "string",
|
|
594
|
+
"description": "Path to certificate file. Default: <ROOTPATH>/keys/certificate.pem"
|
|
595
|
+
},
|
|
596
|
+
"certificateAuthority": { "type": "string", "description": "Path to CA file. Default: <ROOTPATH>/keys/ca.pem" },
|
|
597
|
+
"privateKey": {
|
|
598
|
+
"type": "string",
|
|
599
|
+
"description": "Path to private key file. Default: <ROOTPATH>/keys/privateKey.pem"
|
|
600
|
+
},
|
|
601
|
+
"ciphers": { "type": "string", "description": "Optional explicit cipher list." },
|
|
602
|
+
"host": { "type": "string", "description": "Optional SNI host this certificate applies to." }
|
|
603
|
+
}
|
|
604
|
+
}
|
|
605
|
+
},
|
|
606
|
+
|
|
607
|
+
"examples": [
|
|
608
|
+
{
|
|
609
|
+
"rootPath": "~/hdb",
|
|
610
|
+
"componentsRoot": "~/hdb/components",
|
|
611
|
+
"http": {
|
|
612
|
+
"port": 9926,
|
|
613
|
+
"cors": true,
|
|
614
|
+
"compressionThreshold": 1200,
|
|
615
|
+
"mtls": {
|
|
616
|
+
"required": false,
|
|
617
|
+
"certificateVerification": {
|
|
618
|
+
"failureMode": "fail-closed",
|
|
619
|
+
"crl": { "enabled": true, "timeout": 10000, "cacheTtl": 86400000, "gracePeriod": 86400000 },
|
|
620
|
+
"ocsp": { "enabled": true, "timeout": 5000, "cacheTtl": 3600000, "errorCacheTtl": 300000 }
|
|
621
|
+
}
|
|
622
|
+
}
|
|
623
|
+
},
|
|
624
|
+
"threads": { "count": 8, "maxHeapMemory": 300 },
|
|
625
|
+
"authentication": { "authorizeLocal": true, "enableSessions": true },
|
|
626
|
+
"operationsApi": { "network": { "port": 9925 } },
|
|
627
|
+
"logging": {
|
|
628
|
+
"level": "warn",
|
|
629
|
+
"file": true,
|
|
630
|
+
"rotation": { "enabled": true, "interval": "1D", "maxSize": "100M" }
|
|
631
|
+
},
|
|
632
|
+
"storage": { "path": "~/hdb/database", "blobPaths": ["~/hdb/blobs"] },
|
|
633
|
+
"tls": {
|
|
634
|
+
"certificate": "~/hdb/keys/certificate.pem",
|
|
635
|
+
"privateKey": "~/hdb/keys/privateKey.pem",
|
|
636
|
+
"certificateAuthority": "~/hdb/keys/ca.pem"
|
|
637
|
+
},
|
|
638
|
+
"mqtt": { "port": 1883, "securePort": 8883, "webSocket": true },
|
|
639
|
+
"analytics": { "aggregatePeriod": 60, "replicate": false },
|
|
640
|
+
"my-app": { "package": "git+https://github.com/example/my-app.git", "port": 4000 }
|
|
641
|
+
}
|
|
642
|
+
]
|
|
643
|
+
}
|
package/dist/security/keys.js
CHANGED
|
@@ -211,7 +211,7 @@ function loadCertificates() {
|
|
|
211
211
|
}
|
|
212
212
|
promise = certificateTable.put({
|
|
213
213
|
name: certCn,
|
|
214
|
-
uses: config.uses ??
|
|
214
|
+
uses: config.uses ?? (configKey.includes('operations') ? ['operations-api'] : []),
|
|
215
215
|
ciphers: config.ciphers,
|
|
216
216
|
certificate: certificatePem,
|
|
217
217
|
private_key_name,
|