snapshot of https://github.com/cortezaproject/corteza.git (2024.9.x, 2026-09-18; blobs > 131072B omitted)

server/app/options/RBAC.cue

@@ -0,0 +1,43 @@
+package options
+
+import (
+	"github.com/cortezaproject/corteza/server/codegen/schema"
+)
+
+RBAC: schema.#optionsGroup & {
+	handle: "rbac"
+	title:  "RBAC options"
+
+	options: {
+		log: {
+			type:        "bool"
+			description: "Log RBAC related events and actions"
+		}
+		service_user: {}
+		bypass_roles: {
+			defaultValue: "super-admin"
+			description: """
+				Space delimited list of role handles.
+				These roles causes short-circuiting access control check and allowing all operations.
+				System will refuse to start if check-bypassing roles are also listed as authenticated or anonymous auto-assigned roles.
+				"""
+		}
+		authenticated_roles: {
+			defaultValue: "authenticated"
+			description: """
+				Space delimited list of role handles.
+				These roles are automatically assigned to authenticated user.
+				Memberships can not be managed for these roles.
+				System will refuse to start if roles listed here are also listed under anonymous roles
+				"""
+		}
+		anonymous_roles: {
+			defaultValue: "anonymous"
+			description: """
+				Space delimited list of role handles.
+				These roles are automatically assigned to anonymous user.
+				Memberships can not be managed for these roles.
+				"""
+		}
+	}
+}

server/app/options/SCIM.cue

@@ -0,0 +1,35 @@
+package options
+
+import (
+	"github.com/cortezaproject/corteza/server/codegen/schema"
+)
+
+SCIM: schema.#optionsGroup & {
+	handle: "scim"
+	title:  "SCIM Server"
+
+	// @todo remove explicitly defined expIdent and adjust the code
+	expIdent: "SCIM"
+
+	options: {
+		enabled: {
+			type:        "bool"
+			description: "Enable SCIM subsystem"
+		}
+		base_URL: {
+			defaultValue: "/scim"
+			description:  "Prefix for SCIM API endpoints"
+		}
+		secret: {
+			description: "Secret to use to validate requests on SCIM API endpoints"
+		}
+		external_id_as_primary: {
+			type:        "bool"
+			description: "Use external IDs in SCIM API endpoints"
+		}
+		external_id_validation: {
+			defaultValue: "^[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}$"
+			description:  "Validates format of external IDs. Defaults to UUID"
+		}
+	}
+}

server/app/options/SMTP.cue

@@ -0,0 +1,45 @@
+package options
+
+import (
+	"github.com/cortezaproject/corteza/server/codegen/schema"
+)
+
+SMTP: schema.#optionsGroup & {
+	handle: "smtp"
+	title:  "Email sending"
+
+	// @todo remove explicitly defined expIdent and adjust the code
+	expIdent: "SMTP"
+
+	intro: """
+		Configure your local SMTP server or use one of the available providers.
+
+		These values are copied to settings when the server starts and can be managed from the administration console.
+		We recommend you remove these values after they are copied to settings.
+		If server detects difference between these options and settings, it shows a warning in the log on server start.
+		"""
+
+	options: {
+		host: {
+			description:  "The SMTP server hostname."
+		}
+		port: {
+			type:          "int"
+			description:   "The SMTP post."
+		}
+		user: {
+			description: "The SMTP username."
+		}
+		pass: {
+			description: "The SMTP password."
+		}
+		from: {
+			description: "The SMTP `from` email parameter"
+		}
+		tls_insecure: {
+			type:        "bool"
+			description: "Allow insecure (invalid, expired TLS certificates) connections."
+		}
+		tls_server_name: {}
+	}
+}

server/app/options/action_log.cue

@@ -0,0 +1,23 @@
+package options
+
+import (
+	"github.com/cortezaproject/corteza/server/codegen/schema"
+)
+
+actionLog: schema.#optionsGroup & {
+	handle: "action-log"
+	env: "ACTIONLOG"
+	options: {
+		enabled: {
+			type:          "bool"
+			defaultGoExpr: "true"
+		}
+		debug: {
+			type: "bool"
+		}
+		workflow_functions_enabled: {
+			type: "bool"
+		}
+	}
+	title: "Actionlog"
+}

server/app/options/api_gateway.cue

@@ -0,0 +1,59 @@
+package options
+
+import (
+	"github.com/cortezaproject/corteza/server/codegen/schema"
+)
+
+apigw: schema.#optionsGroup & {
+	handle: "apigw"
+
+	imports: [
+		"\"time\"",
+	]
+
+	options: {
+		enabled: {
+			type:          "bool"
+			defaultGoExpr: "true"
+			description:   "Enable API Gateway"
+		}
+		debug: {
+			type:        "bool"
+			description: "Enable API Gateway debugging info"
+		}
+		log_enabled: {
+			type:        "bool"
+			description: "Enable extra logging"
+		}
+		profiler_enabled: {
+			type:          "bool"
+			defaultGoExpr: "true"
+			description:   "Enable profiler"
+		}
+		profiler_global: {
+			type:          "bool"
+			defaultGoExpr: "false"
+			description:   "Profiler enabled for all routes"
+		}
+		log_request_body: {
+			type:        "bool"
+			description: "Enable incoming request body output in logs"
+		}
+		proxy_enable_debug_log: {
+			type:        "bool"
+			description: "Enable full debug log on requests / responses - warning, includes sensitive data"
+		}
+		proxy_follow_redirects: {
+			type:          "bool"
+			defaultGoExpr: "true"
+			description:   "Follow redirects on proxy requests"
+		}
+		proxy_outbound_timeout: {
+			type:          "time.Duration"
+			description:   "Outbound request timeout"
+			defaultGoExpr: "time.Second * 30"
+			defaultValue:  "30s"
+		}
+	}
+	title: "API Gateway"
+}

server/app/options/attachment.cue

@@ -0,0 +1,32 @@
+package options
+
+import (
+	"github.com/cortezaproject/corteza/server/codegen/schema"
+)
+
+attachment: schema.#optionsGroup & {
+	handle: "attachment"
+
+	options: {
+		avatar_max_file_size: {
+			type: "int64"
+			defaultGoExpr: "1000000"
+			description:  "Avatar image maximum upload size, default value is 1MB"
+		}
+		avatar_initials_font_path: {
+			defaultValue: "fonts/Poppins-Regular.ttf"
+			description:  "Avatar initials font file path"
+			env:          "AVATAR_INITIALS_FONT_PATH"
+		}
+		avatar_initials_background_color: {
+			defaultValue: "#F3F3F3"
+			description:  "Avatar initials background color"
+			env:          "AVATAR_INITIALS_BACKGROUND_COLOR"
+		}
+		avatar_initials_color: {
+			defaultValue: "#0B344E"
+			description:  "Avatar initials text color"
+			env:          "AVATAR_INITIALS_COLOR"
+		}
+	}
+}

server/app/options/auth.cue

@@ -0,0 +1,262 @@
+package options
+
+import (
+	"github.com/cortezaproject/corteza/server/codegen/schema"
+)
+
+auth: schema.#optionsGroup & {
+	handle: "auth"
+
+	imports: [
+		"\"time\"",
+	]
+
+	options: {
+		log_enabled: {
+			type:        "bool"
+			description: "Enable extra logging for authentication flows"
+		}
+		password_security: {
+			type:          "bool"
+			defaultGoExpr: "true"
+			description: """
+				Password security allows you to disable constraints to which passwords must conform to.
+
+				[CAUTION]
+				====
+				Disabling password security can be useful for development environments as it removes the need for complex passwords.
+				Password security *should be enabled* on production environments to avoid security incidents
+				====
+				"""
+		}
+		jwt_algorithm: {
+			defaultGoExpr: "\"HS512\""
+			defaultValue:  "HS512"
+			description: """
+				Algorithm to be use for JWT signature.
+
+				Supported values:
+				 - HS256, HS384, HS512
+				 - PS256, PS384, PS512,
+				 - RS256, RS384, RS512
+
+				Provide shared secret string for HS256, HS384, HS512 and full private key or path to the file PS* and RS* algorithms.
+				"""
+		}
+		secret: {
+			defaultGoExpr: "getSecretFromEnv(\"jwt secret\")"
+			description: """
+				Secret used for signing JWT tokens.
+				Value is used only when HS256, HS384 or HS512 algorithm is used.
+
+				[IMPORTANT]
+				====
+				If secret is not set, system auto-generates one from DB_DSN and HOSTNAME environment variables.
+				Generated secret will change if you change any of these variables.
+				====
+				"""
+			env: "AUTH_JWT_SECRET"
+		}
+		jwt_key: {
+			description: """
+				Raw private key or absolute or relative path to the file containing one.
+				"""
+		}
+		access_token_lifetime: {
+			type: "time.Duration"
+			description: """
+				Lifetime of the access token. Should be shorter than lifetime of the refresh token.
+				"""
+			env: "AUTH_OAUTH2_ACCESS_TOKEN_LIFETIME"
+
+			defaultGoExpr: "time.Hour * 2"
+			defaultValue:  "2h"
+		}
+		refresh_token_lifetime: {
+			type: "time.Duration"
+			description: """
+				Lifetime of the refresh token. Should be much longer than lifetime of the access token.
+
+				Refresh tokens are used to exchange expired access tokens with new ones.
+				"""
+			env: "AUTH_OAUTH2_REFRESH_TOKEN_LIFETIME"
+
+			defaultGoExpr: "time.Hour * 24 * 3"
+			defaultValue:  "72h"
+		}
+		external_redirect_URL: {
+			description: """
+				Redirect URL to be sent with OAuth2 authentication request to provider
+
+				`provider` placeholder is replaced with the actual value when used.
+				"""
+			defaultGoExpr: "FullURL(\"/auth/external/{provider}/callback\")"
+		}
+		external_cookie_secret: {
+			description: """
+				Secret used for securing cookies
+
+				[IMPORTANT]
+				====
+				If secret is not set, system auto-generates one from DB_DSN and HOSTNAME environment variables.
+				Generated secret will change if you change any of these variables.
+				====
+				"""
+
+			defaultGoExpr: "getSecretFromEnv(\"external cookie secret\")"
+		}
+		base_URL: {
+			description: """
+				Frontend base URL. Must be an absolute URL, with the domain.
+				This is used for some redirects and links in auth emails.
+				"""
+
+			defaultGoExpr: "FullURL(\"/auth\")"
+		}
+		session_cookie_name: {
+			description:  "Session cookie name"
+			defaultValue: "session"
+		}
+		session_cookie_path: {
+			description:   "Session cookie path"
+			defaultGoExpr: "pathPrefix(\"/auth\")"
+		}
+		session_cookie_domain: {
+			defaultGoExpr: "GuessApiHostname()"
+			description:   "Session cookie domain"
+		}
+		session_cookie_secure: {
+			type:          "bool"
+			defaultGoExpr: "isSecure()"
+			description:   "Defaults to true when HTTPS is used. Corteza will try to guess the this setting by"
+		}
+		session_lifetime: {
+			type: "time.Duration"
+			description: """
+				Maximum time user is allowed to stay idle when logged in without \"remember-me\" option and before session is expired.
+
+				Recommended value is between an hour and a day.
+
+				[IMPORTANT]
+				====
+				This affects only profile (/auth) pages. Using applications (admin, compose, ...) does not prolong the session.
+				====
+
+				"""
+			defaultGoExpr: "24 * time.Hour"
+			defaultValue:  "24h"
+		}
+		session_perm_lifetime: {
+			type: "time.Duration"
+			description: """
+				Duration of the session in /auth lasts when user logs-in with \"remember-me\" option.
+
+				If set to 0, \"remember-me\" option is removed.
+				"""
+
+			defaultGoExpr: "360 * 24 * time.Hour"
+			defaultValue:  "8640h"
+		}
+		garbage_collector_interval: {
+			type:          "time.Duration"
+			description:   "How often are expired sessions and tokens purged from the database"
+			defaultGoExpr: "15 * time.Minute"
+			defaultValue:  "15min"
+		}
+		request_rate_limit: {
+			type: "int"
+			description: """
+				How many requests from a certain IP address are allowed in a time window.
+				Set to zero to disable
+				"""
+			defaultGoExpr: "60"
+			defaultValue:  "60"
+		}
+		request_rate_window_length: {
+			type:          "time.Duration"
+			defaultGoExpr: "time.Minute"
+			defaultValue:  "1m"
+			description:   "How many requests from a certain IP address are allowed in a time window"
+		}
+		csrf_secret: {
+			defaultGoExpr: "getSecretFromEnv(\"csrf secret\")"
+			description: """
+				Secret used for securing CSRF protection
+
+				[IMPORTANT]
+				====
+				If secret is not set, system auto-generates one from DB_DSN and HOSTNAME environment variables.
+				Generated secret will change if you change any of these variables.
+				====
+				"""
+		}
+		csrf_enabled: {
+			type:          "bool"
+			defaultGoExpr: "true"
+			description:   "Enable CSRF protection"
+		}
+		csrf_field_name: {
+			defaultValue: "same-site-authenticity-token"
+			description:  "Form field name used for CSRF protection"
+		}
+		csrf_cookie_name: {
+			defaultValue: "same-site-authenticity-token"
+			description:  "Cookie name used for CSRF protection"
+		}
+		default_client: {
+			defaultValue: "corteza-webapp"
+			description: """
+				Handle for OAuth2 client used for automatic redirect from /auth/oauth2/go endpoint.
+
+				This simplifies configuration for OAuth2 flow for Corteza Web applications as it removes
+				the need to supply redirection URL and client ID (oauth2/go endpoint does that internally)
+
+				"""
+		}
+		default_user_group: {
+			defaultValue: "default-root"
+			description: """
+				Default user group.
+				If default sub user group is not set, all users are assigned here.
+
+				Each user must belong to a user group if it wishes to use the system.
+				"""
+		}
+		default_sub_user_group: {
+			defaultValue: "default-sub-root"
+			description: """
+				Default sub-user group.
+				If default sub-user group is set, all users are assigned here.
+
+				Each user must belong to a user group if it wishes to use the system.
+				"""
+		}
+		assets_path: {
+			description: """
+				Path to js, css, images and template source files
+
+				When corteza starts, if path exists it tries to load template files from it.
+
+				When empty path is set (default value), embedded files are used.
+				"""
+		}
+		development_mode: {
+			type: "bool"
+			description: """
+				When enabled, corteza reloads template before every execution.
+				Enable this for debugging or when developing auth templates.
+
+				Should be disabled in production where templates do not change between server restarts.
+				"""
+		}
+		provision_super_user: {
+			description: """
+				When set, Corteza creates one or more users with the configured values using provided email as a password.
+				It skips existing (email, handle). All new users are assigned to all bypass roles.
+
+				When set in production, Corteza stops and reports an error
+				"""
+		}
+	}
+	title: "Authentication"
+}

server/app/options/corredor.cue

@@ -0,0 +1,76 @@
+package options
+
+import (
+	"github.com/cortezaproject/corteza/server/codegen/schema"
+)
+
+corredor: schema.#optionsGroup & {
+	handle: "corredor"
+
+	imports: [
+		"\"time\"",
+	]
+
+	options: {
+		enabled: {
+			type:        "bool"
+			description: "Enable/disable Corredor integration"
+		}
+		addr: {
+			defaultValue: "localhost:50051"
+			description:  "Hostname and port of the Corredor gRPC server."
+		}
+		max_backoff_delay: {
+			type:          "time.Duration"
+			description:   "Max delay for backoff on connection."
+			defaultGoExpr: "time.Minute"
+			defaultValue:  "1m"
+		}
+		max_receive_message_size: {
+			type:          "int"
+			defaultGoExpr: "2 << 23"
+			description:   "Max message size that can be received."
+		}
+		default_exec_timeout: {
+			type:          "time.Duration"
+			defaultGoExpr: "time.Minute"
+		}
+		list_timeout: {
+			type:          "time.Duration"
+			defaultGoExpr: "time.Second * 2"
+			defaultValue:  "2s"
+		}
+		list_refresh: {
+			type:          "time.Duration"
+			defaultGoExpr: "time.Second * 5"
+		}
+		run_as_enabled: {
+			type:          "bool"
+			defaultGoExpr: "true"
+		}
+		tls_cert_enabled: {
+			type: "bool"
+			env:  "CORREDOR_CLIENT_CERTIFICATES_ENABLED"
+		}
+		tls_cert_path: {
+			defaultValue: "/certs/corredor/client"
+			env:          "CORREDOR_CLIENT_CERTIFICATES_PATH"
+		}
+		tls_cert_cA: {
+			defaultValue: "ca.crt"
+			env:          "CORREDOR_CLIENT_CERTIFICATES_CA"
+		}
+		tls_cert_private: {
+			defaultValue: "private.key"
+			env:          "CORREDOR_CLIENT_CERTIFICATES_PRIVATE"
+		}
+		tls_cert_public: {
+			defaultValue: "public.crt"
+			env:          "CORREDOR_CLIENT_CERTIFICATES_PUBLIC"
+		}
+		tls_server_name: {
+			env: "CORREDOR_CLIENT_CERTIFICATES_SERVER_NAME"
+		}
+	}
+	title: "Connection to Corredor"
+}

server/app/options/db.cue

@@ -0,0 +1,17 @@
+package options
+
+import (
+	"github.com/cortezaproject/corteza/server/codegen/schema"
+)
+
+DB: schema.#optionsGroup & {
+	handle: "DB"
+	options: {
+		DSN: {
+			defaultValue: "sqlite3://file::memory:?cache=shared&mode=memory"
+			description:  "Database connection string."
+		}
+		
+	}
+	title: "Connection to data store backend"
+}

server/app/options/discovery.cue

@@ -0,0 +1,51 @@
+package options
+
+import (
+	"github.com/cortezaproject/corteza/server/codegen/schema"
+)
+
+discovery: schema.#optionsGroup & {
+	handle: "discovery"
+	options: {
+		enabled: {
+			type:          "bool"
+			defaultGoExpr: "false"
+			description:   "Enable discovery endpoints"
+		}
+		debug: {
+			type:          "bool"
+			defaultGoExpr: "false"
+			description:   "Enable discovery related activity info"
+		}
+		corteza_domain: {
+			type:        "string"
+			description: "Indicates host of corteza compose webapp"
+		}
+		base_url: {
+			type:        "string"
+			description: "Indicates host of corteza discovery server"
+		}
+		embeddings_enabled: {
+			type:          "bool"
+			defaultGoExpr: "false"
+			description:   "Enable discovery embeddings generation"
+		}
+		embeddings_dimension: {
+      type:        "int"
+      description: "Embeddings dimension"
+      defaultGoExpr: "384"
+    }
+    hnsw_ef_construction: {
+      type:        "int"
+      description: "HNSW ef construction parameter"
+      defaultGoExpr: "128"
+    }
+    hnsw_m: {
+      type:        "int"
+      description: "HNSW m parameter"
+      defaultGoExpr: "16"
+    }
+
+	}
+	title: "Discovery"
+}

server/app/options/environment.cue

@@ -0,0 +1,16 @@
+package options
+
+import (
+	"github.com/cortezaproject/corteza/server/codegen/schema"
+)
+
+environment: schema.#optionsGroup & {
+	handle: "environment"
+	options: {
+		environment: {
+			defaultValue: "production"
+			env:          "ENVIRONMENT"
+		}
+	}
+	title: "Environment"
+}

server/app/options/eventbus.cue

@@ -0,0 +1,29 @@
+package options
+
+import (
+	"github.com/cortezaproject/corteza/server/codegen/schema"
+)
+
+eventbus: schema.#optionsGroup & {
+	handle: "eventbus"
+
+	imports: [
+		"\"time\"",
+	]
+
+	options: {
+		scheduler_enabled: {
+			type:          "bool"
+			defaultGoExpr: "true"
+			description:   "Enable eventbus scheduler."
+		}
+		scheduler_interval: {
+			type:        "time.Duration"
+			description: "Set time interval for `eventbus` scheduler."
+
+			defaultGoExpr: "time.Minute"
+			defaultValue:  "60s"
+		}
+	}
+	title: "Events and scheduler"
+}

server/app/options/federation.cue

@@ -0,0 +1,58 @@
+package options
+
+import (
+	"github.com/cortezaproject/corteza/server/codegen/schema"
+)
+
+federation: schema.#optionsGroup & {
+	handle: "federation"
+
+	imports: [
+		"\"time\"",
+	]
+
+	options: {
+		enabled: {
+			type:        "bool"
+			description: "Federation enabled on system, it toggles rest API endpoints, possibility to map modules in Compose and sync itself"
+		}
+		label: {
+			type:         "string"
+			defaultValue: "federated"
+			description:  "Federation label"
+		}
+		host: {
+			type:         "string"
+			defaultValue: "local.cortezaproject.org"
+			description:  "Host that is used during node pairing, also included in invitation"
+		}
+		structure_monitor_interval: {
+			type:          "time.Duration"
+			defaultGoExpr: "time.Minute * 2"
+			defaultValue:  "2m"
+			description:   "Delay in seconds for structure sync"
+			env:           "FEDERATION_SYNC_STRUCTURE_MONITOR_INTERVAL"
+		}
+		structure_page_size: {
+			type:          "int"
+			defaultGoExpr: "1"
+			defaultValue:  "1"
+			description:   "Bulk size in fetching for structure sync"
+			env:           "FEDERATION_SYNC_STRUCTURE_PAGE_SIZE"
+		}
+		data_monitor_interval: {
+			type:          "time.Duration"
+			defaultGoExpr: "time.Minute "
+			defaultValue:  "1m"
+			description:   "Delay in seconds for data sync"
+			env:           "FEDERATION_SYNC_DATA_MONITOR_INTERVAL"
+		}
+		data_page_size: {
+			type:          "int"
+			defaultGoExpr: "100"
+			defaultValue:  "100"
+			description:   "Bulk size in fetching for data sync"
+			env:           "FEDERATION_SYNC_DATA_PAGE_SIZE"
+		}
+	}
+}

server/app/options/http_client.cue

@@ -0,0 +1,39 @@
+package options
+
+import (
+	"github.com/cortezaproject/corteza/server/codegen/schema"
+)
+
+HTTPClient: schema.#optionsGroup & {
+	title: "HTTP Client"
+	// Explicitly define all variants to be 100% compaltible with old name
+	handle: "http-client"
+
+	// @todo remove explcitly defined expIdent and adjust the code
+	expIdent: "HTTPClient"
+
+	imports: [
+		"\"time\"",
+	]
+
+	options: {
+		tls_insecure: {
+			type: "bool"
+			description: """
+				Allow insecure (invalid, expired TLS/SSL certificates) connections.
+
+				[IMPORTANT]
+				====
+				We strongly recommend keeping this value set to false except for local development or demos.
+				====
+				"""
+		}
+		timeout: {
+			type:        "time.Duration"
+			description: "Default timeout for clients."
+
+			defaultGoExpr: "30 * time.Second"
+			defaultValue:  "30s"
+		}
+	}
+}

server/app/options/http_server.cue

@@ -0,0 +1,158 @@
+package options
+
+import (
+	"github.com/cortezaproject/corteza/server/codegen/schema"
+)
+
+HTTPServer: schema.#optionsGroup & {
+	handle: "http-server"
+	title:  "HTTP Server"
+
+	imports: [
+		"\"github.com/cortezaproject/corteza/server/pkg/rand\"",
+	]
+
+	options: {
+		domain: {
+			defaultValue: "localhost"
+			description:  "Domain for the HTTP server."
+			env:          "DOMAIN"
+		}
+		domainWebapp: {
+			defaultValue: "localhost"
+			description:  "Domain for the HTTP webapp."
+			env:          "DOMAIN_WEBAPP"
+		}
+		addr: {
+			defaultValue: ":80"
+			description:  "IP and port for the HTTP server."
+			env:          "HTTP_ADDR"
+		}
+		logRequest: {
+			type:        "bool"
+			description: "Log HTTP requests."
+			env:         "HTTP_LOG_REQUEST"
+		}
+		logResponse: {
+			type:        "bool"
+			description: "Log HTTP responses."
+			env:         "HTTP_LOG_RESPONSE"
+		}
+		tracing: {
+			type: "bool"
+			env:  "HTTP_ERROR_TRACING"
+		}
+		enableHealthcheckRoute: {
+			type:          "bool"
+			defaultGoExpr: "true"
+			env:           "HTTP_ENABLE_HEALTHCHECK_ROUTE"
+		}
+		enableVersionRoute: {
+			type:          "bool"
+			defaultGoExpr: "true"
+			description:   "Enable `/version` route."
+			env:           "HTTP_ENABLE_VERSION_ROUTE"
+		}
+		enableDebugRoute: {
+			type:        "bool"
+			description: "Enable `/debug` route."
+			env:         "HTTP_ENABLE_DEBUG_ROUTE"
+		}
+		enableMetrics: {
+			type:        "bool"
+			description: "Enable (prometheus) metrics."
+			env:         "HTTP_METRICS"
+		}
+		metricsServiceLabel: {
+			defaultValue: "corteza"
+			description:  "Name for metrics endpoint."
+			env:          "HTTP_METRICS_NAME"
+		}
+		metricsUsername: {
+			defaultValue: "metrics"
+			description:  "Username for the metrics endpoint."
+			env:          "HTTP_METRICS_USERNAME"
+		}
+		metricsPassword: {
+			defaultGoExpr: "string(rand.Bytes(5))"
+			description:   "Password for the metrics endpoint."
+			env:           "HTTP_METRICS_PASSWORD"
+		}
+		enablePanicReporting: {
+			type:          "bool"
+			defaultGoExpr: "true"
+			description:   "Report HTTP panic to Sentry."
+			env:           "HTTP_REPORT_PANIC"
+		}
+		baseUrl: {
+			defaultValue: "/"
+			description:  "Base URL (prefix) for all routes (<baseUrl>/auth, <baseUrl>/api, ...)"
+			env:          "HTTP_BASE_URL"
+		}
+		apiEnabled: {
+			type:          "bool"
+			defaultGoExpr: "true"
+			env:           "HTTP_API_ENABLED"
+		}
+		apiBaseUrl: {
+			defaultValue: "/"
+			description: """
+				When webapps are enabled (HTTP_WEBAPP_ENABLED) this is moved to '/api' if not explicitly set otherwise.
+				API base URL is internally prefixed with baseUrl
+				"""
+			env: "HTTP_API_BASE_URL"
+		}
+		webappEnabled: {
+			type: "bool"
+			env:  "HTTP_WEBAPP_ENABLED"
+		}
+		webappBaseUrl: {
+			defaultValue: "/"
+			description:  "Webapp base URL is internally prefixed with baseUrl"
+			env:          "HTTP_WEBAPP_BASE_URL"
+		}
+		webappBaseDir: {
+			defaultValue: "./webapp/public"
+			env:          "HTTP_WEBAPP_BASE_DIR"
+		}
+		webappList: {
+			defaultValue: "admin,compose,workflow,reporter,privacy"
+			env:          "HTTP_WEBAPP_LIST"
+		}
+		sslTerminated: {
+			type:          "bool"
+			defaultGoExpr: "isSecure()"
+			description: """
+				Is SSL termination enabled in ingres, proxy or load balancer that is in front of Corteza?
+				By default, Corteza checks for presence of LETSENCRYPT_HOST environmental variable.
+				This DOES NOT enable SSL termination in Corteza!
+				"""
+			env: "HTTP_SSL_TERMINATED"
+		}
+
+		assets_path: {
+			description: """
+				Corteza will directly serve these assets (static files).
+				When empty path is set (default value), embedded files are used.
+				"""
+		}
+
+		web_console_enabled: {
+			type:          "bool"
+			defaultGoExpr: "false"
+			description:   "Enable web console. When running in dev environment, web console is enabled by default."
+		}
+		web_console_username: {
+			defaultValue: "admin"
+			description:  "Username for the web console endpoint."
+		}
+		web_console_password: {
+			defaultGoExpr: "string(rand.Bytes(32))"
+			description: """
+				Password for the web console endpoint. When running in dev environment, password is not required.
+
+				Corteza intentionally sets default password to random chars to prevent security incidents.
+				"""
+		}
+	}
+}

server/app/options/limit.cue

@@ -0,0 +1,20 @@
+package options
+
+import (
+	"github.com/cortezaproject/corteza/server/codegen/schema"
+)
+
+limit: schema.#optionsGroup & {
+	handle: "limit"
+	options: {
+		system_users: {
+			type:        "int"
+			description: "Maximum number of valid (not deleted, not suspended) users"
+		}
+		record_count_per_module: {
+			type: "int"
+			description:  "Maximum number of records per module"
+		}
+	}
+	title: "Limits"
+}

server/app/options/locale.cue

@@ -0,0 +1,59 @@
+package options
+
+import (
+	"github.com/cortezaproject/corteza/server/codegen/schema"
+)
+
+locale: schema.#optionsGroup & {
+	handle: "locale"
+	options: {
+		languages: {
+			defaultValue: "en"
+			description: """
+				List of comma delimited languages (language tags) to enable.
+				In case when an enabled language can not be loaded, error is logged.
+
+				When loading language configurations (config.xml) from the configured path(s).
+
+				"""
+		}
+
+		path: {
+			description: """
+				One or more paths to locale config and translation files, separated by colon
+
+				When with LOCALE_DEVELOPMENT_MODE=true, default value for path is ../../locale
+			"""
+		}
+
+		query_string_param: {
+			defaultValue: "lng"
+			description: """
+				Name of the query string parameter used to pass the language tag (it overrides Accept-Language header).
+				Set it to empty string to disable detection from the query string.
+				This parameter is ignored if only one language is enabled
+
+				"""
+		}
+
+		resource_translations_enabled: {
+			type:        "bool"
+			description: """
+        When enabled, an editor for resource translations is enabled in UI
+        """
+		}
+
+		log: {
+			type:        "bool"
+			description: "Log locale related events and actions"
+		}
+
+		development_mode: {
+			type: "bool"
+			description: """
+				When enabled, Corteza reloads language files on every request
+				Enable this for debugging or developing.
+				"""
+		}
+	}
+}

server/app/options/log.cue

@@ -0,0 +1,67 @@
+package options
+
+import (
+	"github.com/cortezaproject/corteza/server/codegen/schema"
+)
+
+log: schema.#optionsGroup & {
+	handle: "log"
+	options: {
+		debug: {
+			type: "bool"
+			description: """
+				Disables json format for logging and enables more human-readable output with colors.
+
+				Disable for production.
+
+				"""
+		}
+		level: {
+			defaultValue: "warn"
+			description: """
+				Minimum logging level. If set to "warn",
+				Levels warn, error, dpanic panic and fatal will be logged.
+
+				Recommended value for production: warn
+
+				Possible values: debug, info, warn, error, dpanic, panic, fatal
+
+				"""
+		}
+		filter: {
+			description: """
+				Log filtering rules by level and name (log-level:log-namespace).
+				Please note that level (LOG_LEVEL) is applied before filter and it affects the final output!
+
+				Leave unset for production.
+
+				Example:
+				`warn+:* *:auth,workflow.*`
+				Log warnings, errors, panic, fatals. Everything from auth and workflow is logged.
+
+
+				See more examples and documentation here: https://github.com/moul/zapfilter
+
+				"""
+		}
+		include_caller: {
+			type: "bool"
+			description: """
+				Set to true to see where the logging was called from.
+
+				Disable for production.
+
+				"""
+		}
+		stacktrace_level: {
+			defaultValue: "dpanic"
+			description: """
+				Include stack-trace when logging at a specified level or below.
+				Disable for production.
+
+				Possible values: debug, info, warn, error, dpanic, panic, fatal
+
+				"""
+		}
+	}
+}

server/app/options/messagebus.cue

@@ -0,0 +1,21 @@
+package options
+
+import (
+	"github.com/cortezaproject/corteza/server/codegen/schema"
+)
+
+messagebus: schema.#optionsGroup & {
+	handle: "messagebus"
+	options: {
+		Enabled: {
+			type:          "bool"
+			defaultGoExpr: "true"
+			description:   "Enable messagebus"
+		}
+		log_enabled: {
+			type:        "bool"
+			description: "Enable extra logging for messagebus watchers"
+		}
+	}
+	title: "Messaging queue"
+}

server/app/options/monitor.cue

@@ -0,0 +1,23 @@
+package options
+
+import (
+	"github.com/cortezaproject/corteza/server/codegen/schema"
+)
+
+monitor: schema.#optionsGroup & {
+	handle: "monitor"
+
+	imports: [
+		"\"time\"",
+	]
+
+	options: {
+		interval: {
+			type:          "time.Duration"
+			defaultGoExpr: "5 * time.Minute"
+			defaultValue:  "5m"
+			description:   "Output (log) interval for monitoring."
+		}
+	}
+	title: "Monitoring"
+}

server/app/options/object_store.cue

@@ -0,0 +1,49 @@
+package options
+
+import (
+	"github.com/cortezaproject/corteza/server/codegen/schema"
+)
+
+objectStore: schema.#optionsGroup & {
+	handle: "object-store"
+	title:  "Object (file) storage"
+
+	intro: "The MinIO integration allows you to replace local storage with cloud storage. When configured, `STORAGE_PATH` is not needed."
+	options: {
+		path: {
+			defaultValue: "var/store"
+			description:  "Location where uploaded files are stored."
+			env:          "STORAGE_PATH"
+		}
+		minioEndpoint: {
+			env: "MINIO_ENDPOINT"
+		}
+		minioSecure: {
+			type:          "bool"
+			defaultGoExpr: "true"
+			env:           "MINIO_SECURE"
+		}
+		minioAccessKey: {
+			env: "MINIO_ACCESS_KEY"
+		}
+		minioSecretKey: {
+			env: "MINIO_SECRET_KEY"
+		}
+		minioSSECKey: {
+			env: "MINIO_SSEC_KEY"
+		}
+		minioBucket: {
+			defaultValue: "{component}"
+			description:  "`component` placeholder is replaced with service name (e.g system)."
+			env:          "MINIO_BUCKET"
+		}
+		minioPathPrefix: {
+			description: "`component` placeholder is replaced with service name (e.g system)."
+			env:         "MINIO_PATH_PREFIX"
+		}
+		minioStrict: {
+			type: "bool"
+			env:  "MINIO_STRICT"
+		}
+	}
+}

server/app/options/provision.cue

@@ -0,0 +1,32 @@
+package options
+
+import (
+	"github.com/cortezaproject/corteza/server/codegen/schema"
+)
+
+provision: schema.#optionsGroup & {
+	handle: "provision"
+	options: {
+		always: {
+			type:          "bool"
+			defaultGoExpr: "true"
+			description:   "Controls if provision should run when the server starts."
+		}
+		path: {
+			defaultValue: "provision/*"
+			description:  "Colon seperated paths to config files for provisioning."
+		}
+	}
+	title: "Provisioning"
+	intro: """
+		Provisioning allows you to configure a {PRODUCT_NAME} instance when deployed.
+		It occurs automatically after the {PRODUCT_NAME} server starts.
+
+		[IMPORTANT]
+		====
+		We recommend you to keep provisioning enabled as it simplifies version updates by updating the database and updating settings.
+
+		If you're doing local development or some debugging, you can disable this.
+		====
+		"""
+}

server/app/options/sentry.cue

@@ -0,0 +1,65 @@
+package options
+
+import (
+	"github.com/cortezaproject/corteza/server/codegen/schema"
+)
+
+sentry: schema.#optionsGroup & {
+	handle: "sentry"
+
+	imports: [
+		"\"github.com/cortezaproject/corteza/server/pkg/version\"",
+	]
+
+	title: "Sentry monitoring"
+	intro: """
+		[NOTE]
+		====
+		These parameters help in the development and testing process.
+		When you are deploying to production, these should be disabled to improve performance and reduce storage usage.
+
+		You should configure external services such as Sentry or ELK to keep track of logs and error reports.
+		====
+		"""
+
+	options: {
+		DSN: {
+			description: "Set to enable Sentry client."
+		}
+		debug: {
+			type:        "bool"
+			description: "Print out debugging information."
+		}
+		attach_stacktrace: {
+			type:          "bool"
+			defaultGoExpr: "true"
+			description:   "Attach stacktraces"
+		}
+		sample_rate: {
+			type:        "float64"
+			description: "Sample rate for event submission (0.0 - 1.0. defaults to 1.0)"
+		}
+		max_breadcrumbs: {
+			type:          "int"
+			defaultGoExpr: "0"
+			description:   "Maximum number of breadcrumbs."
+		}
+		server_name: {
+			description: "Set reported Server name."
+			env:         "SENTRY_SERVERNAME"
+		}
+		release: {
+			defaultGoExpr: "version.Version"
+			description:   "Set reported Release."
+		}
+		dist: {
+			description: "Set reported distribution."
+		}
+		environment: {
+			description: "Set reported environment."
+		}
+		webapp_DSN: {
+			description: "Set to enable Sentry client for webapp."
+		}
+	}
+}

server/app/options/template.cue

@@ -0,0 +1,22 @@
+package options
+
+import (
+	"github.com/cortezaproject/corteza/server/codegen/schema"
+)
+
+template: schema.#optionsGroup & {
+	handle: "template"
+	title:  "Rendering engine"
+
+	options: {
+		renderer_gotenberg_address: {
+			defaultGoExpr: ""
+			description:   "Gotenberg rendering container address."
+		}
+
+		renderer_gotenberg_enabled: {
+			type:        "bool"
+			description: "Is Gotenberg rendering container enabled."
+		}
+	}
+}

server/app/options/upgrade.cue

@@ -0,0 +1,25 @@
+package options
+
+import (
+	"github.com/cortezaproject/corteza/server/codegen/schema"
+)
+
+upgrade: schema.#optionsGroup & {
+	handle: "upgrade"
+	title:  "Data store (database) upgrade"
+
+	options: {
+		debug: {
+			type: "bool"
+			description: """
+				Enable/disable debug logging.
+				    To enable debug logging set `UPGRADE_DEBUG=true`.
+				"""
+		}
+		always: {
+			type:          "bool"
+			defaultGoExpr: "true"
+			description:   "Controls if the upgradable systems should be upgraded when the server starts."
+		}
+	}
+}

server/app/options/wait_for.cue

@@ -0,0 +1,76 @@
+package options
+
+import (
+	"github.com/cortezaproject/corteza/server/codegen/schema"
+)
+
+waitFor: schema.#optionsGroup & {
+	handle: "wait-for"
+
+	imports: [
+		"\"time\"",
+	]
+	title: "Delay system startup"
+	intro: """
+		You can configure these options to defer API execution until another external (HTTP) service is up and running.
+
+		[ TIP ]
+		====
+		Delaying API execution can come in handy in complex setups where execution order is important.
+		====
+		"""
+
+	options: {
+		delay: {
+			type: "time.Duration"
+			description: """
+				Delays API startup for the amount of time specified (10s, 2m...).
+				    This delay happens before service (`WAIT_FOR_SERVICES`) probing.
+				"""
+			env: "WAIT_FOR"
+		}
+		status_page: {
+			type:          "bool"
+			defaultGoExpr: "true"
+			description:   "Show temporary status web page."
+			env:           "WAIT_FOR_STATUS_PAGE"
+		}
+
+		services: {
+			description: """
+				Space delimited list of hosts and/or URLs to probe.
+				    Host format: `host` or `host:443` (port will default to 80).
+
+				[NOTE]
+				====
+				Services are probed in parallel.
+				====
+				"""
+			env: "WAIT_FOR_SERVICES"
+		}
+
+		services_timeout: {
+			type:          "time.Duration"
+			defaultGoExpr: "time.Minute"
+			defaultValue:  "1m"
+			description:   "Max time for each service probe."
+			env:           "WAIT_FOR_SERVICES_TIMEOUT"
+		}
+
+		services_probe_timeout: {
+			type:          "time.Duration"
+			defaultGoExpr: "time.Second * 30"
+			defaultValue:  "30s"
+			description:   "Timeout for each service probe."
+			env:           "WAIT_FOR_SERVICES_PROBE_TIMEOUT"
+		}
+
+		services_probe_interval: {
+			type:          "time.Duration"
+			defaultGoExpr: "time.Second * 5"
+			defaultValue:  "5s"
+			description:   "Interval between service probes."
+			env:           "WAIT_FOR_SERVICES_PROBE_INTERVAL"
+		}
+	}
+}

server/app/options/webapp.cue

@@ -0,0 +1,15 @@
+package options
+
+import (
+	"github.com/cortezaproject/corteza/server/codegen/schema"
+)
+
+webapp: schema.#optionsGroup & {
+	handle: "webapp"
+
+	options: {
+		scss_dir_path: {
+			description:  "Path to custom SCSS source files directory"
+		}
+	}
+}

server/app/options/websocket.cue

@@ -0,0 +1,39 @@
+package options
+
+import (
+	"github.com/cortezaproject/corteza/server/codegen/schema"
+)
+
+websocket: schema.#optionsGroup & {
+	handle: "websocket"
+
+	imports: [
+		"\"time\"",
+	]
+	title: "Websocket server"
+
+	options: {
+		log_enabled: {
+			type:        "bool"
+			description: "Enable extra logging for authentication flows"
+		}
+		timeout: {
+			type:        "time.Duration"
+			description: "Time before `WsServer` gets timed out."
+
+			defaultGoExpr: "15 * time.Second"
+			defaultValue:  "15s"
+		}
+		ping_timeout: {
+			type:          "time.Duration"
+			defaultGoExpr: "120 * time.Second"
+			defaultValue:  "120s"
+		}
+		ping_period: {
+			type: "time.Duration"
+
+			defaultGoExpr: "((120 * time.Second) * 9) / 10"
+			defaultValue:  "119s"
+		}
+	}
+}

server/app/options/workflow.cue

@@ -0,0 +1,36 @@
+package options
+
+import (
+	"github.com/cortezaproject/corteza/server/codegen/schema"
+)
+
+workflow: schema.#optionsGroup & {
+	handle: "workflow"
+	options: {
+		register: {
+			type:          "bool"
+			defaultGoExpr: "true"
+			description:   "Registers enabled and valid workflows and executes them when triggered"
+		}
+		exec_debug: {
+			type:        "bool"
+			description: "Enables verbose logging for workflow execution"
+		}
+		call_stack_size: {
+			type:          "int"
+			defaultGoExpr: "16"
+			description:   "Defines the maximum call stack size between workflows"
+		}
+		stack_trace_enabled: {
+			type:          "bool"
+			defaultGoExpr: "true"
+			description:   "Enables execution stack trace construction"
+		}
+		stack_trace_full: {
+			type:          "bool"
+			defaultGoExpr: "false"
+			description:   "Forces the stack trace to record all steps; intended for testing, memory use grows with every executed step"
+		}
+	}
+	title: "Workflow"
+}