9456a4e922
Some checks failed
CI / Run lints and checks (push) Failing after 47s
CI / Run tests (push) Failing after 1s
CI / Run race tests (push) Failing after 5s
CI / Build CLI docs (push) Has been skipped
CI / Run buf actions (push) Failing after 5s
CodeQL / Analyze (go) (push) Failing after 3s
CodeQL / Analyze (javascript) (push) Failing after 2s
Docker Image Scanners / scanners (push) Failing after 3s
Format / format (push) Failing after 3s
Synchronize Issue Labels / Synchronize Issue Labels (push) Has been skipped
CI / Generate release (push) Has been skipped
CI / Draft newsletter (push) Has been skipped
CI / Pending approval Slack notification (push) Has been skipped
CI / Send newsletter (push) Has been skipped
509 lines
20 KiB
JSON
509 lines
20 KiB
JSON
{
|
|
"$id": "https://raw.githubusercontent.com/ory/keto/master/.schema/config.schema.json",
|
|
"$schema": "http://json-schema.org/draft-07/schema#",
|
|
"title": "ORY Keto Configuration",
|
|
"type": "object",
|
|
"definitions": {
|
|
"$schema": {
|
|
"type": "string",
|
|
"format": "uri-reference",
|
|
"description": "Add this to allow defining the schema, useful for IDE integration"
|
|
},
|
|
"namespace": {
|
|
"type": "object",
|
|
"properties": {
|
|
"$schema": {
|
|
"$ref": "#/definitions/$schema"
|
|
},
|
|
"name": {
|
|
"type": "string",
|
|
"title": "The name of the namespace.",
|
|
"examples": ["videos", "groups", "files"]
|
|
},
|
|
"id": {
|
|
"type": "integer",
|
|
"title": "The unique ID of the namespace. Can not be changed once set.",
|
|
"minimum": 0,
|
|
"maximum": 2147483647
|
|
},
|
|
"config": {
|
|
"type": "object",
|
|
"title": "The configuration of the namespace.",
|
|
"description": "To be defined."
|
|
}
|
|
},
|
|
"additionalProperties": false,
|
|
"required": ["name"]
|
|
},
|
|
"tlsxSource": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"path": {
|
|
"title": "Path to PEM-encoded Fle",
|
|
"type": "string",
|
|
"examples": ["path/to/file.pem"]
|
|
},
|
|
"base64": {
|
|
"title": "Base64 Encoded Inline",
|
|
"description": "The base64 string of the PEM-encoded file content. Can be generated using for example `base64 -i path/to/file.pem`.",
|
|
"type": "string",
|
|
"examples": [
|
|
"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tXG5NSUlEWlRDQ0FrMmdBd0lCQWdJRVY1eE90REFOQmdr..."
|
|
]
|
|
}
|
|
}
|
|
},
|
|
"tlsx": {
|
|
"title": "HTTPS",
|
|
"description": "Configure HTTP over TLS (HTTPS). All options can also be set using environment variables by replacing dots (`.`) with underscores (`_`) and uppercasing the key. For example, `some.prefix.tls.key.path` becomes `export SOME_PREFIX_TLS_KEY_PATH`. If all keys are left undefined, TLS will be disabled.",
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"key": {
|
|
"title": "Private Key (PEM)",
|
|
"allOf": [
|
|
{
|
|
"$ref": "#/definitions/tlsxSource"
|
|
}
|
|
]
|
|
},
|
|
"cert": {
|
|
"title": "TLS Certificate (PEM)",
|
|
"allOf": [
|
|
{
|
|
"$ref": "#/definitions/tlsxSource"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
},
|
|
"cors": {
|
|
"title": "Cross Origin Resource Sharing (CORS)",
|
|
"description": "Configure [Cross Origin Resource Sharing (CORS)](http://www.w3.org/TR/cors/) using the following options.",
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean",
|
|
"default": false,
|
|
"title": "Enable CORS",
|
|
"description": "If set to true, CORS will be enabled and preflight-requests (OPTION) will be answered."
|
|
},
|
|
"allowed_origins": {
|
|
"title": "Allowed Origins",
|
|
"description": "A list of origins a cross-domain request can be executed from. If the special * value is present in the list, all origins will be allowed. An origin may contain a wildcard (*) to replace 0 or more characters (i.e.: http://*.domain.com). Usage of wildcards implies a small performance penality. Only one wildcard can be used per origin.",
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"default": ["*"],
|
|
"uniqueItems": true,
|
|
"examples": [
|
|
[
|
|
"https://example.com",
|
|
"https://*.example.com",
|
|
"https://*.foo.example.com"
|
|
]
|
|
]
|
|
},
|
|
"allowed_methods": {
|
|
"type": "array",
|
|
"title": "Allowed HTTP Methods",
|
|
"description": "A list of methods the client is allowed to use with cross-domain requests.",
|
|
"items": {
|
|
"type": "string",
|
|
"enum": [
|
|
"GET",
|
|
"HEAD",
|
|
"POST",
|
|
"PUT",
|
|
"DELETE",
|
|
"CONNECT",
|
|
"TRACE",
|
|
"PATCH"
|
|
]
|
|
},
|
|
"uniqueItems": true,
|
|
"default": ["GET", "POST", "PUT", "PATCH", "DELETE"]
|
|
},
|
|
"allowed_headers": {
|
|
"description": "A list of non simple headers the client is allowed to use with cross-domain requests.",
|
|
"title": "Allowed Request HTTP Headers",
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"minLength": 1,
|
|
"uniqueItems": true,
|
|
"default": ["Authorization", "Content-Type"]
|
|
},
|
|
"exposed_headers": {
|
|
"description": "Indicates which headers are safe to expose to the API of a CORS API specification",
|
|
"title": "Allowed Response HTTP Headers",
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"minLength": 1,
|
|
"uniqueItems": true,
|
|
"default": ["Content-Type"]
|
|
},
|
|
"allow_credentials": {
|
|
"type": "boolean",
|
|
"title": "Allow HTTP Credentials",
|
|
"default": false,
|
|
"description": "Indicates whether the request can include user credentials like cookies, HTTP authentication or client side SSL certificates."
|
|
},
|
|
"max_age": {
|
|
"type": "integer",
|
|
"default": 0,
|
|
"title": "Maximum Age",
|
|
"description": "Indicates how long (in seconds) the results of a preflight request can be cached. The default is 0 which stands for no max age."
|
|
},
|
|
"debug": {
|
|
"type": "boolean",
|
|
"default": false,
|
|
"title": "Enable Debugging",
|
|
"description": "Set to true to debug server side CORS issues."
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"required": ["dsn"],
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"$schema": {
|
|
"$ref": "#/definitions/$schema"
|
|
},
|
|
"dsn": {
|
|
"title": "Data Source Name",
|
|
"type": "string",
|
|
"description": "Sets the data source name. This configures the backend where ORY Keto persists data. If dsn is \"memory\", data will be written to memory and is lost when you restart this instance. ORY Hydra supports popular SQL databases. For more detailed configuration information go to: https://www.ory.com/docs/hydra/dependencies-environment#sql",
|
|
"examples": [
|
|
"postgres://user:password@host:123/database",
|
|
"mysql://user:password@tcp(host:123)/database",
|
|
"memory"
|
|
]
|
|
},
|
|
"serve": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"read": {
|
|
"type": "object",
|
|
"title": "Read API (http and gRPC)",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"port": {
|
|
"type": "integer",
|
|
"default": 4466,
|
|
"title": "Port",
|
|
"description": "The port to listen on.",
|
|
"minimum": 0,
|
|
"maximum": 65535
|
|
},
|
|
"host": {
|
|
"type": "string",
|
|
"default": "",
|
|
"examples": ["localhost", "127.0.0.1"],
|
|
"title": "Host",
|
|
"description": "The network interface to listen on."
|
|
},
|
|
"write_listen_file": {
|
|
"type": "string",
|
|
"title": "Read Listen File",
|
|
"description": "The path to a file that will be created when the read API is ready to accept connections. The content of the file is the host:port of the read API. Use this to get the actual port when using port 0. The service might not yet be ready to accept connections when the file is created.",
|
|
"format": "uri",
|
|
"examples": ["file:///tmp/keto-read-api"]
|
|
},
|
|
"cors": {
|
|
"$ref": "#/definitions/cors"
|
|
},
|
|
"tls": {
|
|
"$ref": "#/definitions/tlsx"
|
|
}
|
|
}
|
|
},
|
|
"write": {
|
|
"type": "object",
|
|
"title": "Write API (http and gRPC)",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"port": {
|
|
"type": "integer",
|
|
"default": 4467,
|
|
"title": "Port",
|
|
"description": "The port to listen on.",
|
|
"minimum": 0,
|
|
"maximum": 65535
|
|
},
|
|
"host": {
|
|
"type": "string",
|
|
"default": "",
|
|
"examples": ["localhost", "127.0.0.1"],
|
|
"title": "Host",
|
|
"description": "The network interface to listen on."
|
|
},
|
|
"write_listen_file": {
|
|
"type": "string",
|
|
"title": "Write Listen File",
|
|
"description": "The path to a file that will be created when the write API is ready to accept connections. The content of the file is the host:port of the write API. Use this to get the actual port when using port 0. The service might not yet be ready to accept connections when the file is created.",
|
|
"format": "uri",
|
|
"examples": ["file:///tmp/keto-write-api"]
|
|
},
|
|
"cors": {
|
|
"$ref": "#/definitions/cors"
|
|
},
|
|
"tls": {
|
|
"$ref": "#/definitions/tlsx"
|
|
}
|
|
}
|
|
},
|
|
"metrics": {
|
|
"type": "object",
|
|
"title": "Metrics API (http only)",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"port": {
|
|
"type": "integer",
|
|
"default": 4468,
|
|
"title": "Port",
|
|
"description": "The port to listen on.",
|
|
"minimum": 0,
|
|
"maximum": 65535
|
|
},
|
|
"host": {
|
|
"type": "string",
|
|
"default": "",
|
|
"examples": ["localhost", "127.0.0.1"],
|
|
"title": "Host",
|
|
"description": "The network interface to listen on."
|
|
},
|
|
"write_listen_file": {
|
|
"type": "string",
|
|
"title": "Metrics Listen File",
|
|
"description": "The path to a file that will be created when the metrics API is ready to accept connections. The content of the file is the host:port of the metrics API. Use this to get the actual port when using port 0. The service might not yet be ready to accept connections when the file is created.",
|
|
"format": "uri",
|
|
"examples": ["file:///tmp/keto-metrics-api"]
|
|
},
|
|
"cors": {
|
|
"$ref": "#/definitions/cors"
|
|
},
|
|
"tls": {
|
|
"$ref": "#/definitions/tlsx"
|
|
}
|
|
}
|
|
},
|
|
"opl": {
|
|
"type": "object",
|
|
"title": "Ory Permission Language Syntax API (http and gRPC)",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"port": {
|
|
"type": "integer",
|
|
"default": 4469,
|
|
"title": "Port",
|
|
"description": "The port to listen on.",
|
|
"minimum": 0,
|
|
"maximum": 65535
|
|
},
|
|
"host": {
|
|
"type": "string",
|
|
"default": "",
|
|
"examples": ["localhost", "127.0.0.1"],
|
|
"title": "Host",
|
|
"description": "The network interface to listen on."
|
|
},
|
|
"write_listen_file": {
|
|
"type": "string",
|
|
"title": "OPL Listen File",
|
|
"description": "The path to a file that will be created when the OPL API is ready to accept connections. The content of the file is the host:port of the OPL API. Use this to get the actual port when using port 0. The service might not yet be ready to accept connections when the file is created.",
|
|
"format": "uri",
|
|
"examples": ["file:///tmp/keto-opl-api"]
|
|
},
|
|
"cors": {
|
|
"$ref": "#/definitions/cors"
|
|
},
|
|
"tls": {
|
|
"$ref": "#/definitions/tlsx"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"profiling": {
|
|
"title": "Profiling",
|
|
"description": "Enables CPU or memory profiling if set. For more details on profiling Go programs read [Profiling Go Programs](https://blog.golang.org/profiling-go-programs).",
|
|
"type": "string",
|
|
"enum": ["cpu", "mem", ""]
|
|
},
|
|
"log": {
|
|
"$ref": "ory://logging-config"
|
|
},
|
|
"tracing": {
|
|
"$ref": "ory://tracing-config"
|
|
},
|
|
"namespaces": {
|
|
"description": "Namespace configuration or it's location.",
|
|
"default": "file://./keto_namespaces",
|
|
"oneOf": [
|
|
{
|
|
"title": "Legacy namespace Repo URI",
|
|
"description": "A URI that points to a directory of namespace files, or a single file with all namespaces",
|
|
"type": "string",
|
|
"format": "uri"
|
|
},
|
|
{
|
|
"type": "array",
|
|
"title": "Legacy namespace configuration",
|
|
"items": {
|
|
"$ref": "#/definitions/namespace"
|
|
}
|
|
},
|
|
{
|
|
"type": "object",
|
|
"title": "Namespace configuration",
|
|
"properties": {
|
|
"location": {
|
|
"type": "string",
|
|
"title": "Ory Permission Language config file URI",
|
|
"description": "A URI that points to a directory of namespace files, or a single file with all namespaces",
|
|
"format": "uri",
|
|
"examples": [
|
|
"file://./keto_namespaces.ts",
|
|
"file:///etc/configs/keto_namespaces.ts"
|
|
]
|
|
},
|
|
"experimental_strict_mode": {
|
|
"type": "boolean",
|
|
"title": "Strict permission checking mode (deprecated)",
|
|
"description": "Deprecated: use feature_flags.strict_mode instead. If strict mode is enabled, then relation tuples for permits are not checked directly (but the rewrites are applied). Similarly, subject sets are only expanded if they were declared with SubjectSet<...>. These stricter rules result in much faster checks with fewer queries to the underlying database."
|
|
}
|
|
},
|
|
"additionalProperties": false,
|
|
"required": ["location"]
|
|
}
|
|
]
|
|
},
|
|
"limit": {
|
|
"type": "object",
|
|
"title": "Limits",
|
|
"description": "Limits aiming to control the resource consumption. These limits are not a sufficient replacement for rate-limiting.",
|
|
"properties": {
|
|
"max_read_depth": {
|
|
"type": "integer",
|
|
"default": 5,
|
|
"title": "Global maximum read depth",
|
|
"description": "The global maximum depth on all read operations. Note that this does not affect how deeply nested the tuples can be. This value can be decreased for a request by a value specified on the request, only if the request-specific value is greater than 1 and less than the global maximum depth.",
|
|
"minimum": 1,
|
|
"maximum": 65535
|
|
},
|
|
"max_read_width": {
|
|
"type": "integer",
|
|
"default": 100,
|
|
"title": "Global maximum read width",
|
|
"description": "The global maximum width on all read operations. Note that this does not affect how deeply nested the tuples can be. This value can be decreased for a request by a value specified on the request, only if the request-specific value is greater than 1 and less than the global maximum width.",
|
|
"minimum": 1,
|
|
"maximum": 65535
|
|
},
|
|
"max_batch_check_size": {
|
|
"type": "integer",
|
|
"default": 10,
|
|
"title": "Maximum batch check size",
|
|
"description": "The maximum number of tuples that will be accepted by the batch check endpoint.",
|
|
"minimum": 1,
|
|
"maximum": 65535
|
|
},
|
|
"batch_check_max_parallelization": {
|
|
"type": "integer",
|
|
"default": 5,
|
|
"title": "Max concurrent checks during batch check",
|
|
"description": "The limit for the number of tuples that will be checked concurrently during a batch check.",
|
|
"minimum": 1,
|
|
"maximum": 65535
|
|
},
|
|
"max_expand_size": {
|
|
"type": "integer",
|
|
"default": 4000,
|
|
"title": "Maximum tuples during expand",
|
|
"description": "The maximum total number of relation tuples the expand engine will return in a single BuildTree call. Once the limit is reached, further nodes are returned as truncated.",
|
|
"minimum": 0,
|
|
"maximum": 65535
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"clients": {
|
|
"title": "Global outgoing network settings",
|
|
"description": "Configure how outgoing network calls behave.",
|
|
"type": "object",
|
|
"properties": {
|
|
"http": {
|
|
"title": "Global HTTP client configuration",
|
|
"description": "Configure how outgoing HTTP calls behave.",
|
|
"type": "object",
|
|
"properties": {
|
|
"disallow_private_ip_ranges": {
|
|
"title": "Disallow private IP ranges",
|
|
"description": "Disallow all outgoing HTTP calls to private IP ranges. This feature can help protect against SSRF attacks.",
|
|
"type": "boolean",
|
|
"default": false
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"secrets": {
|
|
"title": "Secrets for signing and encryption",
|
|
"description": "Make sure to use unique and random secrets for production deployments. Horizontally scaled deployments have to use the same secrets across all instances.",
|
|
"type": "object",
|
|
"properties": {
|
|
"pagination": {
|
|
"description": "Pagination secrets are used to encrypt pagination tokens. The first secret is used for encryption, while all others are used for decryption. This allows you to rotate the encryption key without invalidating all existing pagination tokens.",
|
|
"type": "array",
|
|
"minLength": 1,
|
|
"items": {
|
|
"type": "string",
|
|
"minLength": 16
|
|
},
|
|
"examples": [
|
|
[
|
|
"secret used for encryption",
|
|
"old secret kept for decryption",
|
|
"another old secret kept for decryption"
|
|
]
|
|
]
|
|
}
|
|
}
|
|
},
|
|
"feature_flags": {
|
|
"title": "Feature flags",
|
|
"description": "Opt in to features that are still being refined. Behavior may change in future releases.",
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"expand_rewrites": {
|
|
"type": "boolean",
|
|
"title": "Expand OPL rewrite rules",
|
|
"description": "If enabled, the expand API follows OPL rewrite rules when building permission trees.",
|
|
"default": false
|
|
},
|
|
"strict_mode": {
|
|
"type": "boolean",
|
|
"title": "Strict permission checking mode",
|
|
"description": "If strict mode is enabled, then relation tuples for permits are not checked directly (but the rewrites are applied). Similarly, subject sets are only expanded if they were declared with SubjectSet<...>. These stricter rules result in much faster checks with fewer queries to the underlying database.",
|
|
"default": false
|
|
}
|
|
}
|
|
},
|
|
"version": {
|
|
"type": "string",
|
|
"title": "The Keto version this config is written for.",
|
|
"description": "SemVer according to https://semver.org/ prefixed with `v` as in our releases.",
|
|
"pattern": "^v(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?$"
|
|
}
|
|
}
|
|
}
|